SC-900 Practice Test 40 — 15 Questions

Question 1

A company has several on-premises web-based applications that need to be securely accessed by remote employees without requiring a VPN. The IT team wants to provide single sign-on (SSO) using Microsoft Entra ID. Which Microsoft Entra ID feature should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy enables secure remote access to on-premises web applications without a VPN by acting as a reverse proxy. It integrates with Microsoft Entra ID to provide single sign-on (SSO) for users, leveraging pre-authentication and conditional access policies. This directly meets the requirement for VPN-less, SSO-enabled access.

Answer

Microsoft Entra Self-Service Password Reset (SSPR)

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Identity Protection

Question 2

A security team needs to investigate a potential data breach that may involve unauthorized access to sensitive files in SharePoint Online and OneDrive for Business. They want to search the unified audit log for file access events, including accesses from mobile devices and third-party applications. Additionally, they need to create custom alert policies that trigger when specific high-privilege users download large volumes of files in a short period. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) is the correct solution because it provides the deep, granular logging required to investigate data breaches, including file access events from mobile devices and third-party applications in SharePoint Online and OneDrive for Business. It also supports the creation of custom alert policies that can trigger on specific activities, such as high-privilege users downloading large volumes of files in a short period, by leveraging the unified audit log's rich schema and advanced detection capabilities.

Answer

Microsoft Purview eDiscovery (Premium)

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Question 3

A company uses Microsoft 365. The compliance team needs to create a policy that automatically blocks outgoing emails that contain personally identifiable information (PII) such as social security numbers. However, they want to allow users to override the block with a business justification if necessary. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft Purview is designed to detect and protect sensitive information, such as social security numbers, by automatically blocking outgoing emails that contain PII. DLP policies support user override with a business justification through policy tips and allow overrides, enabling compliance teams to balance security with business needs.

Answer

Communication Compliance

Answer

Records Management

Answer

Audit

Question 4

A company uses Microsoft Entra ID. The IT team wants to provide remote employees with secure, single sign-on (SSO) access to a critical on-premises web application that uses password-based authentication, without requiring a VPN connection. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy enables secure remote access to on-premises web applications by publishing them through an external endpoint, without requiring a VPN. It supports password-based SSO by securely storing and replaying credentials to the legacy application, allowing users to authenticate once via Entra ID. This makes it the correct choice for providing SSO to a password-based on-premises app without a VPN.

Answer

Microsoft Entra Connect

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra ID P2 license

Question 5

Which TWO of the following are features of Microsoft Purview Data Loss Prevention (DLP)? (Select TWO.)

Accepted Answer

Provide policy tips to users. Correct answers: D and E. D: Provide policy tips to users is a feature of Microsoft Purview DLP that educates users about policy violations. E: Monitor and prevent sharing of sensitive data is the primary function of DLP. Option A: Detect and block malware is a feature of Microsoft Defender for Endpoint. Option B: Apply sensitivity labels is a feature of Microsoft Information Protection. Option C: Manage user access rights is a feature of Entra ID (Identity Governance).

Answer

Detect and block malware

Answer

Apply sensitivity labels

Answer

Manage user access rights

Question 6

A company wants to provide secure external access to a partner application without creating user accounts manually. They need to allow partners to authenticate using their existing corporate identities (e.g., from other organizations) and configure policies for access. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra External ID (B2B collaboration). Microsoft Entra External ID (B2B collaboration) allows organizations to securely share applications and resources with external partners by letting them authenticate using their own corporate identities (e.g., from other Azure AD tenants, Microsoft accounts, or social identity providers). It eliminates the need to manually create and manage user accounts for partners, while enabling you to apply conditional access policies for granular control over external access.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Domain Services

Question 7

Refer to the exhibit. An administrator creates a DLP rule as shown. What is the expected outcome when a user tries to share a file containing a U.S. Social Security Number with an external recipient?

Accepted Answer

The sharing is blocked, and the user receives a notification.. The DLP rule is configured with an action of 'Block' (or 'BlockAccess') and user notification enabled. When a user attempts to share a file containing a U.S. SSN with an external recipient, the rule blocks the sharing and displays a notification to the user explaining that the action is blocked. Option A is incorrect because the rule applies to all users, not just non-owners. Option B is incorrect because the rule does more than generate an audit event; it actively blocks the sharing. Option C is incorrect because the rule blocks the action outright, rather than allowing it with justification.

Answer

The sharing is blocked only if the user is not the file owner.

Answer

The sharing is allowed, but an audit event is generated.

Answer

The file is shared, but the user is notified and must provide justification.

Question 8

A company requires all employees to provide a one-time passcode generated by an authenticator app in addition to their password when accessing the corporate VPN. This practice is an example of which security concept?

Accepted Answer

C. Authentication. The requirement for a one-time passcode (OTP) from an authenticator app in addition to a password is a classic implementation of multi-factor authentication (MFA). Authentication is the process of verifying the identity of a user, device, or service, and this scenario uses two distinct factors: something you know (password) and something you have (the OTP generated by the app). This directly aligns with the security concept of authentication, not authorization, auditing, or accounting.

Answer

A. Authorization

Answer

B. Auditing

Answer

D. Accounting

Question 9

Refer to the exhibit. An administrator runs the PowerShell command shown. What is the purpose of this command?

Accepted Answer

Search audit logs for file activities performed by a specific user. The command searches the unified audit log for file-related operations by a specific user in the last 90 days. Option C is correct. It does not delete files, modify permissions, or block the user.

Answer

Delete all files modified by a user in the last 90 days

Answer

Modify permissions on files uploaded by a user

Answer

Block a user from uploading files

Question 10

A healthcare organization needs to automatically classify documents containing patient health information (PHI) in Microsoft SharePoint. The solution should apply a 'Confidential - Healthcare' sensitivity label to any document that matches the HIPAA content pattern. Which Microsoft Purview feature should be used?

Accepted Answer

Auto-labeling for sensitivity labels. Auto-labeling for sensitivity labels (Option D) is correct because it automatically applies the specified sensitivity label to documents that match a defined pattern (e.g., HIPAA content) in SharePoint. Option A is wrong because retention label auto-apply is for retention, not sensitivity. Option B is wrong because manual labeling requires user action and does not auto-classify. Option C is wrong because DLP policies enforce rules to prevent data loss, they do not apply sensitivity labels.

Answer

Retention label auto-apply

Answer

Manual sensitivity labeling

Answer

Data loss prevention (DLP) policy

Question 11

An organization is moving a virtual machine to Azure Infrastructure as a Service (IaaS). According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Applying security updates to the guest operating system. In an IaaS deployment, the customer retains responsibility for securing the guest operating system, including applying security updates. Microsoft manages the physical infrastructure and hypervisor, while the customer must patch and configure the OS running inside the virtual machine.

Answer

Physical security of the datacenter

Answer

Maintaining the hypervisor

Answer

Power and cooling infrastructure

Question 12

A company runs critical applications on Azure virtual machines and on-premises SQL servers. The security team wants to reduce VM attack surface by allowing just-in-time (JIT) access to RDP and SSH ports only when needed. Additionally, they need to monitor changes to important registry keys and system files on the SQL servers. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides just-in-time (JIT) VM access to reduce the attack surface by locking down inbound traffic to RDP (port 3389) and SSH (port 22) until a user requests access. It also includes adaptive application controls and file integrity monitoring (FIM) to track changes to registry keys and system files on both Azure VMs and on-premises SQL servers. This makes it the single solution that addresses both requirements.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 13

Your organization wants to automatically retain customer emails for 5 years after they are received, and then delete them. You need to configure the appropriate Microsoft Purview solution. What should you use?

Accepted Answer

Retention label published automatically. Retention labels in Microsoft Purview can be published automatically to apply to emails based on conditions (such as being received from customers), and they can specify both a retention period (e.g., 5 years) and a disposal action (deletion). Option A is incorrect because eDiscovery cases are used for legal hold and content search, not automated retention. Option B is incorrect because DLP policies focus on preventing data loss through sharing control, not retention. Option C is incorrect because sensitivity labels are primarily for classification and protection, though they can include retention settings; however, the question specifically asks for a retention label published automatically, which is the correct solution.

Answer

eDiscovery case

Answer

Data loss prevention (DLP) policy

Answer

Sensitivity label

Question 14

Which THREE capabilities are provided by Microsoft Purview Compliance Manager?

Accepted Answer

Pre-built compliance assessments for regulations like GDPR. Compliance Manager provides assessments, actions, and score tracking. It does not discover data (Data Map) or log access (Audit).

Answer

Audit log search for user access events

Answer

Automated data discovery across cloud sources

Question 15

An organization needs to automatically apply a 'Confidential' label to documents that contain EU personal data, and also encrypt those documents. Which Microsoft Purview feature should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies can be configured to automatically apply sensitivity labels based on sensitive info types like EU personal data. Sensitivity labels support encryption. Data classification is a prerequisite, but auto-labeling is the feature that applies the label automatically.

Answer

Data Loss Prevention (DLP) policy

Answer

Retention label policy

Answer

Data classification service