SC-900 Practice Test 32 — 15 Questions

Question 1

A healthcare organization runs a mix of workloads on Azure (Azure VMs, SQL Database) and on-premises (Windows Servers). They must continuously assess their compliance against the HIPAA and HITRUST regulatory frameworks. They want a unified dashboard that shows their compliance score against these standards and provides step-by-step recommendations to remediate violations. Which Microsoft Defender for Cloud capability should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a unified view of an organization's compliance posture against specific regulatory standards like HIPAA and HITRUST. It displays a compliance score for each selected framework and offers step-by-step remediation recommendations for identified violations, directly meeting the requirement for continuous assessment and guided remediation.

Answer

Secure score

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Servers

Question 2

Your organization needs to automatically detect and prevent accidental sharing of sensitive data in Microsoft Teams messages. Which Microsoft Purview solution should you use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect and prevent accidental sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), in Microsoft Teams messages. DLP policies can scan messages in real time, apply actions like blocking the message or sending a policy tip to the user, and integrate with Microsoft Teams' chat and channel infrastructure. This directly addresses the requirement for automatic detection and prevention of accidental data sharing.

Answer

Retention policies

Answer

eDiscovery

Answer

Sensitivity labels

Question 3

A company deploys a custom application on Azure App Service (PaaS). Which of the following security responsibilities falls completely under the customer's scope according to the shared responsibility model?

Accepted Answer

Managing the application code and its configuration. In the shared responsibility model for PaaS like Azure App Service, the customer is responsible for managing the application code and its configuration, including secrets, connection strings, and authentication settings. Microsoft manages the underlying platform, including the OS and runtime, so the customer's scope is limited to what they deploy and configure within the service.

Answer

Applying operating system patches to the virtual machines running the App Service

Answer

Configuring network security groups to filter traffic to the App Service

Answer

Ensuring physical security of the Azure data centers

Question 4

An organization uses Microsoft Entra ID to manage user access. The security policy requires that membership in the 'Finance - Sensitive Data' group must be reviewed every quarter by the group owner to confirm that each member still requires access. The group owner must approve or deny each membership, and any denied memberships should be automatically removed. Which Microsoft Entra ID feature should be configured to automate this process?

Accepted Answer

Microsoft Entra ID Access Reviews. Microsoft Entra ID Access Reviews is the correct feature because it enables periodic review of group memberships, where the group owner can approve or deny each member's continued access. When a member is denied, Access Reviews can be configured to automatically remove that user from the group, satisfying the security policy's requirement for quarterly reviews and automatic removal of denied memberships.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Protection

Question 5

A company operates in multiple countries and must comply with GDPR (EU) and CCPA (California). The compliance officer needs a single tool to assess the company's compliance posture against both regulations, get a consolidated compliance score, and receive prioritized improvement actions that can be assigned to responsible teams. The tool should also track progress over time. Which Microsoft Purview solution should the compliance officer use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a unified dashboard to assess compliance posture against multiple regulations like GDPR and CCPA. It offers a consolidated compliance score, prioritized improvement actions that can be assigned to responsible teams, and tracks progress over time through continuous assessments and automated control mapping.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Insider Risk Management

Question 6

A company uses Exchange Online. The security team wants to protect users from malware hidden in email attachments by detonating them in a secure sandbox environment before delivery. Which Microsoft Defender for Office 365 feature should they enable?

Accepted Answer

Safe Attachments. Safe Attachments is the correct feature because it specifically detonates email attachments in a secure, isolated sandbox environment to detect and block malware before the message reaches the user's inbox. This feature uses dynamic analysis to observe attachment behavior in real time, ensuring zero-day threats are identified and neutralized.

Answer

Safe Links

Answer

Anti-Phishing

Answer

Anti-Spoofing

Question 7

A company uses a cloud-based email service. The service provider ensures that the physical data centers are secure and that the email platform is patched and available. The company is responsible for managing user accounts and ensuring that employees use strong passwords. This division of responsibilities is an example of which concept?

Accepted Answer

Shared responsibility model. The scenario describes a clear division of security responsibilities between the cloud service provider (securing physical data centers, patching the platform) and the customer (managing user accounts, enforcing strong passwords). This is the core definition of the shared responsibility model, which is a foundational concept in cloud computing (as defined by NIST SP 800-145 and adopted by major providers like Microsoft 365). The model explicitly delineates that the provider is responsible for 'security of the cloud' (physical hosts, network, hypervisor) while the customer is responsible for 'security in the cloud' (user identities, data, client endpoints).

Answer

Defense in depth

Answer

Zero Trust

Answer

Principle of least privilege

Question 8

A company is using Microsoft Entra ID to manage identities for a multi-tenant SaaS application. They want to allow users from partner organizations to access the application using their own corporate credentials, without needing to manage separate accounts. Which solution should they implement?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct solution because it enables partner users to access the company's multi-tenant SaaS application using their own corporate credentials, without requiring separate accounts. B2B collaboration supports cross-tenant access by creating lightweight guest user objects in the resource tenant, which can authenticate via their home tenant's identity provider. This aligns with the requirement to allow partner organizations to use their existing credentials while avoiding account management overhead.

Answer

Microsoft Entra B2C

Answer

Microsoft Entra federation with the partner's identity provider

Answer

Microsoft Entra provisioning service

Question 9

An organization decides to eliminate passwords for their employees. They deploy Windows Hello for Business on company-issued laptops, allowing users to sign in with a PIN or a biometric gesture (e.g., fingerprint). The IT team also enables Microsoft Authenticator and FIDO2 security keys as alternative sign-in methods. Which Microsoft Entra ID capability are they leveraging?

Accepted Answer

Passwordless authentication. The organization is implementing passwordless authentication by removing passwords and using Windows Hello for Business (PIN/biometrics), Microsoft Authenticator, and FIDO2 security keys. These methods replace the password with a cryptographic key pair bound to the device or user, satisfying the definition of passwordless authentication in Microsoft Entra ID.

Answer

Microsoft Entra ID Protection

Answer

Conditional Access

Answer

Self-Service Password Reset (SSPR)

Question 10

A company implements multiple layers of security controls: firewalls at the perimeter, intrusion detection systems on internal segments, antivirus software on all workstations, and encryption for sensitive data at rest and in transit. This strategy is intended to ensure that if one control fails, others still provide protection. Which security concept does this approach represent?

Accepted Answer

Defense in depth. Defense in depth is the correct concept because it involves implementing multiple layers of security controls (e.g., firewalls, IDS, antivirus, encryption) so that if one layer fails, subsequent layers continue to provide protection. This layered approach ensures redundancy and mitigates the risk of a single point of failure, aligning with the scenario described.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust

Question 11

Your company, Contoso, uses Microsoft Entra ID for employee identity management. You need to ensure that when an employee leaves the company, their access to all SaaS applications is automatically revoked within 24 hours. The HR department updates the employee status in a cloud HR system (Workday). What should you do?

Accepted Answer

Configure Microsoft Entra ID provisioning from Workday to automatically disable users when their employment status changes.. Microsoft Entra ID supports automated user provisioning from Workday via the built-in Workday to Entra ID provisioning connector. When an employee's status changes to 'terminated' in Workday, the provisioning service automatically disables the corresponding user account in Entra ID, typically within 40 minutes (well under the 24-hour requirement). This eliminates manual intervention and ensures timely revocation of access to all SaaS applications integrated with Entra ID.

Answer

Ask HR to manually disable each user in Microsoft Entra ID after termination.

Answer

Use Microsoft Graph API to write a custom application that polls Workday and disables users.

Answer

Create an Azure Automation runbook that runs daily and checks Workday for terminated employees, then disables them in Entra ID.

Question 12

A company uses Microsoft Entra ID and wants to automatically detect and remediate over-privileged roles in their Azure subscriptions and AWS accounts. They need to get a unified view of permissions across multiple clouds. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra Permissions Management. Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions across multi-cloud environments, including Azure and AWS. It automatically detects over-privileged roles and can remediate them by enforcing least-privilege access policies, making it the correct choice for the described requirement.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Verified ID

Answer

Microsoft Entra ID Governance

Question 13

A company uses a cloud-based Customer Relationship Management (CRM) system that is delivered as Software-as-a-Service (SaaS). According to the shared responsibility model, which security responsibility is primarily handled by the customer?

Accepted Answer

Managing user identities and controlling access to the CRM. In a SaaS model, the cloud provider is responsible for the security of the underlying infrastructure, including physical data centers, operating systems, and network controls. The customer retains responsibility for securing their own data and identities, which includes managing user accounts, enforcing authentication policies (e.g., Microsoft Entra ID Multi-Factor Authentication), and controlling access to the CRM application via role-based access control (RBAC). Therefore, managing user identities and access is the customer's primary security responsibility.

Answer

Physical security of the data center hosting the CRM

Answer

Patching the underlying operating system of the CRM servers

Answer

Ensuring network security for the CRM application's backend

Question 14

Your organization uses Microsoft Entra ID for identity management. You need to require multi-factor authentication (MFA) for all users when accessing the Azure portal. Which feature should you use?

Accepted Answer

Conditional Access policy. Conditional Access policy (Option D) is correct because it allows you to create policies that enforce MFA for specific applications like the Azure portal. Option A, Privileged Identity Management, is used for managing and auditing privileged roles, not for enforcing MFA. Option B, Identity Protection user risk policy, can trigger MFA based on risk but cannot enforce MFA for all users unconditionally. Option C, an Entra ID P1 license, is a prerequisite for using Conditional Access but is not a feature itself.

Answer

Privileged Identity Management

Answer

Identity Protection user risk policy

Answer

Entra ID P1 license

Question 15

A company uses Microsoft Defender for Cloud to improve their cloud security posture. They want to see an aggregated score that reflects how well their resources are protected against threats. Which feature in Defender for Cloud provides this?

Accepted Answer

Security Score. The Security Score in Microsoft Defender for Cloud aggregates findings from security assessments and controls into a single percentage score, reflecting how well resources are protected against threats. It is based on the Secure Score algorithm, which calculates the ratio of passed controls to total controls, weighted by the potential impact of each control. This provides a unified, quantitative measure of cloud security posture.

Answer

Compliance dashboard

Answer

Cloud Security Posture Management (CSPM)

Answer

Workload protections