SC-900 Practice Test 39 — 15 Questions

Question 1

A company uses Microsoft 365 and wants to protect against sophisticated phishing attacks that use malicious links in email. They also want real-time analysis of URLs at the time of click. Which Microsoft Defender for Office 365 feature provides this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Safe Links. Safe Links is the correct answer because it provides URL scanning and real-time click-time verification of links in email messages and Office documents. When a user clicks a link, Defender for Office 365 checks the URL against a dynamic list of known malicious sites and performs a real-time analysis to determine if the link is safe at that moment, protecting against sophisticated phishing attacks that use malicious links.

Answer

Safe Attachments

Answer

Anti-spam

Answer

Anti-malware

Question 2

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically trigger a playbook when a high-severity incident is created. Which automation option should be used?

Accepted Answer

Automation rule in Microsoft Sentinel. Microsoft Sentinel automation rules are specifically designed to trigger automated responses—such as running playbooks—based on incident creation or update conditions, including severity level. When a high-severity incident is created, an automation rule can invoke a playbook without requiring manual intervention or external orchestration.

Answer

Azure Policy assignment

Answer

Microsoft Power Automate flow directly from Sentinel

Answer

Azure Logic Apps HTTP trigger

Question 3

A company needs to ensure that only approved devices can access corporate resources. Which Microsoft Entra feature should they combine with Microsoft Intune?

Accepted Answer

Conditional Access. Conditional Access is the Microsoft Entra feature that enforces policies to grant or block access based on conditions such as device compliance. When combined with Microsoft Intune, which manages device compliance policies (e.g., requiring encryption, a specific OS version, or a healthy device health attestation), Conditional Access can block access from non-compliant or unapproved devices. This integration ensures that only devices marked as compliant by Intune can access corporate resources.

Answer

Application Proxy

Answer

Identity Protection

Answer

Privileged Identity Management

Question 4

Your organization uses Microsoft Entra ID P1. You need to implement a solution that allows users to reset their own passwords without administrator intervention. The solution must also enforce a policy that requires users to verify their identity with two methods before resetting. What should you configure?

Accepted Answer

Enable self-service password reset (SSPR) and configure the number of methods required to reset to 2.. Self-service password reset (SSPR) in Microsoft Entra ID P1 allows users to reset their own passwords without administrator intervention. By configuring SSPR and setting the number of methods required to reset to 2, you enforce the policy that users must verify their identity with two authentication methods before resetting their password.

Answer

Configure Privileged Identity Management (PIM) to require approval for password reset.

Answer

Create an Identity Protection user risk policy to force password reset.

Answer

Configure a Conditional Access policy to require MFA for password changes.

Question 5

Your organization uses Microsoft Intune for mobile device management. You need to ensure that users cannot copy corporate data from managed apps to personal apps. Which policy should you configure?

Accepted Answer

App Protection Policy. App Protection Policies (APP) in Microsoft Intune are designed to manage how data is handled within applications, regardless of device enrollment. By configuring a 'Save as' or 'Copy/paste' restriction between managed and unmanaged apps, you can prevent corporate data from being transferred to personal apps. This policy operates at the app layer, not the device layer, making it the correct choice for this data leakage scenario.

Answer

App Configuration Policy

Answer

Device Compliance Policy

Answer

Conditional Access Policy

Question 6

Your organization uses Microsoft Entra ID and Microsoft Defender for Cloud Apps. You want to monitor and control the use of cloud apps by enforcing session policies, such as preventing downloads from unmanaged devices. Which integration should you use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is the correct integration because it provides Cloud Access Security Broker (CASB) functionality, enabling session policies via reverse proxy to control user actions like blocking downloads from unmanaged devices. These policies are enforced in real-time by inspecting and modifying traffic to cloud apps based on device compliance signals from Microsoft Entra ID.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 7

Refer to the exhibit. You run the cmdlet and get a list of risk detections. What does this cmdlet retrieve?

Accepted Answer

Risk detections for the unfamiliar sign-in properties risk event type. The cmdlet `Get-MgRiskDetection` retrieves all risk detections in the tenant, but when combined with the `-Filter` parameter for `riskEventType eq 'unfamiliarSigninProperties'`, it specifically returns only those risk detections that match the unfamiliar sign-in properties risk event type. This is because the cmdlet supports filtering by the `riskEventType` property, which corresponds to the type of risk detection as defined by Microsoft Entra ID Protection.

Answer

Users who have been flagged for risky sign-ins

Answer

All risk detections in the tenant

Answer

All sign-in logs with unfamiliar properties

Question 8

Refer to the exhibit. A user reports being unable to access Exchange Online from their personal laptop. The sign-in log shows failure due to device non-compliance. What should you configure to allow access while maintaining security?

Accepted Answer

Create a Conditional Access policy requiring compliant device. The sign-in log indicates the failure is due to device non-compliance, meaning the user's personal laptop does not meet your organization's compliance policies (e.g., missing antivirus, encryption, or required updates). Creating a Conditional Access policy that requires a compliant device will block access from non-compliant devices while allowing access from compliant ones, maintaining security by enforcing device health checks before granting access to Exchange Online.

Answer

Reset the user's password

Answer

Block all personal devices

Answer

Enable MFA for the user

Question 9

A company deploys full disk encryption on all employee laptops to protect data in case a device is lost or stolen. Which security goal does this measure primarily address?

Accepted Answer

Confidentiality. Full disk encryption (FDE) ensures that data stored on the laptop's hard drive is unreadable without the correct decryption key. This directly protects the confidentiality of the data by preventing unauthorized access if the device is lost or stolen, as the encrypted data cannot be deciphered without the key.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 10

Refer to the exhibit. You are reviewing a Microsoft Purview sensitivity label configuration. A user reports that a document containing a sensitive info type with confidence 80 was not automatically labeled. What is the most likely cause?

Accepted Answer

The auto-labeling policy is not configured to apply this label.. Auto-labeling in Microsoft Purview requires a specific auto-labeling policy to be configured and published to the user or location. Even if a sensitivity label exists and a sensitive info type (SIT) is detected with high confidence, the label will not be applied automatically unless an auto-labeling policy is explicitly set to apply that label to documents matching the SIT. The user's report indicates the label was not applied, which points to the policy not being configured, not a user override or encryption issue.

Answer

The user has overridden the label application.

Answer

The encryption is disabled.

Answer

The encryption template ID is missing.

Question 11

A security analyst downloads a software installer from a vendor's website. To ensure the file has not been tampered with during transmission, the analyst compares the SHA-256 hash of the downloaded file against the hash published on the vendor's official site. This practice primarily validates which security goal?

Accepted Answer

Integrity. Comparing the SHA-256 hash of the downloaded installer against the vendor's published hash verifies that the file has not been altered during transmission. This directly validates integrity, which ensures data remains unchanged from its original source. Hashing is a one-way cryptographic function; any change in the file, even a single bit, produces a completely different hash value, making tampering detectable.

Answer

Confidentiality

Answer

Availability

Answer

Authentication

Question 12

An organization wants to implement a zero-trust security model. They plan to require multi-factor authentication (MFA) for all users accessing sensitive applications, but only when the sign-in risk is medium or higher. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra ID Conditional Access policy with risk condition. B is correct because Microsoft Entra ID Conditional Access policies allow administrators to enforce MFA based on sign-in risk level, which is evaluated by Microsoft Entra ID Protection. By configuring a policy with a risk condition (e.g., medium or higher), the organization can require MFA only when the sign-in risk meets that threshold, aligning with a zero-trust model that grants access based on real-time risk assessment rather than a static rule.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Defender for Cloud Apps access policy

Answer

Microsoft Entra ID Protection risk detection policy

Question 13

An attacker gains access to a company's email system and reads confidential customer emails. Which security principle has been compromised?

Accepted Answer

Confidentiality. Confidentiality is the security principle that ensures data is accessible only to authorized users. When an attacker reads confidential customer emails without authorization, the confidentiality of that data has been breached, as the information was exposed to an unintended party.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 14

Your organization wants to protect sensitive documents from being copied to unauthorized cloud services. Which Microsoft Purview capability should you use?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers or health records—when users attempt to copy or share it with unauthorized cloud services like personal OneDrive or third-party storage apps. By scanning content in transit and applying actions like blocking the action or encrypting the data, DLP directly addresses the requirement to prevent data exfiltration to unauthorized cloud destinations.

Answer

Audit log

Answer

Retention policy

Answer

Sensitivity label

Question 15

Your organization uses Microsoft Entra ID and wants to enforce multi-factor authentication (MFA) for all users. Which policy should you create?

Accepted Answer

Conditional Access policy. Conditional Access policies are the correct mechanism to enforce MFA for all users because they allow granular, policy-driven access controls based on signals like user, location, device, and application. By creating a Conditional Access policy that requires MFA for all cloud apps, you can target all users and enforce MFA at authentication time, providing a flexible and scalable solution.

Answer

Identity Protection policy

Answer

Security defaults

Answer

Privileged Identity Management