SC-900 Practice Test 40 — 15 Questions

Question 1

Refer to the exhibit. You are a security analyst using Microsoft Sentinel. You run this KQL query. What does the query return?

Accepted Answer

Incident IDs for high-severity alerts that have an open incident.. The query returns incident IDs for high-severity alerts that have an associated incident that is not closed. Option A is incorrect because it returns incidents with status not closed, not all. Option B is incorrect because it filters high severity. Option C is incorrect because it joins alerts with incidents, not just alerts without incidents.

Answer

High-severity alerts that do not have an incident assigned.

Answer

High-severity alerts that were closed within the last hour.

Answer

All incidents created in the last hour.

Question 2

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy JSON snippet. The policy is enabled and contains one rule. What is the effect of this rule?

Accepted Answer

Blocks access to content containing a credit card number in Exchange and SharePoint, without user notification.. The rule detects credit card numbers in Exchange Online and SharePoint Online. The action 'BlockAccess' will block access to the content. The rule does not include user notification, so users will not receive a policy tip. The policy applies to all users (no user filter). Option A correctly describes this.

Answer

Applies only to SharePoint, not Exchange.

Answer

Only audits the activity, does not block.

Answer

Blocks access and sends a policy tip to users.

Question 3

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to ensure that when a user tries to share a document containing a credit card number externally via email, the user sees a policy tip and the email is blocked. Which DLP rule action should they configure?

Accepted Answer

Block the message and notify the user with a policy tip. DLP rules can have actions like 'Block' and 'Notify user with policy tip'. Option A is wrong because it doesn't block; Option B is wrong because it doesn't notify; Option D is wrong because it doesn't block.

Answer

Notify user with policy tip only

Answer

Block the message only

Answer

Redirect the message to the compliance admin

Question 4

Your company uses Microsoft Defender for Endpoint. A security analyst reports that a device is showing multiple alerts for the same malware variant, but the alerts are being automatically suppressed after the initial detection. What is the most likely reason for this behavior?

Accepted Answer

Alert suppression is enabled to reduce noise from repeated detections. Option C is correct because alert suppression is a built-in feature to reduce alert fatigue for repeated detections. Option A is incorrect because suppression is not due to low severity—it's based on duplicate detection. Option B is incorrect because automatic investigation and remediation may run, but suppression is separate. Option D is incorrect because suppression is not a configuration error.

Answer

The alerts are classified as low severity

Answer

The device is not properly onboarded to Microsoft Defender for Endpoint

Answer

Automatic investigation and remediation resolved the alerts

Question 5

Which TWO capabilities are part of Microsoft Entra ID Protection? (Choose two.)

Accepted Answer

Risk-based conditional access policies. Options B and D are correct. Entra ID Protection includes risk-based policies and reporting for risky users. Option A is incorrect because passwordless authentication is a feature of Entra ID, but not specifically ID Protection. Option C is incorrect because privileged identity management is Microsoft Entra Privileged Identity Management (PIM). Option E is incorrect because conditional access is a broader feature, but ID Protection provides risk-based conditional access.

Answer

Passwordless authentication

Answer

Just-in-time privileged access

Answer

Conditional access policies for device compliance

Question 6

Your organization uses Microsoft Sentinel for SIEM. You receive an alert that a user account was compromised. You need to automatically disable the user's access across all cloud apps (SaaS) and reset their password. What should you use?

Accepted Answer

Create a Microsoft Sentinel automated response playbook. Option B is correct because Microsoft Sentinel can use automation rules with playbooks (Power Automate or Logic Apps) to trigger actions like disabling a user and resetting password in Microsoft Entra ID. Option A is wrong because manual response is not automated. Option C is wrong because Microsoft Defender for Cloud Apps can block access but not reset passwords. Option D is wrong because Microsoft Intune manages devices, not user accounts.

Answer

Use Microsoft Intune to remote wipe the user's device

Answer

Manually disable the user in Microsoft Entra ID and reset password

Answer

Configure a Microsoft Defender for Cloud Apps session policy

Question 7

Refer to the exhibit. An administrator creates a Conditional Access policy in Microsoft Entra ID. What will this policy do?

Accepted Answer

Require MFA for Global Administrators accessing any application. Option C is correct because the policy applies to all applications, for users with Global Administrator role, and requires MFA. Option A is wrong because it applies to all applications, not just specific. Option B is wrong because it applies to Global Administrators, not all users. Option D is wrong because it requires MFA, not block.

Answer

Block access for Global Administrators unless they use MFA

Answer

Require MFA for all users

Answer

Require MFA for users accessing the Microsoft Entra admin center only

Question 8

Which TWO of the following are capabilities of Microsoft Purview Information Protection? (Choose two.)

Accepted Answer

Classify and label sensitive data. Microsoft Purview Information Protection allows classification and labeling, and can apply encryption. Activity logging is part of Audit, and DLP is a separate solution.

Answer

Block external sharing of files

Answer

Detect malware in email attachments

Answer

Monitor user activities in real-time

Question 9

Your organization uses Microsoft Entra ID. You need to allow external users from a specific partner tenant to access a single internal application, but only after they provide a phone number for verification. What should you configure?

Accepted Answer

Cross-tenant access settings for the partner tenant. Cross-tenant access settings allow you to trust MFA and device compliance from external tenants. By configuring inbound access settings, you can require that the partner tenant's users meet your MFA requirements (phone verification). Option B is incorrect because B2B collaboration settings control invitation, not authentication requirements. Option C is incorrect because Conditional Access policies apply to your tenant but cannot directly enforce MFA on external users without cross-tenant trust. Option D is incorrect because identity protection is for risk detection, not MFA enforcement.

Answer

B2B collaboration invitation settings

Answer

Conditional Access policy for the application

Answer

Identity Protection policy

Question 10

Refer to the exhibit. You are configuring a Microsoft Entra ID group. What does the exhibit represent?

Accepted Answer

A dynamic security group based on department attribute.. The JSON shows a dynamic group in Microsoft Entra ID with a membership rule that includes users whose department equals 'Marketing'. Option A is incorrect because it's a dynamic group, not assigned. Option C is incorrect because it's a security group, not a Microsoft 365 group (no mailEnabled). Option D is incorrect because the rule is for department, not location.

Answer

A Microsoft 365 group with dynamic membership.

Answer

A dynamic group based on user location.

Answer

A static security group with assigned members.

Question 11

Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps? (Choose TWO.)

Accepted Answer

Session control. Microsoft Defender for Cloud Apps provides cloud discovery (identifying cloud apps in use), and session control (real-time monitoring and control of app sessions). Information protection is part of Microsoft Purview, not Defender for Cloud Apps. Vulnerability management is part of Defender for Endpoint. Threat intelligence is from Microsoft Sentinel or Defender Threat Intelligence.

Answer

Vulnerability management

Answer

Threat intelligence

Answer

Information protection

Question 12

A company wants to use Microsoft Defender for Office 365 to protect against malicious links in email. Which feature should they enable?

Accepted Answer

Safe Links. Safe Links is the Defender for Office 365 feature that provides time-of-click protection against malicious URLs. Option A is wrong because it's for attachments; Option C is wrong because it's for anti-malware; Option D is wrong because it's for anti-spam.

Answer

Safe Attachments

Answer

Anti-malware policy

Answer

Anti-spam policy

Question 13

You need to ensure that sensitive documents in Microsoft SharePoint Online are automatically classified and protected when they contain credit card numbers. What should you configure?

Accepted Answer

A sensitivity label with auto-labeling for Microsoft Purview Information Protection. Option A is correct because a sensitivity label with auto-labeling can be configured to detect sensitive info types like credit card numbers. Option B is incorrect because retention labels manage retention, not protection. Option C is incorrect because DLP policies can block or alert but do not apply labels automatically. Option D is incorrect because a retention policy is for retention, not classification.

Answer

A retention policy for SharePoint

Answer

A data loss prevention (DLP) policy

Answer

A retention label for regulatory compliance

Question 14

Your organization uses Microsoft Defender for Office 365. Users report receiving phishing emails that bypassed the default anti-phishing policy. What should you do to improve protection?

Accepted Answer

Create a custom anti-phishing policy.. Correct: Create a custom anti-phishing policy with stricter settings. Option A: Increase spam confidence level is for spam, not phishing. Option C: Enable safe attachments is for attachment scanning. Option D: Configure anti-malware policy is for malware.

Answer

Enable Safe Attachments.

Answer

Configure anti-malware policy.

Answer

Increase the spam confidence level (SCL) threshold.

Question 15

An organization is using Microsoft Purview Compliance Portal to manage data lifecycle. Which THREE actions can be performed using retention labels?

Accepted Answer

Trigger a disposition review at the end of retention. Retention labels can apply retention actions, mark as records, and trigger disposition review. They do not automatically delete data without a policy; instead, they work with retention policies. They cannot be used for DLP directly.

Answer

Automatically delete content after a specified period

Answer

Block sharing of sensitive information via email

SC-900 Practice Test 40 — 15 Questions

Exhibit

SC-900 Practice Test 40 — 15 Questions

Exhibit