SC-900 Practice Test 37 — 15 Questions

Question 1

A company is migrating its on-premises virtual machines to Azure Infrastructure-as-a-Service (IaaS). Which security responsibility primarily shifts from the customer to Microsoft during this migration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Physical security of the data center. When migrating on-premises virtual machines to Azure IaaS, Microsoft takes over responsibility for the physical security of the data centers, including environmental controls, hardware maintenance, and physical access controls. This is a fundamental shift from the customer's responsibility under the shared responsibility model, where the customer previously managed the physical infrastructure on-premises.

Answer

Patching the guest operating system

Answer

Managing user access to the virtual machines

Answer

Configuring the firewall rules for the virtual network

Question 2

A multinational corporation has data stored across multiple clouds (Azure, AWS) and on-premises. The data governance team needs to create a single inventory of all data assets, automatically classify sensitive data (e.g., credit card numbers) across these sources, and track how data moves and transforms (lineage). Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct solution because it provides a unified map of data assets across multi-cloud (Azure, AWS) and on-premises sources, supports automated sensitive data classification (e.g., credit card numbers via built-in classifiers), and tracks data lineage to show how data moves and transforms. This directly meets the requirements for a single inventory, classification, and lineage tracking.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview eDiscovery

Question 3

A compliance officer needs to identify and monitor potentially risky user activities, such as users copying large amounts of data to external devices or sharing sensitive files with unauthorized recipients. They want to create a policy that detects these activities and automatically escalates them for investigation. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is specifically designed to detect and investigate malicious or inadvertent insider risks based on activities like data exfiltration, unusual file sharing, or violations of corporate policies. It uses indicators and adaptive policies to assign risk scores and trigger alerts for review. Audit (option B) only provides logging and does not have built-in risk analysis. Communication Compliance (option C) focuses on inappropriate communications, not data-related risks. Compliance Manager (option D) assesses compliance posture but does not detect risky user activities. Therefore, Insider Risk Management is the correct solution.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Compliance Manager

Question 4

A security team monitors user activities in third-party cloud apps like Box and Dropbox. They want to automatically detect when a user performs an anomalous file download after signing in from an unusual location, and then suspend the user's account and initiate an investigation. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it provides Cloud Access Security Broker (CASB) functionality, including anomaly detection for user activities across third-party cloud apps like Box and Dropbox. It can automatically detect anomalous file downloads after unusual sign-in locations using behavioral analytics and then trigger automated actions such as suspending the user account and initiating an investigation via integration with Microsoft 365 Defender.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Endpoint

Question 5

A company uses Microsoft 365 and needs to prevent employees in the Mergers & Acquisitions (M&A) department from communicating with employees in the Trading department via Microsoft Teams chat, email, and SharePoint sharing. They must ensure that these restrictions are automatically enforced by Microsoft 365. Which Microsoft Purview solution should the administrator configure?

Accepted Answer

Microsoft Purview Information Barriers. Information Barriers in Microsoft Purview are designed to prevent communication and collaboration between specified groups, helping organizations avoid conflicts of interest and comply with regulations.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview eDiscovery (Premium)

Question 6

A company uses cryptographic hashes to verify that a downloaded software file has not been modified by an attacker during transmission. Which principle of the CIA triad is primarily being addressed?

Accepted Answer

Integrity. Cryptographic hashing (e.g., SHA-256) produces a fixed-size digest from the file's contents. By comparing the computed hash with the publisher's published hash, any change to the file—even a single bit—yields a completely different digest, proving the file has not been tampered with. This directly protects the integrity of the data, ensuring it remains unaltered during transit.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 7

A company must retain all financial records for exactly 7 years and then automatically delete them. They need to automatically apply a retention label to any document that contains the words 'Invoice' or 'Statement'. Which Microsoft Purview solution should they use?

Accepted Answer

Data Lifecycle Management (retention labels with auto-apply). Data Lifecycle Management (DLM) with auto-apply retention labels is the correct solution because it allows you to define a retention label that automatically applies to documents containing the keywords 'Invoice' or 'Statement' using a sensitive info type or trainable classifier. You can then configure the label to retain the data for exactly 7 years and trigger automatic deletion at the end of that period. This directly meets the requirement for both automated classification and lifecycle enforcement.

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery (Standard)

Answer

Audit

Question 8

A company's security policy requires that all data transferred between the corporate data center and the cloud must be protected from unauthorized access during transmission. They use encryption protocols such as TLS to achieve this. Which security goal is primarily being addressed?

Accepted Answer

Confidentiality. Confidentiality is the security goal that ensures data is not disclosed to unauthorized entities. By using encryption protocols such as TLS, the data in transit is rendered unreadable to any party that intercepts the traffic, directly protecting against unauthorized access during transmission.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 9

A security team wants to discover which cloud applications (such as Dropbox, Salesforce, or unsanctioned file-sharing apps) are being used by employees, even if those apps are not sanctioned by IT. They need to analyze usage patterns, risk levels, and identify potential shadow IT. Which feature of Microsoft Defender for Cloud Apps should they enable?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs from firewalls and proxies to identify cloud app usage, including unsanctioned apps like Dropbox or Salesforce, without requiring API integration. It provides risk scores, usage patterns, and shadow IT detection by comparing discovered apps against Microsoft's cloud app catalog of over 31,000 apps.

Answer

App Connectors (API connectors)

Answer

Conditional Access App Control

Answer

Microsoft Defender for Endpoint

Question 10

Which TWO are capabilities of Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Entitlement Management. Entitlement Management and Access Reviews are capabilities of Entra ID Governance. Conditional Access is a separate feature, Identity Protection is security, and SSPR is user self-service.

Answer

Self-service password reset

Answer

Identity Protection

Answer

Conditional Access

Question 11

A healthcare organization uses Microsoft 365 and wants to prevent users from sending emails that contain patient health information (PHI) to external recipients. Which Microsoft Purview solution should they implement?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive data, such as patient health information (PHI), via email and other channels. DLP policies can be configured with sensitive information types (e.g., HIPAA-defined PHI patterns) to automatically block or warn users when they attempt to send such data to external recipients.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

eDiscovery

Question 12

A company uses Microsoft Entra ID and wants to ensure that guest users who are inactive for 90 days have their access to internal resources automatically revoked. Additionally, a manager must review all guest accounts annually. Which Microsoft Entra feature should be used to implement these requirements?

Accepted Answer

Microsoft Entra Identity Governance Access Reviews. Microsoft Entra Identity Governance Access Reviews enables administrators to create recurring reviews of guest user access and automatically remove access for inactive users. By configuring an access review with a duration of 90 days and enabling automatic revocation, guest users who have not signed in for that period will have their access removed. Additionally, the annual manager review requirement is met by scheduling a recurring review for all guest accounts, ensuring compliance with governance policies.

Answer

Conditional Access policies

Answer

Privileged Identity Management (PIM)

Answer

Self-Service Password Reset (SSPR)

Question 13

A company receives a subject rights request (SRR) from a customer under GDPR, asking for the deletion of all personal data held about them. The compliance team needs a tool to orchestrate the discovery of this data across Microsoft 365 and other systems, and to track the response and fulfillment of the request. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Priva (Privacy Management). Microsoft Priva (Privacy Management) is the correct solution because it is specifically designed to help organizations manage subject rights requests (SRRs) under regulations like GDPR. It automates the discovery of personal data across Microsoft 365 and connected systems, provides a workflow to track the request lifecycle, and facilitates the fulfillment of actions such as deletion. This directly addresses the compliance team's need to orchestrate discovery and track response for an SRR.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management (retention labels)

Question 14

A multinational company stores customer data across multiple Azure regions. A new regulation requires that customer data must remain within the country's borders and cannot be transferred abroad. Which concept does this regulation primarily relate to?

Accepted Answer

Data Sovereignty. Data Sovereignty is the correct answer because the regulation mandates that customer data must remain within the country's borders and cannot be transferred abroad. This legal and compliance concept asserts that data is subject to the laws and governance structures of the nation where it is physically stored, directly addressing cross-border transfer restrictions.

Answer

Data Residency

Answer

Data Retention

Answer

Data Classification

Question 15

A company uses Microsoft Entra ID. The security team needs to block all sign-in attempts from a list of known malicious IP addresses. They also want to block sign-ins that originate from anonymous proxy services. Which Microsoft Entra capability should they configure to meet these requirements?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID allow administrators to define conditions under which sign-ins are blocked or allowed. By configuring a policy that includes 'Locations' as a condition, you can specify a list of known malicious IP addresses and also enable the 'Anonymous IP address' risk detection to block sign-ins from anonymous proxy services. This directly meets the requirement to block sign-ins from both specific IPs and anonymous proxies.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Access Reviews