SC-900 Practice Test 38 — 15 Questions

Question 1

A hospital stores patient medical records electronically. An attacker gains access to the system and modifies patient diagnoses. Which principle of the CIA triad has been violated?

Accepted Answer

Integrity. The CIA triad's Integrity principle ensures that data is not modified by unauthorized parties. In this scenario, the attacker altered patient diagnoses, which directly violates data integrity. Confidentiality (unauthorized disclosure) and Availability (denial of service) are not the primary concerns here.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 2

A multinational corporation must comply with the General Data Protection Regulation (GDPR). They use Microsoft Purview Compliance Manager to manage compliance activities. The compliance manager wants to automatically assign each control to the appropriate team member for remediation. What should they configure?

Accepted Answer

Configure improvement actions with owners. To automatically assign each control to the appropriate team member for remediation in Microsoft Purview Compliance Manager, you must configure improvement actions with owners. Each improvement action can be assigned to a specific user who is responsible for implementing the remediation steps, and this assignment triggers automatic notifications and tracking within the compliance score.

Answer

Create new assessments for each regulation

Answer

Set up connectors to import external risk data

Answer

Use the Microsoft 365 admin center to delegate tasks

Question 3

A company uses Microsoft 365 and allows employees to access corporate email and documents from their personal devices. The security team wants to protect against malicious links in emails and Microsoft Teams messages. When a user clicks a link, it should be checked in real-time to see if it leads to a known malicious site. If it does, access should be blocked. Which Microsoft security solution provides this capability?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Links, which provides real-time URL scanning at the time of click. When a user clicks a link in an email or Teams message, the URL is rewritten and checked against a dynamic list of known malicious sites. If the link is determined to be malicious, access is blocked, and the user is redirected to a warning page.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 4

An organization uses Microsoft Purview Compliance Manager to track compliance with regulations. The compliance officer needs to create a custom assessment for a new internal policy. What should they do?

Accepted Answer

Create a new custom assessment in Compliance Manager and add custom controls.. In Microsoft Purview Compliance Manager, assessments are built on templates that contain controls. To create a custom assessment for a new internal policy, the compliance officer must create a new custom assessment and then add custom controls, because Compliance Manager does not provide a built-in template for arbitrary internal policies. Option B correctly describes this workflow: creating a new custom assessment and adding custom controls.

Answer

Use the Microsoft 365 admin center to create a compliance assessment.

Answer

Use the built-in 'Custom' template in Compliance Manager and modify it.

Answer

Import a new assessment template from the Microsoft Service Trust Portal.

Question 5

A company uses Microsoft Sentinel for security information and event management (SIEM). The security team needs to detect and automatically respond to a potential privilege escalation attack where an attacker attempts to add a new user to the Global Administrator role in Microsoft Entra ID. What should the security team configure?

Accepted Answer

Create an analytics rule with an automated playbook in Microsoft Sentinel. Microsoft Sentinel is the SIEM solution, and analytics rules define conditions that trigger automated responses. By creating an analytics rule that detects a user being added to the Global Administrator role (e.g., via the AuditLogs or IdentityProtection logs) and linking it to an automated playbook (a logic app), the security team can automatically respond to the privilege escalation attempt without manual intervention.

Answer

Deploy a device compliance policy in Microsoft Intune

Answer

Configure a data classification label in Microsoft Purview

Answer

Create a policy in Microsoft Defender for Cloud Apps

Question 6

A compliance officer needs to create a policy that prevents users from sharing files containing medical record numbers (MRN) via email. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as medical record numbers (MRN), via email. DLP policies can inspect email content and attachments for patterns (e.g., regex for MRNs) and automatically enforce actions like blocking the message or notifying the user, preventing data exfiltration.

Answer

Sensitivity labels

Answer

eDiscovery

Answer

Insider risk management

Question 7

A company wants to prevent employees from accidentally sharing a document containing personally identifiable information (PII) with external users. The document is stored in OneDrive for Business. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the accidental sharing of sensitive data, such as PII, with external users. DLP policies can be configured to scan documents in OneDrive for Business for PII patterns (e.g., Social Security numbers, credit card numbers) and automatically block sharing with external users or trigger a policy tip to warn the employee. This directly addresses the requirement to prevent accidental external sharing of PII.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Question 8

Which Microsoft security solution provides centralized investigation and response across identities, endpoints, email, and cloud apps by correlating alerts from multiple sources?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct answer because it is specifically designed to correlate alerts from identities, endpoints, email, and cloud apps into a single incident, providing centralized investigation and response. It uses the Microsoft 365 Defender portal to unify signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, enabling automated remediation across these domains.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 9

Match each Microsoft Defender product to its focus area.

Accepted Answer

Microsoft Defender for Cloud: Secures cloud workloads. Microsoft Defender for Cloud secures cloud workloads; Defender for Endpoint secures endpoints; Defender for Identity secures identities; Defender for Office 365 secures email and collaboration; Defender for Cloud Apps secures shadow IT and app permissions.

Answer

Microsoft Defender for Office 365: Secures shadow IT and app permissions

Answer

Microsoft Defender for Cloud Apps: Secures cloud workloads

Question 10

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook, while maintaining security and compliance with conditional access policies. What should you configure?

Accepted Answer

Configure Microsoft Entra External ID with social identity providers.. Microsoft Entra External ID (formerly Azure AD External Identities) allows you to configure social identity providers such as Google and Facebook as external identity sources. This enables users to sign in with their existing social media accounts while still being subject to your tenant's conditional access policies, ensuring security and compliance.

Answer

Enable Microsoft Entra Permissions Management.

Answer

Deploy Microsoft Entra Verified ID.

Answer

Configure Microsoft Entra B2B collaboration for guest users.

Question 11

You are the identity administrator for a multinational company using Microsoft Entra ID. The company has a Microsoft 365 E5 subscription. The security team wants to enforce the following requirements:

1. All users must use multi-factor authentication (MFA) when accessing sensitive applications (e.g., finance app).
2. Users from the IT department must use passwordless authentication methods (e.g., Windows Hello for Business) when accessing any resource.
3. All access to sensitive applications must be logged and monitored for anomalous activity.
4. Guest users from partner organizations must be automatically reviewed quarterly to ensure they still need access.
5. The company wants to minimize administrative overhead by automating as much as possible.

You need to design a solution that meets these requirements using Microsoft Entra ID capabilities. Which combination of actions should you take?

Accepted Answer

Create Conditional Access policies: one requiring MFA for the finance app, another requiring passwordless authentication strength for IT. Enable Microsoft Entra ID Protection to log and monitor sign-in risks. Create an access review for guest users.. It uses Conditional Access policies to enforce MFA for the finance app and passwordless authentication strength for IT, meeting requirements 1 and 2. Microsoft Entra ID Protection logs and monitors sign-in risks for sensitive apps (requirement 3), and an access review for guest users automates quarterly reviews (requirement 4). This minimizes administrative overhead by leveraging automation, aligning with requirement 5.

Answer

Configure Self-Service Password Reset (SSPR) for all users. Enable Microsoft Entra ID Protection. Create an access review for guests.

Answer

Use Microsoft Entra ID Protection to enforce MFA based on risk. Implement Privileged Identity Management (PIM) for IT. Configure access reviews for guests.

Answer

Enable security defaults to enforce MFA for all users. Configure Microsoft Entra ID Protection to monitor anomalies. Use Microsoft Entra ID Governance to automate guest access reviews.

Question 12

Your organization uses Microsoft Sentinel to detect threats. A security analyst needs to create a custom analytics rule that triggers an incident when a user accesses more than 1000 files from an external IP address within 5 minutes. Which rule type should the analyst configure?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows the analyst to define a custom KQL query that counts file access events from external IPs and triggers an incident when the threshold of 1000 files within 5 minutes is exceeded. This rule type supports aggregation, time windows, and custom thresholds, making it ideal for detecting specific behavioral patterns like high-volume access from external sources.

Answer

Fusion rule

Answer

ML Behavior Analytics rule

Answer

Near-real-time (NRT) query rule

Question 13

An organization uses Microsoft Entra ID for identity management and wants to allow external partners to access their resources using their own corporate credentials. Which feature should they enable?

Accepted Answer

Entra External ID. Entra External ID (formerly Azure AD B2B) enables organizations to invite external partners to access resources using their own corporate credentials. This feature leverages federation protocols such as SAML, WS-Fed, or OpenID Connect to authenticate the partner's identity in their home tenant, eliminating the need for separate local accounts.

Answer

Identity Protection

Answer

Conditional Access

Answer

Privileged Identity Management

Question 14

A company deploys Microsoft Entra ID Protection. The security team wants to automatically block sign-ins from anonymous IP addresses. They configure a Conditional Access policy. Which assignment condition should they use?

Accepted Answer

Sign-in risk level condition with 'High'. C is correct because the sign-in risk level condition in Conditional Access allows you to target sign-ins that have been assessed by Microsoft Entra ID Protection as risky. Anonymous IP addresses are a specific sign-in risk detection, and configuring the policy to block sign-ins with a 'High' sign-in risk level will automatically block those sign-ins. This directly addresses the security team's requirement to block sign-ins from anonymous IP addresses.

Answer

User risk level condition with 'Medium'

Answer

Device condition with 'Compliant'

Answer

Location condition with 'Any IP'

Question 15

Your organization uses Microsoft Defender for Cloud Apps. A security analyst notices anomalous file downloads from a SharePoint site by a user flagged as high risk. What should the analyst configure to automatically block such activity?

Accepted Answer

Configure a session policy. Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user activities based on risk level. When a user is flagged as high risk, a session policy can be configured to automatically block anomalous file downloads from SharePoint by intercepting the session and applying actions such as block, allow, or restrict. This is the correct choice because it directly addresses the need to prevent the specific activity in real time.

Answer

Configure a file policy

Answer

Configure an access policy

Answer

Configure an app permission policy