SC-900 Practice Test 30 — 15 Questions

Question 1

Refer to the exhibit. You are creating a Microsoft Purview sensitivity label for HR data. The JSON shows a label configuration. What is the likely effect of setting the sensitivity value to 90?

Accepted Answer

The label will be applied with higher priority than labels with lower sensitivity values. Option B is correct because in Microsoft Purview, higher sensitivity values indicate higher priority, and labels with higher sensitivity can auto-classify and override lower labels. Option A is wrong because sensitivity doesn't directly control encryption. Option C is wrong because sensitivity doesn't affect retention. Option D is wrong because sensitivity doesn't determine audit logging.

Answer

The label automatically encrypts the document

Answer

The label triggers auditing for 90 days

Answer

The label sets a 90-day retention period

Question 2

A company uses Microsoft Purview to map their data estate. They need to classify data stored in Azure SQL Database and Amazon S3. What should they use?

Accepted Answer

Microsoft Purview Data Map. Option B is correct because Purview can scan and classify data across on-premises and multi-cloud sources. Option A is wrong because Defender for Cloud focuses on security posture. Option C is wrong because Sentinel is for SIEM. Option D is wrong because Intune is for device management.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 3

A company wants to use Microsoft Entra ID (Azure AD) to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. Which security feature should they implement?

Accepted Answer

Conditional Access policies. Conditional Access policies allow administrators to require MFA based on conditions like application sensitivity. Option B is incorrect because Identity Protection detects risk, not enforces MFA. Option C is incorrect because Privileged Identity Management (PIM) manages access for privileged roles. Option D is incorrect because password protection prevents weak passwords.

Answer

Privileged Identity Management (PIM)

Answer

Password Protection

Answer

Identity Protection policies

Question 4

You are troubleshooting a Conditional Access policy in Microsoft Entra ID. The policy in the exhibit is not blocking some sign-ins that you expected to block. What is the most likely reason?

Accepted Answer

The policy only blocks based on user risk, not sign-in risk. Option B is correct because the policy only blocks based on user risk level 'high', not sign-in risk. Sign-ins with high sign-in risk but low user risk are not blocked. Option A is wrong because there is no exclude clause. Option C is wrong because the policy does block. Option D is wrong because the policy is not assigned to a user group in this snippet.

Answer

The policy is not assigned to any users

Answer

The grant control is set to allow access

Answer

The policy excludes certain users

Question 5

Which TWO capabilities are provided by Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Secure score and security recommendations. Options A and D are correct. Defender for Cloud provides vulnerability assessment and security posture management. Option B is wrong because CASB is Defender for Cloud Apps. Option C is wrong because SIEM is Sentinel. Option E is wrong because endpoint protection is Defender for Endpoint.

Answer

Endpoint detection and response (EDR)

Answer

Cloud Access Security Broker (CASB)

Answer

Security Information and Event Management (SIEM)

Question 6

Refer to the exhibit. A security analyst in your SOC runs the provided KQL query in Microsoft Sentinel to identify users with repeated MFA or suspicious sign-in alerts. The query returns no results even though alerts exist. What is the most likely issue?

Accepted Answer

The alert names do not contain the strings 'MFA' or 'Suspicious sign-in'.. The query uses the 'has' operator which is case-insensitive, but the alert names in the environment might use different wording (e.g., 'Azure AD MFA' instead of 'MFA'). Option A is incorrect because the query uses 'has' which is case-insensitive. Option C is incorrect because the time range is 7 days. Option D is incorrect because the query correctly uses 'extend'.

Answer

The 'extend' operator fails because 'Entities' array is empty.

Answer

The TimeGenerated filter is too restrictive; alerts older than 7 days are excluded.

Answer

The 'has' operator is case-sensitive and the alert names are in uppercase.

Question 7

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to identify resources that are missing system updates. Which feature should they use?

Accepted Answer

Secure Score recommendations. Defender for Cloud's Secure Score includes recommendations for missing system updates. Option B is incorrect because vulnerability assessment is for vulnerabilities, not updates. Option C is incorrect because just-in-time access is for management ports. Option D is incorrect because adaptive application controls allowlist applications.

Answer

Just-in-time VM access

Answer

Vulnerability assessment solutions

Answer

Adaptive application controls

Question 8

Which TWO Microsoft Purview solutions can help detect and prevent data exfiltration?

Accepted Answer

Microsoft Purview Insider Risk Management. Data Loss Prevention (DLP) and Insider Risk Management are both designed to detect and prevent data exfiltration. Option A (Audit) logs but does not prevent. Option E (Compliance Manager) manages compliance posture. Option D (eDiscovery) is for legal discovery.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview eDiscovery

Question 9

Your company has Microsoft Defender for Office 365 and wants to configure anti-phishing policies to protect against spear-phishing attacks targeting executives. Which policy setting should you enable to provide the highest level of protection?

Accepted Answer

Impersonation protection for users. Option C is correct because impersonation protection specifically protects against spear-phishing attacks targeting specific users like executives. Option A is wrong because spoof intelligence detects spoofed domains but not user impersonation. Option B is wrong because bulk email filtering reduces bulk mail but not targeted phishing. Option D is wrong because malware filter handles attachments with malware, not phishing.

Answer

Malware filter

Answer

Bulk email filtering

Answer

Spoof intelligence

Question 10

Refer to the exhibit. You run the PowerShell command to retrieve a conditional access policy's conditions. The output shows Applications: All, Users: All, and Locations: All trusted. You need to ensure that only trusted locations are used when accessing Microsoft 365. What change should you make?

Accepted Answer

Modify the Locations condition to include all trusted locations and exclude untrusted locations. Option C is correct because the current policy applies to all locations (including untrusted) but requires trusted? Actually the condition says Locations: All trusted, meaning it only applies to trusted locations? The stem says 'ensure that only trusted locations are used' meaning block untrusted. The exhibit says Locations: All trusted? That would apply only to trusted locations. To enforce only trusted locations, you should change Locations to 'All' and then grant access only from trusted locations. Wait, re-reading: 'All trusted' likely means the condition includes all trusted locations? The right answer is to modify the condition to exclude untrusted locations. Option C is correct: modify the Locations condition to include trusted and exclude untrusted. Option A is wrong because blocking legacy auth doesn't affect locations. Option B is wrong because grant controls are not about location. Option D is wrong because sign-in frequency doesn't control locations.

Answer

Add a condition to block legacy authentication

Answer

Under Grant, require multi-factor authentication

Answer

Set sign-in frequency to 4 hours

Question 11

Refer to the exhibit. You are evaluating a custom Azure Policy definition. The policy is intended to audit whether users assigned to a management role have MFA enabled. However, the policy is not triggering alerts for non-compliant users. What is the most likely cause?

Accepted Answer

The 'mfaEnabledPrincipals' parameter is not populated with the list of MFA-enabled users.. The policy uses 'auditIfNotExists' but the existenceCondition checks if the principal ID is in the 'mfaEnabledPrincipals' parameter. This parameter must be populated with the list of principals that have MFA enabled, but the policy does not automatically detect MFA status. Option A is incorrect because the mode is 'All', which includes role assignments. Option C is incorrect because the policy does check for role assignments. Option D is incorrect because the audit effect does not require remediation.

Answer

The policy mode is set to 'All' instead of 'Indexed'.

Answer

The policy only evaluates role assignments of type 'Microsoft.Authorization/roleAssignments' but not users.

Answer

The effect 'auditIfNotExists' should be 'deny' to trigger alerts.

Question 12

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security information and event management (SIEM). Microsoft Sentinel provides SIEM and SOAR capabilities. Option A is a capability; Option B is a capability; Option C is a Microsoft Entra feature; Option D is a Microsoft Defender feature; Option E is a Microsoft Purview feature.

Answer

Identity governance and administration

Answer

Endpoint detection and response (EDR)

Answer

Data classification and labeling

Question 13

Your organization wants to prevent users from installing unapproved apps on company-managed Windows devices. Which Microsoft Intune feature should you use?

Accepted Answer

App control policies. Intune app protection policies (APP) protect data, but app control policies (e.g., Windows Defender Application Control) prevent unapproved apps. Option D is correct. Option A (Conditional Access) controls access, not app installation. Option B (Compliance policies) check settings. Option C (Device configuration) manages settings but not app installation control.

Answer

Device configuration profiles

Answer

Conditional Access

Answer

Device compliance policies

Question 14

Your company uses Microsoft Intune to manage devices. You need to ensure that only devices that are compliant with your security policies can access corporate email via Microsoft Outlook. What should you implement?

Accepted Answer

Conditional Access policies. Option C is correct because Conditional Access policies in Entra ID can enforce device compliance as a condition for accessing cloud apps like Exchange Online. Option A is wrong because app protection policies protect data within apps but do not control access based on device compliance. Option B is wrong because device compliance policies define compliance requirements but do not enforce access control. Option D is wrong because Windows Information Protection (WIP) protects corporate data on devices but does not control access to email.

Answer

Windows Information Protection

Answer

Device compliance policies

Answer

App protection policies

Question 15

Which TWO features are part of Microsoft Defender XDR?

Accepted Answer

Automated investigation and response. Option A is correct because Microsoft Defender XDR includes incident management. Option C is correct because it includes automated investigation and response. Option B is wrong because cloud app security is part of Defender for Cloud Apps, not XDR. Option D is wrong because identity protection is part of Entra ID Protection. Option E is wrong because endpoint DLP is part of Microsoft Purview.

Answer

Cloud app discovery

Answer

Endpoint data loss prevention

Answer

Identity Protection

SC-900 Practice Test 30 — 15 Questions

Exhibit

SC-900 Practice Test 30 — 15 Questions

Exhibit