SC-900 Practice Test 39 — 15 Questions

Question 1

Your organization has Microsoft Sentinel deployed. The security operations team needs to automatically respond to a security incident by opening an incident in ServiceNow and sending a notification to a Teams channel. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An automation rule with a playbook. Automation rules in Microsoft Sentinel can trigger playbooks (based on Azure Logic Apps) that integrate with external systems like ServiceNow and Teams. Option B is wrong because workbooks provide visualizations, not automation. Option C is wrong because analytics rules create alerts, not automated responses. Option D is wrong because watchlists are for correlation, not response.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 2

An organization decides to eliminate passwords for their employees. They deploy Windows Hello for Business on company-issued laptops, allowing users to sign in with a PIN or a biometric gesture (e.g., fingerprint). The IT team also enables Microsoft Authenticator and FIDO2 security keys as alternative sign-in methods. Which Microsoft Entra ID capability are they leveraging?

Accepted Answer

Passwordless authentication. The organization is implementing passwordless authentication by removing passwords and using Windows Hello for Business (PIN/biometrics), Microsoft Authenticator, and FIDO2 security keys. These methods replace the password with a cryptographic key pair bound to the device or user, satisfying the definition of passwordless authentication in Microsoft Entra ID.

Answer

Microsoft Entra ID Protection

Answer

Conditional Access

Answer

Self-Service Password Reset (SSPR)

Question 3

Which TWO features are part of Microsoft Defender XDR?

Accepted Answer

Automated investigation and response. Automated investigation and response (AIR) is a core capability of Microsoft Defender XDR, enabling automatic response to threats across workloads. Option E is correct because Incident management across workloads allows security teams to manage and correlate incidents from multiple sources in a unified console within Defender XDR. Option B is incorrect because Cloud app discovery is a feature of Microsoft Defender for Cloud Apps, not Defender XDR. Option C is incorrect because Endpoint data loss prevention (Endpoint DLP) is part of Microsoft Purview compliance solutions. Option D is incorrect because Identity Protection is a feature of Microsoft Entra ID (formerly Azure AD), not Defender XDR.

Answer

Cloud app discovery

Answer

Endpoint data loss prevention

Answer

Identity Protection

Question 4

A company implements multiple layers of security controls: firewalls at the perimeter, intrusion detection systems on internal segments, antivirus software on all workstations, and encryption for sensitive data at rest and in transit. This strategy is intended to ensure that if one control fails, others still provide protection. Which security concept does this approach represent?

Accepted Answer

Defense in depth. Defense in depth is the correct concept because it involves implementing multiple layers of security controls (e.g., firewalls, IDS, antivirus, encryption) so that if one layer fails, subsequent layers continue to provide protection. This layered approach ensures redundancy and mitigates the risk of a single point of failure, aligning with the scenario described.

Answer

Least privilege

Answer

Separation of duties

Answer

Zero trust

Question 5

Your company, Contoso, uses Microsoft Entra ID for employee identity management. You need to ensure that when an employee leaves the company, their access to all SaaS applications is automatically revoked within 24 hours. The HR department updates the employee status in a cloud HR system (Workday). What should you do?

Accepted Answer

Configure Microsoft Entra ID provisioning from Workday to automatically disable users when their employment status changes.. Microsoft Entra ID supports automated user provisioning from Workday via the built-in Workday to Entra ID provisioning connector. When an employee's status changes to 'terminated' in Workday, the provisioning service automatically disables the corresponding user account in Entra ID, typically within 40 minutes (well under the 24-hour requirement). This eliminates manual intervention and ensures timely revocation of access to all SaaS applications integrated with Entra ID.

Answer

Ask HR to manually disable each user in Microsoft Entra ID after termination.

Answer

Use Microsoft Graph API to write a custom application that polls Workday and disables users.

Answer

Create an Azure Automation runbook that runs daily and checks Workday for terminated employees, then disables them in Entra ID.

Question 6

A company uses Microsoft Entra ID and wants to automatically detect and remediate over-privileged roles in their Azure subscriptions and AWS accounts. They need to get a unified view of permissions across multiple clouds. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra Permissions Management. Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution that provides visibility into permissions across multi-cloud environments, including Azure and AWS. It automatically detects over-privileged roles and can remediate them by enforcing least-privilege access policies, making it the correct choice for the described requirement.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Verified ID

Answer

Microsoft Entra ID Governance

Question 7

A company uses a cloud-based Customer Relationship Management (CRM) system that is delivered as Software-as-a-Service (SaaS). According to the shared responsibility model, which security responsibility is primarily handled by the customer?

Accepted Answer

Managing user identities and controlling access to the CRM. In a SaaS model, the cloud provider is responsible for the security of the underlying infrastructure, including physical data centers, operating systems, and network controls. The customer retains responsibility for securing their own data and identities, which includes managing user accounts, enforcing authentication policies (e.g., Azure AD Multi-Factor Authentication), and controlling access to the CRM application via role-based access control (RBAC). Therefore, managing user identities and access is the customer's primary security responsibility.

Answer

Physical security of the data center hosting the CRM

Answer

Patching the underlying operating system of the CRM servers

Answer

Ensuring network security for the CRM application's backend

Question 8

Your organization uses Microsoft Entra ID for identity management. You need to require multi-factor authentication (MFA) for all users when accessing the Azure portal. Which feature should you use?

Accepted Answer

Conditional Access policy. Conditional Access policy (Option D) is correct because it allows you to create policies that enforce MFA for specific applications like the Azure portal. Option A, Privileged Identity Management, is used for managing and auditing privileged roles, not for enforcing MFA. Option B, Identity Protection user risk policy, can trigger MFA based on risk but cannot enforce MFA for all users unconditionally. Option C, an Entra ID P1 license, is a prerequisite for using Conditional Access but is not a feature itself.

Answer

Privileged Identity Management

Answer

Identity Protection user risk policy

Answer

Entra ID P1 license

Question 9

A company uses Microsoft Defender for Cloud to improve their cloud security posture. They want to see an aggregated score that reflects how well their resources are protected against threats. Which feature in Defender for Cloud provides this?

Accepted Answer

Security Score. The Security Score in Microsoft Defender for Cloud aggregates findings from security assessments and controls into a single percentage score, reflecting how well resources are protected against threats. It is based on the Secure Score algorithm, which calculates the ratio of passed controls to total controls, weighted by the potential impact of each control. This provides a unified, quantitative measure of cloud security posture.

Answer

Compliance dashboard

Answer

Cloud Security Posture Management (CSPM)

Answer

Workload protections

Question 10

An organization uses Microsoft Intune to manage devices. The security team wants to ensure that only devices with a minimum OS version and antivirus enabled can access corporate email. What should they configure?

Accepted Answer

Conditional Access policy referencing device compliance. A Conditional Access policy referencing device compliance is correct because it allows the security team to enforce access controls based on real-time device health signals, such as minimum OS version and antivirus status. When a device is marked as non-compliant by Intune, the Conditional Access policy blocks access to corporate email (e.g., Exchange Online) until the device meets the required compliance criteria. This combines Intune's compliance evaluation with Azure AD's access enforcement, ensuring only healthy devices can access corporate resources.

Answer

Device enrollment restrictions

Answer

App protection policies in Microsoft Defender for Cloud Apps

Answer

A device compliance policy

Question 11

A company runs a production Kubernetes cluster in Azure. The security team needs to continuously monitor the cluster for misconfigurations, such as containers running with privileged access or secrets exposed in environment variables. They also want to detect runtime threats like crypto-mining containers. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. It continuously assesses Kubernetes clusters against the CIS Kubernetes Benchmark, detecting misconfigurations like privileged containers and exposed secrets in environment variables, and uses behavioral analytics to detect runtime threats such as crypto-mining containers.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 12

A company uses Microsoft Purview. A compliance officer applies a retention label to a set of legal documents and configures the label to mark the items as records. After the label is applied, a user attempts to delete one of these documents from SharePoint Online. What will be the outcome?

Accepted Answer

The user receives an access denied error and cannot delete the document.. When a retention label is configured to mark items as records, the items become immutable and locked. In SharePoint Online, records cannot be deleted by users; any attempt to delete a record results in an 'access denied' error because the retention policy overrides standard user permissions to enforce compliance.

Answer

The user is allowed to delete the document, but a copy is retained in a preservation hold.

Answer

The document is deleted and immediately purged from the recycle bin.

Answer

The delete action is allowed but an audit event is generated and the document is still retained for the specified period.

Question 13

A security operations team needs to protect Windows servers from ransomware and other advanced threats. They require a solution that provides endpoint detection and response (EDR), automated investigation, and the ability to isolate compromised machines from the network. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR), automated investigation and remediation, and network isolation capabilities specifically for Windows servers and endpoints. These features directly address the requirement to protect against ransomware and advanced threats by detecting suspicious behavior, automatically investigating alerts, and allowing admins to isolate compromised machines from the network to prevent lateral movement.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Question 14

A company uses Microsoft Entra ID. The security team wants to grant temporary, time-bound administrative access to the Microsoft 365 user management role for IT support staff. The access should require an approval from a senior administrator, and all actions should be audited. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access with time-bound role activation, approval workflows, and full auditing. This directly matches the requirement for temporary, approved administrative access to the Microsoft 365 user management role with audit trails.

Answer

Conditional Access

Answer

Identity Protection

Answer

Identity Governance

Question 15

A security architect is explaining the evolution of the security perimeter. They state that because users access corporate resources from anywhere on any device, the traditional network perimeter is no longer sufficient. What does the architect identify as the new primary security perimeter?

Accepted Answer

The identity. In modern zero-trust architectures, identity is the new primary security perimeter because it enables granular access control regardless of network location. Since users access corporate resources from anywhere on any device, authentication and authorization (via protocols like OAuth 2.0, SAML, and OpenID Connect) become the decisive factor for granting access, rather than the traditional network boundary. This shift is foundational to Microsoft's identity-centric security model, where Azure AD (now Microsoft Entra ID) acts as the control plane for all resource access.

Answer

The cloud infrastructure

Answer

The data center

Answer

The endpoint