SC-900 Practice Test 36 — 15 Questions

Question 1

Refer to the exhibit. A compliance administrator is configuring role-based access control (RBAC) in Microsoft Purview compliance portal. Which role group would provide the permissions shown?

Accepted Answer

Information Protection. The permissions (Sensitive Info Types, Data Classifiers, Content Explorer) are part of the Information Protection role group. Option A is correct. Option B (Data Classification) is a role within Information Protection, not a group. Option C (Compliance Administrator) is a higher-level role. Option D (Security Reader) is read-only.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Data Classification

Question 2

Which THREE Microsoft Purview features can be used to protect data in Microsoft 365? (Select three.)

Accepted Answer

Data Loss Prevention. Data Loss Prevention, Sensitivity labels, and Insider Risk Management are Purview features. Defender for Cloud Apps (Option D) is a separate product. eDiscovery (Option E) is for discovery, not protection.

Answer

eDiscovery

Answer

Microsoft Defender for Cloud Apps

Question 3

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' sensitivity label to any document that contains a Social Security number. What should you create?

Accepted Answer

An auto-labeling policy for sensitivity labels. Option D is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive info types like SSN. Option A is wrong because a manual label policy requires user action. Option B is wrong because a DLP policy blocks sharing but doesn't apply labels. Option C is wrong because a retention policy manages data retention, not classification.

Answer

A sensitivity label policy with manual labeling

Answer

A Data Loss Prevention (DLP) policy

Answer

A retention policy

Question 4

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a compliant antivirus solution can access corporate email. Which policy type should be configured?

Accepted Answer

Conditional Access policy in Microsoft Entra ID. Conditional Access policies can grant access based on device compliance, and compliance policies in Intune can require antivirus to be installed and active.

Answer

App protection policy in Microsoft 365

Answer

Device compliance policy in Intune

Answer

Security baseline in Microsoft Defender for Cloud

Question 5

Refer to the exhibit. The JSON shows a Microsoft Purview DLP policy. A user sends an email with a credit card number to an external recipient. What will happen?

Accepted Answer

The email is blocked and the user receives a notification.. The policy is scoped to Exchange, SharePoint, and OneDrive, and includes a rule with BlockAccess action. Since Exchange is included, the email will be blocked and the user notified.

Answer

The email is delivered normally because TeamsChatAndChannel is false.

Answer

The email is delivered but an alert is generated.

Answer

The email is encrypted before delivery.

Question 6

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from copying credit card numbers from an internal web application to a personal cloud storage app. Which DLP policy setting should they configure?

Accepted Answer

Endpoint DLP with clipboard control. Endpoint DLP policies can monitor and control clipboard operations, including copying sensitive data to unallowed apps. Option A is incorrect because browser DLP only covers browser-based activities. Option C is incorrect because email DLP covers email. Option D is incorrect because Teams DLP covers Teams chats and channels.

Answer

Browser DLP

Answer

Exchange DLP

Answer

Teams DLP

Question 7

Refer to the exhibit. You are reviewing a policy in Microsoft Defender for Cloud that monitors for unencrypted data uploads to an S3 bucket. The policy condition is shown. Which statement about this policy is correct?

Accepted Answer

The policy enforces encryption for objects uploaded to the 'documents' bucket.. The condition specifies that the request must have server-side encryption set to AES256. This is a security control to ensure data is encrypted at rest. The policy restricts uploads without encryption, but it allows uploads with AES256 encryption. The resource is a wildcard under the 'documents' bucket. Option D correctly states that the policy applies to objects in the 'documents' bucket.

Answer

The policy applies to all S3 buckets in the account.

Answer

The policy requires encryption with AWS KMS.

Answer

The policy denies all uploads to the bucket.

Question 8

Refer to the exhibit. You are deploying a custom assessment automation in Microsoft Defender for Cloud using Bicep. The deployment fails with an error that the resource type is not valid. What is the most likely reason?

Accepted Answer

The property 'supportedCloud' should be 'supportedClouds' as an array.. The resource type 'Microsoft.Security/customAssessmentAutomations' is a valid type, but the API version '2021-07-01-preview' may not be correct. However, the more likely issue is that the property 'supportedCloud' should be 'supportedClouds' (plural) and the value should be an array. Option D is correct. Option A is wrong because the resource type exists. Option B is wrong because the API version might be valid but not the latest. Option C is wrong because the name is valid.

Answer

The API version is not supported.

Answer

The name property is missing.

Answer

The resource type is misspelled.

Question 9

Your company uses Microsoft Defender XDR. You need to integrate threat intelligence from external sources to enrich alerts and automate response actions. Which feature should you use?

Accepted Answer

Threat intelligence integration. Option C is correct because Microsoft Defender XDR supports threat intelligence integration via APIs and SIEM connectors, allowing ingestion of external threat intel. Option A is wrong because automation rules are for response actions, not ingestion. Option B is wrong because advanced hunting queries are for investigation. Option D is wrong because threat analytics provides built-in intelligence, not external ingestion.

Answer

Automation rules

Answer

Threat analytics

Answer

Advanced hunting

Question 10

A company wants to automatically classify documents containing credit card numbers and apply encryption at rest in SharePoint Online. Which Microsoft Purview feature should be used?

Accepted Answer

Sensitivity labels with auto-classification. Sensitivity labels with auto-classification can detect credit card numbers and apply encryption. Option B is correct. Option A (DLP policies) prevent sharing but do not apply encryption. Option C (Audit) logs activities. Option D (eDiscovery) is for legal discovery.

Answer

eDiscovery

Answer

Microsoft Purview Audit

Answer

Data Loss Prevention (DLP) policies

Question 11

Which TWO Microsoft Entra ID capabilities help detect and remediate identity risks? (Select two.)

Accepted Answer

Identity Protection. Identity Protection detects risks, and Conditional Access policies can enforce remediation. PIM (Option C) manages privileges. Password protection (Option D) prevents weak passwords. Identity Governance (Option E) manages access lifecycle.

Answer

Identity Governance

Answer

Password protection

Answer

Privileged Identity Management

Question 12

Your company uses Microsoft Defender for Endpoint. A report shows that several devices are missing critical security updates. What feature should you use to deploy the missing updates?

Accepted Answer

Microsoft Intune update rings for Windows. Option C is correct because Microsoft Intune can manage updates for Windows devices. Option A is wrong because Defender for Endpoint detects but does not deploy updates. Option B is wrong because Microsoft Update is a service, not a management tool. Option D is wrong because Microsoft Configuration Manager is on-premises, but Intune is cloud-based and more likely for modern management.

Answer

Microsoft Defender for Endpoint's threat and vulnerability management (TVM)

Answer

Microsoft Configuration Manager

Answer

Microsoft Update

Question 13

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically trigger a playbook when a high-severity incident is created. Which automation option should be used?

Accepted Answer

Automation rule in Microsoft Sentinel. Automation rules in Microsoft Sentinel allow you to automatically run playbooks when incidents are created or updated, based on conditions like severity.

Answer

Azure Policy assignment

Answer

Microsoft Power Automate flow directly from Sentinel

Answer

Azure Logic Apps HTTP trigger

Question 14

Refer to the exhibit. The KQL query is run in Microsoft Defender for Endpoint. What is the purpose of this query?

Accepted Answer

To find devices with a high number of operations on potentially sensitive files.. The query looks for devices where multiple file events (over 5) involving files with 'confidential' in the name and larger than 1000 bytes occurred in the last 7 days, grouped by device and action type.

Answer

To list all devices that have files named confidential.

Answer

To detect malware on devices.

Answer

To list all file creation events.

Question 15

Your organization wants to use Microsoft Entra ID to require multi-factor authentication (MFA) for all users when accessing a financial application. What should you configure?

Accepted Answer

Conditional Access policy. Conditional Access policies allow you to enforce MFA based on application and user conditions. Option B is incorrect because MFA registration policy only enforces registration, not usage. Option C is incorrect because identity protection focuses on risk. Option D is incorrect because per-user MFA is a legacy method; Conditional Access is the modern approach.

Answer

Identity Protection policy

Answer

Per-user MFA

Answer

MFA registration policy

SC-900 Practice Test 36 — 15 Questions

Exhibit

SC-900 Practice Test 36 — 15 Questions

Exhibit