SC-900 Practice Test 34 — 15 Questions

Question 1

An organization is moving a virtual machine to Azure Infrastructure as a Service (IaaS). According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Applying security updates to the guest operating system. In an IaaS deployment, the customer retains responsibility for securing the guest operating system, including applying security updates. Microsoft manages the physical infrastructure and hypervisor, while the customer must patch and configure the OS running inside the virtual machine.

Answer

Physical security of the datacenter

Answer

Maintaining the hypervisor

Answer

Power and cooling infrastructure

Question 2

A company runs critical applications on Azure virtual machines and on-premises SQL servers. The security team wants to reduce VM attack surface by allowing just-in-time (JIT) access to RDP and SSH ports only when needed. Additionally, they need to monitor changes to important registry keys and system files on the SQL servers. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides just-in-time (JIT) VM access to reduce the attack surface by locking down inbound traffic to RDP (port 3389) and SSH (port 22) until a user requests access. It also includes adaptive application controls and file integrity monitoring (FIM) to track changes to registry keys and system files on both Azure VMs and on-premises SQL servers. This makes it the single solution that addresses both requirements.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 3

Which THREE capabilities are provided by Microsoft Purview Compliance Manager?

Accepted Answer

Pre-built compliance assessments for regulations like GDPR. Compliance Manager provides assessments, actions, and score tracking. It does not discover data (Data Map) or log access (Audit).

Answer

Audit log search for user access events

Answer

Automated data discovery across cloud sources

Question 4

An organization needs to automatically apply a 'Confidential' label to documents that contain EU personal data, and also encrypt those documents. Which Microsoft Purview feature should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies can be configured to automatically apply sensitivity labels based on sensitive info types like EU personal data. Sensitivity labels support encryption. Data classification is a prerequisite, but auto-labeling is the feature that applies the label automatically.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention label policy

Answer

Data classification service

Question 5

A legal team is managing a large litigation case involving over two million documents in SharePoint Online and Exchange Online. They want to reduce the time required for manual review by using a machine learning model that learns from a seed set of relevant and non-relevant documents and then predicts the relevance of the remaining documents. Which Microsoft Purview solution provides this advanced analytical capability?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) in Microsoft Purview provides advanced analytics capabilities, including predictive coding, which uses machine learning models trained on a seed set of relevant and non-relevant documents to automatically predict the relevance of the remaining content. This directly addresses the legal team's need to reduce manual review time for over two million documents in SharePoint Online and Exchange Online.

Answer

Communication Compliance

Answer

eDiscovery (Standard)

Answer

Audit (Premium)

Question 6

Your company uses Microsoft Purview to manage records. You need to ensure that financial records are retained for 7 years and then permanently deleted. Which type of policy should you create?

Accepted Answer

A retention policy with a retention period of 7 years and then delete. A retention policy with a retention period of 7 years and then delete is correct because it applies a time-based retention rule to financial records at the container or folder level, ensuring they are kept for exactly 7 years and then permanently removed without human intervention. This meets the requirement for automatic deletion after the retention period, as opposed to a disposition review which requires manual approval.

Answer

A sensitivity label set to 'Financial' with auto-labeling

Answer

A retention label that triggers a disposition review after 7 years

Answer

A DLP policy that blocks sharing of financial records

Question 7

A company has deployed Microsoft 365 Defender to unify threat detection and response. Which two components are included within the Microsoft 365 Defender integrated solution? (Select all that apply.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft 365 Defender is an integrated threat protection suite that unifies detection and response across an organization's Microsoft 365 environment. It includes Microsoft Defender for Endpoint, which provides endpoint detection and response (EDR) capabilities for devices, and Microsoft Defender for Office 365, which protects against email, phishing, and collaboration threats. These two components work together within the Microsoft 365 Defender portal to correlate alerts and automate response across endpoints and Office 365 workloads.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 8

A company uses Microsoft 365 E5. An employee's corporate laptop is infected with keylogging malware that captures the employee's credentials. The attacker uses these credentials to sign in to Exchange Online and forward sensitive emails to an external account. Under the shared responsibility model, who is primarily responsible for the security incident?

Accepted Answer

The customer is responsible because they control user devices, accounts, and access policies.. Under the shared responsibility model, the customer is responsible for securing user devices, managing user accounts, and configuring access policies. In this scenario, the keylogging malware on the employee's corporate laptop is a customer-side endpoint security issue, and the attacker used stolen credentials to access Exchange Online. Microsoft is responsible for the security of the cloud infrastructure (e.g., physical data centers, network, and hypervisor), but not for threats originating from compromised customer-managed devices or user accounts.

Answer

Microsoft is responsible because they provide the cloud service and must protect against all threats.

Answer

Both Microsoft and the customer share equal responsibility for all layers of the service.

Answer

Neither party is responsible because the employee bypassed security controls.

Question 9

A company's security team configures network firewall rules so that only a dedicated jump server's IP address can initiate RDP connections to production servers. This is an example of which security principle?

Accepted Answer

Least privilege. Restricting RDP access to only a dedicated jump server's IP address ensures that no other hosts or users can directly initiate remote desktop connections to production servers. This enforces the principle of least privilege by granting only the minimum necessary network access (the jump server) required for administrative tasks, reducing the attack surface and limiting lateral movement.

Answer

Defense in depth

Answer

Zero Trust

Answer

Separation of duties

Question 10

A financial institution uses digital signatures to sign all transaction records. This ensures that the records have not been altered after signing. Which security goal does this primarily protect?

Accepted Answer

Integrity. Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the transaction record, which is then encrypted with the signer's private key. Any alteration to the record after signing would cause the hash verification to fail, directly protecting the integrity of the data. While digital signatures also support non-repudiation, the question specifically asks which goal is primarily protected by ensuring records have not been altered, which is integrity.

Answer

Confidentiality

Answer

Non-repudiation

Answer

Availability

Question 11

An organization wants to protect against business email compromise (BEC) attacks where attackers impersonate the CEO to trick employees into transferring funds. Which Microsoft Defender for Office 365 capability should they configure to detect such impersonation?

Accepted Answer

Impersonation protection. Impersonation protection in Defender for Office 365 is specifically designed to detect and block business email compromise (BEC) attacks where an attacker spoofs a trusted sender, such as a CEO or CFO. It uses machine learning and sender intelligence to analyze email patterns and flag messages that impersonate internal or external high-value targets, making it the correct capability for this scenario.

Answer

Safe Attachments

Answer

Safe Links

Answer

Spoof intelligence

Question 12

A security architect explains the Zero Trust model to the board. They state that every access request must be fully authenticated and authorized based on identity, device health, location, and risk, regardless of whether the user is on the corporate network. Which Zero Trust principle does this statement represent?

Accepted Answer

Verify explicitly. The statement emphasizes that every access request must be authenticated and authorized based on identity, device health, location, and risk, regardless of network location. This directly aligns with the 'Verify explicitly' principle of Zero Trust, which mandates that authentication and authorization are performed for every request using all available data points, not just once at the perimeter.

Answer

Least privilege

Answer

Assume breach

Answer

Microsegmentation

Question 13

A company uses Microsoft Entra ID (Microsoft Entra ID) to manage user access to cloud applications. The security team wants to enforce that users must provide a second form of authentication, such as a phone call or mobile app notification, in addition to their password. Which Microsoft Entra capability should they enable?

Accepted Answer

Multi-Factor Authentication. Multi-Factor Authentication (MFA) is the correct capability because it requires users to provide a second form of authentication (e.g., phone call, mobile app notification) in addition to their password. This directly addresses the security team's requirement for a second authentication factor, which is the core function of MFA in Microsoft Entra ID.

Answer

Conditional Access

Answer

Identity Protection

Answer

Privileged Identity Management

Question 14

A company uses a financial accounting system where the employee who creates a purchase order cannot also approve it. This policy is designed to prevent a single individual from committing fraud by both initiating and approving a transaction. Which security principle does this practice primarily implement?

Accepted Answer

Separation of duties. The practice of requiring different individuals to create and approve purchase orders directly implements the separation of duties principle. This security control ensures that no single person has complete control over a sensitive financial transaction, thereby reducing the risk of fraud or error. In the context of identity and access management, separation of duties enforces that conflicting tasks are assigned to different users to prevent abuse of privileges.

Answer

Least privilege

Answer

Defense in depth

Answer

Zero Trust

Question 15

A company has a document management system. The security policy requires that a user in the Sales department can only view documents related to sales and cannot access documents in the Finance or HR folders. Which security principle is being applied?

Accepted Answer

Least privilege. The security policy restricts a Sales user's access to only sales-related documents, explicitly denying access to Finance and HR folders. This aligns with the principle of least privilege, which mandates that users be granted only the minimum permissions necessary to perform their job functions. In Microsoft 365, this is implemented via role-based access control (RBAC) or sensitivity labels that enforce read-only access on specific SharePoint document libraries or folders.

Answer

Availability

Answer

Defense in depth

Answer

Non-repudiation