SC-900 Practice Test 35 — 15 Questions

Question 1

A company uses Microsoft Entra ID. They want to require all users accessing the external vendor portal to accept a terms of use document before they are granted access. The acceptance must be revoked after 30 days, requiring the user to accept again. Which Conditional Access component should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access controls (Grant). The administrator needs to enforce a terms of use acceptance that expires after 30 days. In Conditional Access, the 'Access controls (Grant)' section includes the 'Require terms of use' option, which can be configured to require re-acceptance after a specified duration (e.g., 30 days). This directly meets the requirement by blocking access until the user accepts the current version of the terms of use document.

Answer

Assignments

Answer

Conditions

Answer

Session controls

Question 2

A financial institution uses digital signatures to ensure that a transaction record has not been altered after it was processed. Which security principle is primarily addressed?

Accepted Answer

B. Integrity. Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the transaction record, which is then encrypted with the sender's private key. Any alteration to the record after signing would cause the hash verification to fail, directly ensuring data integrity. This is why option B is correct.

Answer

A. Confidentiality

Answer

C. Availability

Answer

D. Non-repudiation

Question 3

A company wants to automatically detect emails in Exchange Online that contain credit card numbers and apply encryption to those emails before they are sent. Which Microsoft Purview solution should the administrator configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft Purview is specifically designed to detect sensitive information such as credit card numbers in emails and automatically apply protective actions like encryption. DLP policies can scan Exchange Online messages in transit and enforce rules to encrypt the email before it is sent, which directly meets the requirement.

Answer

Information Protection (sensitivity labels)

Answer

Data Lifecycle Management

Answer

eDiscovery

Question 4

A company uses Microsoft Entra ID and Intune for device management. They want to ensure that only devices marked as compliant (e.g., updated, encrypted) can access the corporate HR portal. Which Conditional Access assignment condition should the administrator configure?

Accepted Answer

Device state. The 'Device state' condition in Conditional Access allows administrators to require that only devices marked as compliant (via Intune compliance policies) can access resources. By configuring this condition, the HR portal will block access from non-compliant devices, enforcing security requirements like encryption and updates before granting access.

Answer

Locations

Answer

Client apps

Answer

Sign-in risk

Question 5

Your company is implementing a hybrid identity solution with Microsoft Entra ID. Users report that they can sign in to Microsoft 365 but cannot access on-premises applications that are configured for integrated Windows authentication. You need to ensure seamless single sign-on (SSO) for both cloud and on-premises resources. What should you implement?

Accepted Answer

Enable Microsoft Entra seamless SSO.. Microsoft Entra seamless SSO (Seamless SSO) is the correct choice because it automatically signs users in when they are on corporate devices connected to the corporate network, using Kerberos delegation to provide single sign-on for both cloud resources (like Microsoft 365) and on-premises applications configured for Integrated Windows Authentication (IWA). This eliminates the need for users to re-enter credentials when accessing on-premises apps after authenticating to the cloud.

Answer

Implement Passthrough Authentication.

Answer

Deploy Active Directory Federation Services (AD FS).

Answer

Configure password hash synchronization.

Question 6

A company uses Microsoft Entra ID and wants to automatically detect potential security risks such as leaked credentials and suspicious sign-in patterns. They also need the ability to investigate these risks and configure automated responses based on risk levels. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct service because it automatically detects potential security risks such as leaked credentials and suspicious sign-in patterns, provides investigation tools (e.g., risk reports and detailed risk event logs), and enables automated responses like conditional access policies that block or require MFA based on risk levels. This directly matches the scenario's requirements for detection, investigation, and automated remediation.

Answer

Microsoft Entra ID Governance

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Domain Services

Question 7

A company wants to reduce the risk of privileged account misuse. They need to provide temporary, time-bound access to administrative roles in Microsoft Entra ID (Microsoft Entra ID) and require approval from a manager before granting the access. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing administrators to activate roles for a limited, time-bound duration. It also supports approval workflows, requiring a manager's approval before role activation is granted, directly addressing the need for temporary, approved access to administrative roles.

Answer

Conditional Access policies

Answer

Identity Protection

Answer

Entra ID Governance (Access Reviews)

Question 8

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. An HR manager wants to ensure that employee records are kept for at least 1 year after last modification. The policy is applied to Exchange, SharePoint, and OneDrive. What is the outcome?

Accepted Answer

The policy will not retain content; it will delete matching content after 365 days, which may not be intended. The policy is configured as 'Delete only' with a retention period of 365 days. This means that after 365 days from the last modification, the content will be permanently deleted. It does not retain content for any minimum period; it simply deletes it after the specified duration. The HR manager wants to keep records for at least 1 year, but this policy will delete them exactly at the 1-year mark, which may not be intended if the manager expects retention beyond that point or if the policy should also preserve content until deletion.

Answer

Employee records in Exchange are retained for 365 days after last modification, then deleted

Answer

Employee records in SharePoint are deleted after 365 days from last modification if they have Department=HR

Answer

The policy retains content for 365 days and then automatically moves to archive

Question 9

A company stores critical financial reports in a SharePoint Online library. To ensure that the reports have not been tampered with, the security team compares a calculated hash of each file against a stored baseline. This verification process primarily protects which security goal?

Accepted Answer

Integrity. The verification process uses hash comparison to detect unauthorized changes to files, which directly protects data integrity. Integrity ensures that data has not been altered or tampered with during storage or transit. In SharePoint Online, hashing (e.g., SHA-256) creates a unique fingerprint; if the calculated hash matches the stored baseline, the file is unchanged.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 10

Which TWO are features of Microsoft Entra ID?

Accepted Answer

Single sign-on (SSO). Options A and E are correct. Microsoft Entra ID provides Single sign-on (SSO) and Self-service password reset (SSPR). Option B (Data loss prevention) is a feature of Microsoft Purview. Option C (Cloud app discovery) is part of Microsoft Defender for Cloud Apps. Option D (Mobile device management) is a feature of Microsoft Intune.

Answer

Data loss prevention (DLP)

Answer

Cloud app discovery

Answer

Mobile device management (MDM)

Question 11

A healthcare organization uses Microsoft Entra ID and needs to enforce that only users from the United States and Canada can access patient records. Access attempts from all other locations must be blocked. Which Microsoft Entra ID Conditional Access condition should be configured to meet this requirement?

Accepted Answer

Locations. The Locations condition in Microsoft Entra ID Conditional Access allows administrators to define named locations (e.g., countries or IP ranges) and then grant or block access based on those locations. By configuring a policy that blocks access from all countries except the United States and Canada, the organization can enforce geographic restrictions on patient record access.

Answer

Device state

Answer

Sign-in risk

Answer

Client apps

Question 12

Your organization wants to use Microsoft Entra ID to require multi-factor authentication (MFA) for all users when accessing a financial application. What should you configure?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA based on specific conditions, such as the application being accessed (the financial app). This is the correct, modern approach to require MFA for a specific application rather than for all sign-ins globally. It provides granular control by evaluating signals like user, device, location, and application before granting access.

Answer

Identity Protection policy

Answer

Per-user MFA

Answer

MFA registration policy

Question 13

A compliance officer needs to automatically detect documents containing passport numbers in SharePoint Online and apply a retention label that retains the documents for 10 years before deleting them. They also want to prevent users from permanently deleting these documents before the retention period ends. Which Microsoft Purview solution should they use to achieve this?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it enables organizations to automatically apply retention labels to sensitive content—such as documents containing passport numbers—based on sensitive information types. It also enforces a retention period (10 years) and prevents users from permanently deleting documents before that period ends, meeting both the detection and preservation requirements.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Question 14

Your company uses Microsoft Purview to manage data across Azure, on-premises SQL Server, and Amazon S3. You need to create a unified map of all data sources and their sensitivity labels. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct feature because it provides a unified, automated map of data assets across hybrid and multi-cloud environments (Azure, on-premises SQL Server, and Amazon S3). It automatically scans and classifies data sources, applies sensitivity labels, and maintains a centralized metadata repository, enabling a holistic view of the data landscape and its sensitivity.

Answer

Microsoft Purview Data Sharing

Answer

Microsoft Purview Data Estate Insights

Answer

Microsoft Purview Data Catalog

Question 15

A security manager explains that the company's security strategy relies on multiple layers of controls, such as firewalls, antivirus software, and multi-factor authentication, so that if one layer fails, another can still prevent an attack. Which security principle does this strategy best represent?

Accepted Answer

Defense in depth. Defense in depth is the correct answer because it explicitly describes a layered security strategy where multiple independent controls (firewalls, antivirus, MFA) are deployed so that if one layer is bypassed or fails, subsequent layers still provide protection. This principle is foundational to modern security architecture and directly matches the scenario of using diverse controls to prevent a single point of failure.

Answer

Least privilege

Answer

Zero Trust

Answer

Separation of duties