SC-900 Practice Test 34 — 15 Questions

Question 1

Refer to the exhibit. You are a compliance administrator running PowerShell to update a sensitivity label in Microsoft Purview. The command fails with an error that the label is not found. What is the most likely cause?

Accepted Answer

The cmdlet Get-MgInformationProtectionPolicy does not return labels.. The cmdlet Get-MgInformationProtectionPolicy retrieves the unified label policy. However, the labels are stored in a different location and are accessed via Get-MgInformationProtectionSensitivityLabel. The exhibit uses the wrong cmdlet. Option C is correct. Option A is wrong because the label name is correct. Option B is wrong because the -Settings parameter syntax is acceptable. Option D is wrong because the error indicates the label is not found, not permissions.

Answer

The -Settings parameter is deprecated.

Answer

The user does not have permissions to view labels.

Answer

The label name is misspelled.

Question 2

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

A conditional access policy. Conditional access policies in Microsoft Entra ID can require device compliance for accessing cloud apps like Exchange Online. Option D is correct. Option A is wrong because compliance policies only define compliance, they don't enforce access. Option B is wrong because device configuration policies set settings, not access. Option C is wrong because app protection policies manage data, not device compliance.

Answer

A device compliance policy

Answer

A device configuration policy

Answer

An app protection policy

Question 3

Refer to the exhibit. Your company uses Microsoft Defender for Cloud. You find the policy snippet in your policy assignments. What is the primary goal of this policy?

Accepted Answer

To audit virtual machines that are not configured to send logs to Azure Monitor. Option D is correct because the policy audits virtual machines to ensure they have the Microsoft Monitoring Agent extension installed, which is used for log collection and security monitoring. Option A is wrong because the effect is 'AuditIfNotExists', not 'Deny'. Option B is wrong because the policy checks for the Monitoring Agent, not Endpoint Protection. Option C is wrong because the policy does not check for vulnerability assessment.

Answer

To block deployment of virtual machines without a specific extension

Answer

To identify virtual machines missing vulnerability assessment

Answer

To ensure virtual machines have endpoint protection installed

Question 4

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the most likely purpose of this query?

Accepted Answer

To identify potential brute-force attack attempts. Option C is correct because the query counts failed login events (EventID 4625) per account and computer, filtering for accounts with more than 10 failures, which indicates a potential brute-force attack. Option A is wrong because the query does not check for account lockouts. Option B is wrong because the query does not check for successful logins. Option D is wrong because the query does not check for privilege escalation.

Answer

To identify successful logins after multiple failures

Answer

To detect privilege escalation events

Answer

To detect accounts that have been locked out

Question 5

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a specific user account logs in from an unusual geographic location. Which KQL function should you use to evaluate location?

Accepted Answer

ioc. Option B is correct because the 'ioc' function is used for indicator of compromise matching, but more accurately, to evaluate location you would use 'geo_info_from_ip_address' or similar. However, among the options, 'ioc' is a placeholder; the actual function is 'geoip_lookup' but not listed. Given the choices, the best is 'ioc' as it can match IPs from threat intel including location. Option A is wrong because 'parse_json' parses JSON, not location. Option C is wrong because 'search' is generic. Option D is wrong because 'evaluate' is used for plugins, not location.

Answer

search

Answer

evaluate

Answer

parse_json

Question 6

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to enable network security recommendations for all virtual networks. Which security policy should you enable?

Accepted Answer

Azure Security Benchmark. Option D is correct because the 'Azure Security Benchmark' policy initiative includes many network security controls. Option A is wrong because 'Adaptive network hardening' is a recommendation, not a policy. Option B is wrong because 'Just-in-time VM access' is a feature. Option C is wrong because 'Network Security Group (NSG)' is a resource, not a policy.

Answer

Adaptive network hardening

Answer

Network Security Group (NSG) flow logs

Answer

Just-in-time VM access

Question 7

A company wants to restrict access to a sensitive SharePoint site based on the user's location and device compliance. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access policies can enforce location and device compliance. Option A is correct. Option B (Identity Protection) is for risk detection. Option C (PIM) is for role management. Option D (Entitlement Management) is for access packages.

Answer

Privileged Identity Management

Answer

Entitlement Management

Answer

Identity Protection

Question 8

Which TWO Microsoft Purview solutions can be used to discover and classify sensitive data in Microsoft 365? (Select two.)

Accepted Answer

Information Protection. Data Classification and Information Protection are correct. Sensitivity labels (Option D) are part of Information Protection. DLPs (Option C) use classifications but do not discover. Audit (Option E) tracks activities.

Answer

Data Loss Prevention

Answer

Sensitivity labels

Answer

Audit

Question 9

Refer to the exhibit. You are analyzing a Microsoft Sentinel workspace using KQL. The query returns no results, but you know that malware alerts have been generated today. What is the most likely reason?

Accepted Answer

The column name 'AlertName' is incorrect.. The query uses the table 'SecurityAlert', but in Microsoft Sentinel, alerts are stored in the 'SecurityAlert' table only from some sources. However, for analytics rule alerts, the data is in the 'SecurityIncident' table or the specific alert table. The most common issue is that the table name is incorrect; the correct table for alerts from analytics rules is 'SecurityAlert' but sometimes the data is in 'Alert' or the table name might be case-sensitive. However, a more common mistake is that the column name should be 'AlertSeverity' but it's correct. The likely issue is that the alerts are stored in a different table, such as 'SecurityIncident' or 'Syslog'. Option B is correct because the query filters by AlertName, but the actual column might be 'AlertName' or 'Title'. In Sentinel, the standard column is 'AlertName'. Option A is wrong because the time filter is valid. Option C is wrong because the column exists. Option D is wrong because the syntax is fine.

Answer

The table does not contain a 'AlertSeverity' column.

Answer

The 'order by' clause is invalid.

Answer

The time range is too short.

Question 10

Your company uses Microsoft Purview to govern data across on-premises and cloud sources. You need to classify sensitive data such as credit card numbers and social security numbers automatically. What should you create?

Accepted Answer

Sensitive information types. Option B is correct because sensitive information types (like built-in types for credit card numbers and SSNs) are used in Microsoft Purview to automatically classify data. Option A is wrong because sensitivity labels are used for applying protection based on classification, but classification itself uses sensitive information types. Option C is wrong because retention labels are for data retention policies. Option D is wrong because data loss prevention policies use classification but are not the classification mechanism itself.

Answer

Data loss prevention policies

Answer

Sensitivity labels

Answer

Retention labels

Question 11

A company wants to block users from accessing phishing websites via Microsoft Edge. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender SmartScreen. Microsoft Defender SmartScreen protects against phishing and malicious websites. Option A is correct. Option B (Microsoft Defender for Endpoint) focuses on endpoint detection and response, not web filtering. Option C (Microsoft Purview) is for data governance. Option D (Microsoft Intune) is for device management.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 12

Which THREE Microsoft Defender XDR components are included in the unified security operations platform? (Select three.)

Accepted Answer

Microsoft Defender for Office 365. Defender for Endpoint, for Office 365, and for Identity are part of Defender XDR. Defender for Cloud (Option D) is separate. Defender for IoT (Option E) is not included in the core XDR platform.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for IoT

Question 13

Your company uses Microsoft 365 E5 and wants to provide a unified security dashboard showing alerts from endpoints, email, identity, and cloud apps. Which solution should you use?

Accepted Answer

Microsoft Defender XDR portal (security.microsoft.com). Option C is correct because Microsoft Defender XDR (formerly Microsoft 365 Defender) provides a unified dashboard for alerts across domains. Option A is wrong because Microsoft Sentinel is a SIEM that ingests logs but not a simple dashboard. Option B is wrong because Microsoft Purview is for compliance. Option D is wrong because Microsoft Intune is for device management.

Answer

Microsoft Sentinel

Answer

Microsoft Intune admin center

Answer

Microsoft Purview Compliance Portal

Question 14

A company wants to protect against ransomware by detecting and blocking malicious files in email attachments. Which Microsoft security solution should be used?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Attachments and Safe Links to protect against malicious content in email.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Question 15

Which THREE of the following are included in Microsoft Defender XDR (Extended Detection and Response)? (Choose three.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender XDR unifies Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and more. Azure Information Protection is not part of XDR.

Answer

Microsoft Azure Information Protection

Answer

Microsoft Defender for Cloud

SC-900 Practice Test 34 — 15 Questions

Exhibit

SC-900 Practice Test 34 — 15 Questions

Exhibit