SC-900 Practice Test 35 — 15 Questions

Question 1

A company implements a security strategy that includes multiple layers of controls: a perimeter firewall, an intrusion detection system, endpoint antivirus software, and multi-factor authentication for user access. The goal is that if one layer fails, another layer is in place to prevent or mitigate an attack. Which security principle does this approach best represent?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Defense in depth. Defense in depth is a security strategy that layers independent defensive mechanisms so that if one layer fails, another layer is already in place to prevent or mitigate an attack. The scenario explicitly describes multiple layers (firewall, IDS, endpoint antivirus, MFA) working together, which is the core definition of defense in depth. This approach ensures no single point of failure can compromise the entire security posture.

Answer

Zero Trust

Answer

Least privilege

Answer

CIA triad

Question 2

A company uses Microsoft Entra ID. The security team wants to automatically detect user behaviors that indicate possible compromise, such as leaked credentials, impossible travel, or anomalous login patterns. When a user is determined to be at high risk, the system should automatically require the user to reset their password the next time they sign in. Which Microsoft Entra capability should they use?

Accepted Answer

Identity Protection. Identity Protection is the correct Microsoft Entra capability because it is specifically designed to automatically detect risky user behaviors such as leaked credentials, impossible travel, and anomalous sign-in patterns. It assigns a risk level to users and sign-ins, and can be configured with a Conditional Access policy to enforce actions like requiring a password reset at next sign-in when a user is deemed high risk. This directly matches the security team's requirement for automated detection and remediation.

Answer

Conditional Access

Answer

Privileged Identity Management (PIM)

Answer

Identity Governance

Question 3

A company wants to gain visibility into the cloud applications that employees are using (e.g., unsanctioned SaaS apps), assess the risk level of each app based on multiple factors, and block access to high-risk applications. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into cloud application usage, assesses risk based on factors like compliance, app store ratings, and security controls, and can block access to high-risk apps via reverse proxy or API integration. This directly matches the requirement to discover unsanctioned SaaS apps and enforce access controls.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 4

A company uses Microsoft 365 and needs to comply with a regulatory requirement to retain all customer contracts for 5 years after the contract's end date, after which they must be automatically deleted. Additionally, the legal department needs the ability to preserve all documents related to an ongoing lawsuit, overriding any deletion timelines. Which Microsoft Purview solution should the company use?

Accepted Answer

Data Lifecycle Management with retention labels and eDiscovery holds. Data Lifecycle Management (DLM) with retention labels allows the company to apply a retention label to customer contracts that retains them for 5 years after the contract end date and then automatically deletes them. eDiscovery holds can be placed on all documents related to an ongoing lawsuit, which overrides any deletion timelines, ensuring that content is preserved until the hold is released. This combination directly meets both the regulatory retention and legal preservation requirements.

Answer

Information Barriers

Answer

Communication Compliance

Answer

Audit (Premium)

Question 5

An organization wants to protect its Azure PaaS services, such as Azure SQL Database and Azure Key Vault, by detecting and alerting on suspicious activities like SQL injection attempts or unusual access patterns. They also need to integrate these alerts into a central security information and event management (SIEM) system for further analysis. Which Microsoft security solution provides the threat detection capability described?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides unified security management and advanced threat protection across hybrid cloud workloads, including Azure PaaS services like Azure SQL Database and Azure Key Vault. It detects suspicious activities such as SQL injection attempts and unusual access patterns using built-in behavioral analytics and integrates alerts into a central SIEM system via Azure Monitor or directly to Microsoft Sentinel.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Question 6

A financial services company is subject to regulations that require monitoring of employee communications for potential market manipulation. The compliance team needs to create policies that automatically detect messages containing phrases like 'insider info' or 'confidential trade' in Microsoft Teams chats and Exchange Online emails. Detected messages should be routed to designated reviewers for investigation, and the company wants a built-in Microsoft Purview solution to handle this process. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect and investigate policy violations in organizational communications, such as Microsoft Teams chats and Exchange Online emails. It allows compliance teams to create custom policies that automatically scan for sensitive phrases like 'insider info' or 'confidential trade' and route flagged messages to designated reviewers for investigation, meeting the regulatory monitoring requirements.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Question 7

A multinational organization uses Microsoft Entra ID. The IT help desk team is responsible for password resets and group management, but only for users located in the European region. The organization has created a group containing all European user accounts. Which Microsoft Entra feature should an administrator use to delegate these administrative tasks specifically to the help desk team, limited to the European user scope?

Accepted Answer

Administrative units. Administrative units (AUs) in Microsoft Entra ID allow administrators to delegate administrative permissions scoped to a specific subset of users, groups, or devices. By creating an AU containing only the European user group, the administrator can assign the help desk team roles (e.g., Helpdesk Administrator or User Administrator) limited to that AU, ensuring they can perform password resets and group management only for European users.

Answer

Access reviews

Answer

Conditional Access

Answer

Self-service password reset (SSPR)

Question 8

A company deploys firewalls, intrusion detection systems, and endpoint antivirus software at multiple layers of its network. This strategy is intended to ensure that if one security control fails, others still provide protection. Which security concept does this approach represent?

Accepted Answer

Defense in depth. Defense in depth is a security strategy that layers multiple independent controls—such as firewalls, intrusion detection systems (IDS), and endpoint antivirus—across different network segments. The core principle is that if one layer is breached or fails, subsequent layers continue to provide protection, ensuring no single point of failure compromises the entire security posture.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust

Question 9

A company uses Microsoft 365 and Microsoft Azure. The security team wants a single portal that provides a unified view of alerts and incidents from their endpoints, email, and cloud applications to accelerate threat investigation and response. Which Microsoft security solution should they use?

Accepted Answer

Microsoft 365 Defender portal. Microsoft 365 Defender portal (now part of the Microsoft 365 Defender unified security operations platform) is designed to aggregate alerts and incidents from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), and cloud applications (Microsoft Defender for Cloud Apps) into a single queue. This unified view enables security teams to triage and investigate threats across these domains without switching between separate consoles, directly accelerating response times.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Purview Compliance Manager

Question 10

A company wants to allow external business partners to access its internal applications using their own corporate credentials (e.g., their Microsoft Entra ID or Google account), without creating separate user accounts in the company's directory. Which Microsoft Entra ID feature should they use?

Accepted Answer

B2B collaboration. B2B collaboration allows the company to grant external business partners access to its internal applications using their own corporate identities (such as Microsoft Entra ID or Google accounts) without creating separate user accounts in the company's directory. It leverages federation trust and cross-tenant authentication, enabling partners to authenticate with their home organizations while accessing resources in the host tenant.

Answer

Azure AD B2C (Business-to-Consumer)

Answer

Microsoft Entra Domain Services

Answer

Conditional Access

Question 11

An organization uses Exchange Online and is concerned about phishing attacks that include malicious hyperlinks. They need a security solution that checks URLs at the time a user clicks them and blocks access to known malicious or suspicious websites. The solution must also provide real-time reputation analysis for link clicks. Which Microsoft security solution should they enable?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) provides Safe Links, a feature specifically designed to protect against phishing attacks by scanning URLs at the time of click. It performs real-time reputation analysis against Microsoft's threat intelligence to block access to known malicious or suspicious websites. This directly addresses the requirement for click-time URL verification and blocking.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 12

A company uses Microsoft Entra ID. The security team wants to configure automated actions when user sign-ins are detected as high risk due to anonymized IP addresses or leaked credentials. They need to automatically block the sign-in or force a password change based on risk level. Which Microsoft Entra ID feature should they use?

Accepted Answer

Identity Protection. Microsoft Entra ID Protection is the correct feature because it automates the detection and remediation of identity-based risks, including sign-ins from anonymized IP addresses and leaked credentials. It allows administrators to configure conditional access policies that automatically block high-risk sign-ins or force a password change based on the risk level (e.g., low, medium, high). This directly matches the security team's requirement for automated actions tied to risk detection.

Answer

Privileged Identity Management

Answer

Azure AD Connect

Answer

Self-service password reset

Question 13

A company has a hybrid environment with on-premises Active Directory. The security team wants to detect advanced attacks such as pass-the-hash, malicious Kerberos ticket activity, and abnormal service account behavior. They want alerts from the on-premises environment to be integrated into Microsoft Defender for Cloud for centralized monitoring. Which Microsoft security solution should they deploy on their domain controllers?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to detect advanced on-premises Active Directory attacks like pass-the-hash, malicious Kerberos ticket activity (e.g., Golden Ticket, Silver Ticket), and abnormal service account behavior. It integrates directly with Microsoft Defender for Cloud to provide centralized monitoring and alerting, fulfilling the requirement for on-premises domain controller protection.

Answer

Microsoft Defender for Cloud (agentless)

Answer

Microsoft Defender for Office 365

Answer

Microsoft Entra ID Protection

Question 14

A company uses Microsoft Defender for Endpoint on all workstations and Microsoft Defender for Office 365 for email protection. The security operations team wants a single console to see all incidents from both products, automatically investigate and respond to threats across endpoints and email, and integrate with Microsoft Sentinel for advanced hunting. Which Microsoft security solution should they use?

Accepted Answer

Microsoft 365 Defender. Microsoft 365 Defender is the correct solution because it provides a unified incident queue that aggregates alerts from Microsoft Defender for Endpoint and Microsoft Defender for Office 365, enabling automated investigation and response (AIR) across endpoints and email. It also natively integrates with Microsoft Sentinel for advanced hunting via the Microsoft 365 Defender connector, allowing the security operations team to correlate signals and perform cross-domain threat hunting.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Purview Compliance Portal

Answer

Microsoft Entra ID Protection

Question 15

A security architect is designing a defense strategy for a company's IT infrastructure. The strategy includes deploying a network firewall, using an intrusion detection system, installing antivirus software on all endpoints, and requiring multi-factor authentication for all user accounts. The architect explains that if the firewall fails, the IDS can detect an intrusion, and if the IDS misses something, the antivirus might catch it, and MFA can protect even if credentials are compromised. Which security principle best describes this layered approach?

Accepted Answer

Defense in depth. Defense in depth is the correct principle because it describes a layered security strategy where multiple independent controls (firewall, IDS, antivirus, MFA) are deployed so that if one layer fails, another layer can still prevent or detect an attack. This approach explicitly relies on redundancy and diversity of controls to provide resilience against failures or bypasses, as illustrated by the architect's explanation of how each subsequent layer compensates for potential gaps in the previous one.

Answer

Least privilege

Answer

Zero Trust

Answer

Shared responsibility