SC-900 Practice Test 31 — 15 Questions

Question 1

Your organization has deployed Microsoft Intune for mobile device management. You need to ensure that users can only access corporate resources from devices that are compliant with your security policies. Which policy type should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Conditional Access policy. A Conditional Access policy is the correct choice because it enforces access controls at the identity level, evaluating device compliance status before granting access to corporate resources. When combined with Intune compliance policies, Conditional Access can block or allow access based on real-time device health checks, ensuring only compliant devices can connect.

Answer

An app protection policy

Answer

A compliance policy

Answer

A configuration policy

Question 2

A security analyst receives an alert from Microsoft Sentinel indicating a potential ransomware attack. The analyst needs to quickly understand the full scope of the attack, including all affected accounts and devices. Which Microsoft Sentinel feature should they use?

Accepted Answer

Incident investigation. D is correct because Microsoft Sentinel's incident investigation feature provides a visual, interactive graph that maps relationships between entities (e.g., accounts, devices, IP addresses) involved in an incident. This allows the analyst to quickly see the full scope of a ransomware attack by exploring all affected resources and their connections, rather than relying on static reports or automated responses.

Answer

Analytics rules

Answer

Workbooks

Answer

Playbooks

Question 3

Your organization needs to monitor and respond to security threats across on-premises, cloud, and hybrid environments. Which Microsoft solution provides a unified SIEM and SOAR capability?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct answer because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR) solution. It provides unified threat monitoring, detection, and response across on-premises, cloud, and hybrid environments by ingesting data from various sources, using built-in analytics, and enabling automated playbooks.

Answer

Microsoft Defender XDR

Answer

Microsoft Defender for Cloud

Answer

Microsoft Intune

Question 4

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to enable network security recommendations for all virtual networks. Which security policy should you enable?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark provides a comprehensive set of security recommendations, including network security controls for virtual networks, such as restricting inbound/outbound traffic and enforcing encryption. Enabling this policy in Microsoft Defender for Cloud applies built-in Azure Policy initiatives that assess and recommend network security configurations across all virtual networks. This directly meets the requirement to enable network security recommendations for all virtual networks.

Answer

Adaptive network hardening

Answer

Network Security Group (NSG) flow logs

Answer

Just-in-time VM access

Question 5

A multinational corporation wants to implement a Zero Trust security model. They plan to verify every access request explicitly, use least privilege access, and assume breach. Which Microsoft security solution should they use to enforce conditional access policies based on user, device, location, and risk?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct solution for enforcing conditional access policies based on signals like user, device, location, and risk. Option A (Microsoft Sentinel) is a SIEM/SOAR solution for security analytics, not access control. Option B (Microsoft Intune) manages devices but does not enforce access policies on its own. Option D (Microsoft Defender for Cloud Apps) provides cloud app security but is not the primary conditional access engine.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Question 6

A financial services company needs to comply with GDPR and requires that personal data be automatically classified and protected when stored in Microsoft SharePoint and OneDrive. They also need to retain certain records for a minimum of 7 years. Which combination of Microsoft Purview capabilities should they use?

Accepted Answer

Sensitivity labels and retention labels. Sensitivity labels classify and protect personal data (e.g., encrypt, apply markings), while retention labels enforce the required 7-year retention period. Option A is incorrect because DLP policies detect and prevent data loss but do not enforce retention. Option C is incorrect because DLP policies do not classify data. Option D is incorrect because eDiscovery is for searching and exporting data, not for classification or retention.

Answer

Sensitivity labels and data loss prevention (DLP) policies

Answer

Data loss prevention (DLP) policies and retention labels

Answer

eDiscovery and sensitivity labels

Question 7

Your company uses Microsoft Defender for Identity to monitor on-premises Active Directory. You receive an alert about a potential lateral movement attack involving a service account. The alert indicates that the account was used to log in to multiple servers from a non-domain-joined machine. You need to investigate the alert and determine if the account is compromised. What should you do first?

Accepted Answer

Review the account’s activity timeline in Microsoft Defender for Identity to see all logins and accessed resources.. The correct first step because Microsoft Defender for Identity provides an activity timeline for each account, allowing you to review all logins, resources accessed, and other suspicious activities. This helps determine if the account is compromised before taking any action. Option A is incorrect because the account may be a member of privileged groups, but that alone does not confirm compromise; the activity timeline provides more context. Option B is incorrect because immediately resetting the password could disrupt legitimate operations and destroy evidence. Option D is incorrect because the user of a service account is typically not a person, and lateral movement alerts indicate automated or unauthorized behavior, so contacting a user is not appropriate.

Answer

Check if the account is a member of any privileged groups.

Answer

Immediately reset the service account password.

Answer

Contact the user to verify if they performed the logins.

Question 8

A company implements a sign-in process where a user must provide their password and then enter a temporary code sent to their mobile phone. Which security principle is this process primarily enforcing?

Accepted Answer

Authentication. The process of verifying a user's identity by requiring both a password (something they know) and a temporary code sent to their mobile phone (something they have) is a classic implementation of multi-factor authentication (MFA). Authentication is the security principle that confirms the identity of a user, device, or system before granting access. This sign-in flow directly enforces authentication by combining two distinct factors to prove the user is who they claim to be.

Answer

Authorization

Answer

Accounting

Answer

Non-repudiation

Question 9

Which TWO actions can be performed using Microsoft Purview Data Lifecycle Management?

Accepted Answer

Create a retention policy to keep financial records for 7 years. Microsoft Purview Data Lifecycle Management allows administrators to create retention policies that specify how long data must be kept to meet regulatory or business requirements, such as retaining financial records for 7 years. Option C is correct because the same solution enables deletion policies that automatically remove outdated content, like drafts older than 30 days, ensuring data is not kept longer than necessary.

Answer

Monitor internal emails for policy violations

Answer

Block sharing of sensitive files with external users

Answer

Automatically classify documents containing PII

Question 10

You are the compliance administrator for Contoso, a multinational corporation with headquarters in the US and subsidiaries in Europe and Asia. Contoso uses Microsoft 365 E5 and Microsoft Purview. The company handles personal data subject to GDPR and CCPA. You need to design a compliance solution that meets the following requirements:
- Automatically classify and protect documents containing personal data in SharePoint Online and OneDrive for Business.
- Ensure that data subject requests (DSRs) for access and deletion can be fulfilled within the regulatory timeframes.
- Prevent accidental sharing of sensitive data via email and Teams.
- Maintain an audit trail of all activities related to personal data for at least one year.
- Manage data retention to comply with local laws that require different retention periods for different types of data.
Which combination of Microsoft Purview solutions should you use?

Accepted Answer

Sensitivity labels with auto-labeling, DLP, eDiscovery, Data Lifecycle Management, and Audit (Premium). It includes all the necessary Purview solutions: Sensitivity labels with auto-labeling classify and protect documents containing personal data; DLP prevents accidental sharing via email and Teams; eDiscovery enables fulfilling data subject requests (DSRs) for access and deletion; Data Lifecycle Management allows configuring different retention periods for different data types; Audit (Premium) provides one-year audit trail retention. Options B, C, and D each miss one or more critical components needed to meet all requirements.

Answer

Insider Risk Management, DLP, eDiscovery, and Data Lifecycle Management

Answer

Data Lifecycle Management, Information Barriers, DLP, and Audit (Premium)

Answer

Sensitivity labels, Communication Compliance, eDiscovery, and Audit (Standard)

Question 11

A security administrator is explaining authentication and authorization to new IT staff. Which statement correctly describes the difference between these two processes?

Accepted Answer

Authentication verifies who the user is; authorization verifies what the user can do.. Authentication is the process of verifying the identity of a user, device, or other entity, typically through credentials like a password, biometric, or certificate. Authorization determines what an authenticated entity is permitted to do, such as accessing specific resources or performing certain actions, often enforced via access control lists (ACLs) or role-based access control (RBAC). In Microsoft Entra ID, authentication occurs first (e.g., via OAuth 2.0 or SAML), and then authorization is evaluated using claims or directory roles.

Answer

Authentication verifies what a user can do; authorization verifies who the user is.

Answer

Both authentication and authorization verify the user's identity.

Answer

Authorization is always performed before authentication.

Question 12

Refer to the exhibit. You are reviewing Microsoft Entra role assignments for a user. The first assignment has a roleDefinitionId of '62e90394-69f5-4237-9190-012177145e10' at scope '/'. The second assignment has a roleDefinitionId of '194ae4cb-b126-40b2-bd5b-6091b380977d' at a subscription scope. What can you infer?

Accepted Answer

The user has the Global Administrator role at the tenant level.. The roleDefinitionId '62e90394-69f5-4237-9190-012177145e10' corresponds to the Global Administrator role in Microsoft Entra ID. The scope '/' indicates the tenant root scope, meaning the assignment applies to the entire tenant. Therefore, the user is a Global Administrator at the tenant level, granting broad administrative access to Azure AD (Entra ID) resources. However, Global Administrator does not automatically provide Azure RBAC roles for managing Azure resources; those require separate assignments.

Answer

The user can only read Azure AD objects.

Answer

The second role is assigned at the subscription scope.

Answer

The user is a Global Administrator with full access to all Azure AD and Azure resources.

Question 13

Refer to the exhibit. An administrator runs the PowerShell command against Microsoft Defender for Endpoint. The output shows an alert with Severity 'High' and Status 'New'. What should the administrator do next to investigate the alert?

Accepted Answer

Investigate the alert details in the Microsoft Defender XDR portal. The alert has a severity of 'High' and status 'New', indicating a potentially critical threat that requires immediate investigation. The correct next step is to use the Microsoft Defender XDR portal to examine the alert details, including the affected devices, user accounts, and related events, to determine the scope and impact of the threat. Changing severity or resolving the alert without investigation would risk missing a real security incident.

Answer

Change the severity to Medium to reduce false positives

Answer

Resolve the alert as a false positive

Answer

Create a Microsoft Sentinel analytics rule from the alert

Question 14

Which TWO capabilities are part of Microsoft Entra ID? (Choose two.)

Accepted Answer

Application management. Microsoft Entra ID includes application management capabilities that allow administrators to register, configure, and control access to enterprise applications. It also provides single sign-on (SSO) functionality, enabling users to authenticate once and access multiple applications without re-entering credentials, using protocols such as SAML 2.0, OAuth 2.0, and OpenID Connect.

Answer

Cloud security posture management

Answer

Mobile device management (MDM)

Answer

Security information and event management (SIEM)

Question 15

A company runs virtual machines in Azure and also maintains on-premises servers connected via Azure Arc. The security team needs a single dashboard to view security recommendations, detect misconfigurations, and track a secure score across both environments. They also want to enable advanced threat protection features such as just-in-time (JIT) VM access and file integrity monitoring for these workloads. Which Microsoft security solution should they implement?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a unified dashboard that displays security recommendations, misconfigurations, and a secure score across both Azure and on-premises workloads connected via Azure Arc. It also includes advanced threat protection features like just-in-time (JIT) VM access and file integrity monitoring, making it the correct choice for this scenario.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps