SC-900 Practice Test 31 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to protect hybrid workloads. A security administrator needs to ensure that all Azure subscriptions are automatically covered by Defender for Cloud's security policies. What should the administrator configure?

Accepted Answer

Assign the Azure Security Benchmark initiative to the root management group.. Defender for Cloud's default policy initiative is automatically assigned to all subscriptions in a management group, ensuring consistent coverage. Option A is incorrect because assigning at the resource group level does not apply to other groups. Option B is incorrect because Azure Policy must be assigned, not just enabled. Option D is incorrect because manual onboarding is not automatic.

Answer

Assign the Azure Security Benchmark initiative to each resource group.

Answer

Enable Defender for Cloud on each subscription individually.

Answer

Install the Log Analytics agent on all VMs.

Question 2

Which THREE capabilities are provided by Microsoft Purview? (Choose three.)

Accepted Answer

Data classification and labeling. Microsoft Purview offers data classification, data loss prevention, and data lifecycle management. Option D is a Microsoft Entra feature; Option E is a Microsoft Defender feature.

Answer

Identity protection and risk detection

Answer

Threat and vulnerability management

Question 3

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel analytics rule. What is the primary purpose of this rule?

Accepted Answer

To detect when a file labeled 'Highly Confidential' is shared externally. The query filters alerts for 'Sensitive file shared externally' and further refines to files with SensitivityLabel 'Highly Confidential'. It projects the file name and owner. Option C is correct. Option A is too broad (any shared file). Option B mentions 'all alerts'. Option D is incorrect because the query does not block sharing.

Answer

To identify all files shared externally regardless of sensitivity

Answer

To automatically block external sharing of sensitive files

Answer

To list all alerts generated by the rule

Question 4

Your organization is deploying Microsoft Defender for Cloud Apps to protect against cloud app threats. You need to ensure that users are prompted for authentication when accessing a sanctioned cloud app from an unmanaged device. Which policy type should you configure?

Accepted Answer

Session policy. Option B is correct because session policies (now called app session policies in Defender for Cloud Apps) allow you to monitor and control user sessions in real-time, including requiring authentication for access from unmanaged devices. Option A is wrong because access policies control access based on conditions but do not provide session-level control. Option C is wrong because activity policies trigger alerts and actions based on activities but not session-level authentication. Option D is wrong because anomaly detection policies detect suspicious behavior but do not enforce access controls.

Answer

Activity policy

Answer

Access policy

Answer

Anomaly detection policy

Question 5

Which THREE actions can Microsoft Sentinel perform as part of automated incident response using playbooks?

Accepted Answer

Block an IP address on a firewall. Option A is correct because playbooks can create incidents in other systems. Option B is correct because playbooks can block IP addresses. Option C is correct because playbooks can reset user passwords. Option D is wrong because playbooks cannot directly modify firewall rules; they can trigger automation. Option E is wrong because playbooks cannot automatically install software.

Answer

Install anti-malware software on a device

Answer

Modify a network security group rule

Question 6

A company uses Microsoft Purview to classify and label data. The compliance team needs to automatically apply a 'Highly Confidential' sensitivity label to any document containing a passport number that is stored in SharePoint Online. The label should also encrypt the document. What should the compliance team configure?

Accepted Answer

Create an auto-labeling policy for sensitivity labels. Option D is correct because an auto-labeling policy can be set to scan SharePoint for content containing a passport number and apply a label with encryption. Option A is wrong because manual labeling is not automatic. Option B is wrong because a DLP policy blocks sharing but does not apply labels. Option C is wrong because a retention label is for retention, not encryption.

Answer

Create a retention label with a retention rule

Answer

Create a data loss prevention (DLP) policy

Answer

Create a manual sensitivity label and train users

Question 7

A company uses Microsoft Purview Data Lifecycle Management. To comply with regulatory requirements, the company must retain financial records for 7 years and then delete them. Which THREE actions should the company configure? (Select THREE.)

Accepted Answer

Create a retention label with a retention period of 7 years. Options A, B, and D are correct: Create a retention label for 7 years, auto-apply the label to financial content, and configure a disposition review for deletion. Option C is wrong because a DLP policy is for preventing data loss, not lifecycle management. Option E is wrong because a retention policy is for the entire location, not specific content.

Answer

Create a data loss prevention policy

Answer

Create a retention policy for the entire SharePoint site

Question 8

Your organization uses Microsoft Purview to manage data sensitivity and compliance. Which TWO capabilities are provided by Microsoft Purview Information Protection?

Accepted Answer

Create and publish sensitivity labels that can be applied to documents and emails.. Microsoft Purview Information Protection includes sensitivity labels and data classification. Data Loss Prevention (DLP) is a separate policy, and insider risk management is a different solution. Retention policies are part of Microsoft Purview Records Management.

Answer

Define retention labels to keep data for a specified period.

Answer

Detect and manage insider risk activities such as data theft by employees.

Answer

Enforce Data Loss Prevention (DLP) policies to prevent accidental sharing of sensitive data.

Question 9

An organization uses Microsoft Intune to manage devices. The security team wants to ensure that only devices with a minimum OS version and antivirus enabled can access corporate email. What should they configure?

Accepted Answer

Conditional Access policy referencing device compliance. Conditional Access with device compliance policies evaluates device health and enforces access controls. Option A is incorrect because compliance policies alone do not enforce access. Option C is incorrect because app protection policies manage data within apps, not device-level access. Option D is incorrect because device enrollment is a prerequisite, not enforcement.

Answer

Device enrollment restrictions

Answer

App protection policies in Microsoft Defender for Cloud Apps

Answer

A device compliance policy

Question 10

A security administrator needs to enforce that all Microsoft 365 documents containing credit card numbers are automatically encrypted before being shared externally. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Data Loss Prevention (DLP) policies can detect sensitive information like credit card numbers and automatically apply encryption. Option C is correct. Option A (Information Protection) applies labels but does not auto-encrypt based on content. Option B (Audit) logs events. Option D (Communication Compliance) monitors communications.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Information Protection

Question 11

Which TWO actions can be performed using Microsoft Entra Identity Governance? (Choose two.)

Accepted Answer

Automate user lifecycle workflows. Identity Governance includes access reviews and entitlement management. Option B (assign roles via PIM) is Privileged Identity Management, which is part of Identity Governance. Option C (lifecycle workflows) is also part of Identity Governance. Option A (SSPR) is separate. Option E (Conditional Access) is not part of Identity Governance.

Answer

Configure self-service password reset

Answer

Reset user passwords

Answer

Create conditional access policies

Question 12

Your company uses Microsoft Sentinel to centralize security event monitoring. You need to create a custom analytics rule that triggers an alert when a user account is created outside of business hours. Which rule type should you use?

Accepted Answer

Scheduled query analytics rule. Option D is correct because scheduled query rules run on a schedule and can detect patterns like account creation outside business hours. Option A is wrong because NRT rules are for near-real-time detection but are limited in logic. Option B is wrong because Microsoft Security incident creation rules create incidents from other alerts. Option C is wrong because Anomaly rules use ML for behavioral anomalies, not specific conditions.

Answer

Microsoft Security incident creation rule

Answer

Anomaly analytics rule

Answer

Near-real-time (NRT) analytics rule

Question 13

A company uses Microsoft Sentinel for security information and event management (SIEM). The security team needs to detect and automatically respond to a potential privilege escalation attack where an attacker attempts to add a new user to the Global Administrator role in Microsoft Entra ID. What should the security team configure?

Accepted Answer

Create an analytics rule with an automated playbook in Microsoft Sentinel. Option D is correct because Microsoft Sentinel can create analytics rules to detect the event and automated response using playbooks. Option A is wrong because Microsoft Defender for Cloud Apps handles cloud app security, not Entra ID role changes. Option B is wrong because Microsoft Purview is for data governance. Option C is wrong because Microsoft Intune manages devices, not identity roles.

Answer

Deploy a device compliance policy in Microsoft Intune

Answer

Configure a data classification label in Microsoft Purview

Answer

Create a policy in Microsoft Defender for Cloud Apps

Question 14

Your company uses Microsoft 365 Copilot to assist employees with drafting emails and documents. The security team needs to ensure that when Copilot accesses sensitive data, it respects the organization's sensitivity labels and does not expose highly confidential information to unauthorized users. What should the security team configure?

Accepted Answer

Apply Microsoft Purview sensitivity labels to data and enable Copilot data protection. Option D is correct because Microsoft Purview sensitivity labels are integrated with Microsoft 365 Copilot to enforce data protection. Option A is wrong because Copilot is already integrated with Microsoft 365. Option B is wrong because data loss prevention policies block sharing but do not control Copilot access. Option C is wrong because Microsoft Defender for Cloud Apps is for cloud app security, not Copilot.

Answer

Configure Microsoft Defender for Cloud Apps session policies

Answer

Disable Copilot for all users

Answer

Create a data loss prevention policy that blocks Copilot

Question 15

Your organization uses Microsoft Purview to label and protect sensitive data. The compliance team wants to automatically apply a 'Confidential' label to documents containing personally identifiable information (PII) stored in SharePoint Online. What should they create?

Accepted Answer

An auto-labeling policy for sensitivity labels. Auto-labeling policies can automatically apply sensitivity labels to documents based on sensitive information types. Option B is incorrect because retention labels are for retention. Option C is incorrect because trainable classifiers are for pattern detection but do not apply labels automatically. Option D is incorrect because DLP policies block actions.

Answer

A DLP policy to detect PII

Answer

A trainable classifier for PII

Answer

A retention label policy for PII