SC-900 Practice Test 32 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default filters. You need to create a custom mail flow rule to block similar emails based on specific keywords in the subject line. Which tool should you use?

Accepted Answer

Exchange admin center. Exchange admin center (EAC) allows creating mail flow rules (transport rules) based on conditions like subject keywords. Option B is correct. Option A (Security & Compliance Center) includes policies but not mail flow rules. Option C (Defender for Cloud Apps) is for cloud apps. Option D (Microsoft Entra admin center) is for identity.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Defender for Cloud Apps portal

Answer

Microsoft Entra admin center

Question 2

You are investigating an alert in Microsoft Sentinel. The exhibit shows the JSON output of an alert that was generated from a sign-in log. The alert is linked to an active incident. Which action should you take to prioritize the incident for investigation?

Accepted Answer

Change the incident severity to critical. Option B is correct because increasing the incident severity to critical will ensure it is prioritized. Option A is wrong because closing the incident would stop investigation. Option C is wrong because changing assignment does not change priority. Option D is wrong because deleting the alert does not resolve the incident.

Answer

Close the incident as a false positive

Answer

Delete the alert from the incident

Answer

Reassign the incident to another analyst

Question 3

Your organization wants to implement a Zero Trust security model. Which TWO principles are part of the Zero Trust model? (Select TWO.)

Accepted Answer

Assume breach. Options A and D are correct: Zero Trust assumes breach and verifies explicitly. Option B is wrong because implicit trust is not part of Zero Trust. Option C is wrong because network perimeter is the traditional model. Option E is wrong because perimeter-based access is not Zero Trust.

Answer

Grant access based on IP address

Answer

Rely on network perimeter security

Answer

Use implicit trust for internal traffic

Question 4

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive information. You need to create a policy that prevents users from sharing credit card numbers via email, but allows them to share internally with other employees. The policy should also notify the user when an attempt is made to share externally. What should you configure?

Accepted Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.. Option B is correct because it uses the credit card number sensitive info type, restricts external sharing, and allows internal sharing. Option A is wrong because it blocks all sharing. Option C is wrong because it only provides user education, not blocking. Option D is wrong because it requires user override, but still blocks internal sharing.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Block access to content' for all recipients.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Allow override' with a business justification.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Notify user with policy tip' but no blocking.

Question 5

An organization is deploying Microsoft Intune for mobile device management. They need to ensure that all iOS devices must have a passcode of at least 6 characters and the device must be encrypted. What should they configure?

Accepted Answer

A device compliance policy. Device compliance policies in Intune can require specific settings like passcode length and encryption. Option A is incorrect because Conditional Access uses compliance status. Option C is incorrect because configuration profiles push settings but do not enforce compliance. Option D is incorrect because app protection policies manage apps, not devices.

Answer

A Conditional Access policy

Answer

A device configuration profile

Answer

An app protection policy

Question 6

Refer to the exhibit. You are reviewing a Microsoft Purview Information Protection policy in JSON format. The policy defines two sensitivity labels. What is the key difference between the 'Confidential' label and the 'Highly Confidential' label?

Accepted Answer

The 'Highly Confidential' label restricts edit rights. The 'Confidential' label grants VIEW and EDIT rights, while 'Highly Confidential' grants only VIEW. Option B is correct. Option A is incorrect because both have encryption. Option C is incorrect because both are sublabels? Not necessarily. Option D is incorrect because the JSON does not mention sublabels.

Answer

Only the 'Confidential' label applies encryption

Answer

The 'Highly Confidential' label allows printing

Answer

The 'Confidential' label is a parent label

Question 7

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers in emails to external recipients. Which DLP rule action should you configure?

Accepted Answer

Block the message from being sent. Option A is correct because blocking the message from being sent is the appropriate action to prevent data loss. Option B is wrong because allowing override with justification does not prevent sharing. Option C is wrong because notifying the user without blocking still allows the email to be sent. Option D is wrong because auditing alone does not block the action.

Answer

Audit the activity only

Answer

Allow the message but notify the user

Answer

Allow the message with a policy tip

Question 8

Your organization uses Microsoft Entra ID and wants to automatically block sign-ins from users located in countries that are not approved for business operations. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access with Named Locations. Conditional Access policies allow you to create location-based policies to block or grant access based on geographic locations. Option A is correct because Named Locations are used in Conditional Access to define countries. Option B (Identity Protection) detects risks but does not directly block by country. Option C (Privileged Identity Management) manages roles. Option D (Terms of Use) presents agreements but does not block by location.

Answer

Privileged Identity Management

Answer

Terms of Use

Answer

Identity Protection user risk policy

Question 9

Which THREE capabilities are provided by Microsoft Defender for Cloud? (Choose three.)

Accepted Answer

Security recommendations for resources. Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM), vulnerability assessment for VMs, and security recommendations. Option B (threat protection for Azure) is also a capability but is part of the broader 'Defender for Cloud' workload protection. However, the question asks for capabilities; CSPM, vulnerability assessment, and security recommendations are core. Option D (Just-in-Time VM access) is a feature, but the three most common are A, C, E.

Answer

Just-in-Time (JIT) VM access

Answer

Regulatory compliance assessment

Question 10

Your organization uses Microsoft Entra ID for identity management. You need to require multi-factor authentication (MFA) for all users when accessing the Azure portal. Which feature should you use?

Accepted Answer

Conditional Access policy. Option C is correct because Conditional Access policies in Entra ID allow you to enforce MFA for specific applications. Option A is wrong because Entra ID P1 includes Conditional Access but the feature itself is Conditional Access. Option B is wrong because Identity Protection detects risks but does not enforce MFA directly. Option D is wrong because Privileged Identity Management manages elevated roles, not MFA.

Answer

Privileged Identity Management

Answer

Identity Protection user risk policy

Answer

Entra ID P1 license

Question 11

Your organization uses Microsoft Defender for Cloud to protect Azure virtual machines. You need to ensure that critical vulnerabilities identified on the VMs are automatically remediated using a just-in-time patching mechanism. What should you configure?

Accepted Answer

Enable adaptive application controls and just-in-time VM access in Defender for Cloud. Option B is correct because Microsoft Defender for Cloud's adaptive application controls and just-in-time VM access can be combined with update management to automate patching. Option A is wrong because Azure Update Manager does not provide just-in-time patching. Option C is wrong because Azure Automation Update Management requires manual scheduling. Option D is wrong because Microsoft Intune is for endpoint management, not Azure VMs.

Answer

Deploy Microsoft Intune for update management

Answer

Configure Azure Automation Update Management

Answer

Enable Azure Update Manager

Question 12

Your organization is planning to deploy Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that logs from your network proxy servers are ingested. Which method should you use to connect the logs?

Accepted Answer

Log collector. Defender for Cloud Apps uses log collectors to ingest traffic logs from proxies and firewalls. Option D is correct. Option A (API connector) connects to cloud apps, not proxies. Option B (Conditional Access) controls access. Option C (Microsoft Sentinel connector) is for SIEM ingestion, not Cloud App Discovery.

Answer

Conditional Access App Control

Answer

Microsoft Sentinel data connector

Answer

App connector API

Question 13

Refer to the exhibit. You run the Azure PowerShell command for a storage account. What is the current network access configuration?

Accepted Answer

The storage account is not accessible from any network.. DefaultAction is Deny, and no rules are defined. This means all network traffic is denied by default. Option B is correct. Option A says 'all networks' which would be Allow. Option C says only specific IPs, but IpRules is empty. Option D says only VNets, but VirtualNetworkRules is empty.

Answer

The storage account is accessible only from specific virtual networks.

Answer

The storage account is accessible from all networks.

Answer

The storage account is accessible only from specific IP addresses.

Question 14

You are troubleshooting a Windows device that is reporting as non-compliant in Microsoft Intune. The exhibit shows the output of a PowerShell command run on the device. Based on the output, which component is likely misconfigured?

Accepted Answer

Microsoft Defender for Endpoint sensor onboarding. Option D is correct because the output shows that all Defender components are enabled, so the issue is likely not with Defender for Endpoint. The non-compliance could be due to missing updates, which are not shown. Option A is wrong because AMService is enabled. Option B is wrong because Antispyware is enabled. Option C is wrong because Antivirus is enabled.

Answer

Antivirus protection

Answer

Antispyware protection

Answer

Microsoft Defender Antivirus real-time protection

Question 15

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive credit card numbers via email. The DLP policy must trigger automatically when a user attempts to send an email containing a credit card number. Which DLP configuration should you use?

Accepted Answer

Create a DLP policy with a condition that matches the Credit Card Number sensitive info type and an action to block the email. Option C is correct because a DLP policy with a rule that uses a sensitive info type (Credit Card Number) and an action to block the email is the standard approach. Option A is wrong because Microsoft Defender for Office 365 is for anti-phishing and malware, not DLP. Option B is wrong because Customer Key is for encryption, not DLP. Option D is wrong because Double Key Encryption is for protecting data with two keys, not for blocking sharing.

Answer

Configure Double Key Encryption for the Exchange Online mailbox

Answer

Configure a Safe Links policy in Microsoft Defender for Office 365

Answer

Use Microsoft Purview Customer Key for encryption