SC-900 Practice Test 40 — 15 Questions

Question 1

A company uses Microsoft Entra ID. Employees often forget their passwords and contact the IT helpdesk to reset them. The company wants to reduce helpdesk costs by allowing users to reset their own passwords using a verified mobile phone number or email address. Which Microsoft Entra ID feature should the administrator enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without helpdesk intervention, using a verified mobile phone number or email address as authentication methods. This directly reduces helpdesk costs by shifting password reset responsibility to the user, while maintaining security through verification of registered contact methods.

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Question 2

Refer to the exhibit. You are deploying a custom assessment automation in Microsoft Defender for Cloud using Bicep. The deployment fails with an error that the resource type is not valid. What is the most likely reason?

Accepted Answer

The property 'supportedCloud' should be 'supportedClouds' as an array.. In Bicep for Microsoft Defender for Cloud custom assessments, the property that defines which cloud environments the assessment applies to must be named 'supportedClouds' and must be an array of strings (e.g., ['Azure', 'AWS', 'GCP']). Using the singular 'supportedCloud' is invalid syntax and causes the deployment to fail with a resource type validation error.

Answer

The API version is not supported.

Answer

The name property is missing.

Answer

The resource type is misspelled.

Question 3

Your organization wants to protect against phishing attacks by verifying the sender's identity for incoming emails. Which Microsoft Defender for Office 365 feature should you configure?

Accepted Answer

Anti-phishing policy with SPF/DKIM/DMARC settings. The anti-phishing policy in Microsoft Defender for Office 365 includes sender verification settings that leverage SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These protocols authenticate the sender's domain and verify that the email originated from an authorized server, directly addressing the requirement to protect against phishing by verifying sender identity.

Answer

Anti-malware policy

Answer

Safe Links policy

Answer

Safe Attachments policy

Question 4

Your organization is using Microsoft Entra ID. You want to provide a single sign-on (SSO) experience for users accessing multiple SaaS applications. Which feature should you implement?

Accepted Answer

Microsoft Entra ID as an identity provider. Microsoft Entra ID acts as an identity provider (IdP) to enable single sign-on (SSO) for SaaS applications. When configured as the IdP, Entra ID authenticates the user once and issues a security token (e.g., SAML 2.0 assertion or OpenID Connect token) that is accepted by the SaaS application, eliminating the need for repeated logins. This is the core mechanism for federated SSO across multiple cloud applications.

Answer

Microsoft Entra application proxy

Answer

Microsoft Entra myapps portal

Answer

Microsoft Entra Privileged Identity Management

Question 5

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which policy should you configure?

Accepted Answer

Conditional Access policy in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By configuring a Conditional Access policy that requires device compliance, only devices marked as compliant by Intune can access corporate email. This is the correct mechanism because Conditional Access acts as the gatekeeper that enforces the compliance requirement at the authentication and authorization layer.

Answer

Device compliance policy in Microsoft Intune

Answer

Enrollment restrictions in Microsoft Intune

Answer

App protection policy in Microsoft Intune

Question 6

Your company is implementing a new application that requires users to authenticate using Microsoft Entra ID. The security team wants to enforce multifactor authentication (MFA) for all users accessing this application, but only when they are connecting from an untrusted network. Which conditional access policy should you configure?

Accepted Answer

Grant control: 'Require multifactor authentication' with a condition on 'Locations' set to 'All trusted locations' as exclusion.. It configures a Conditional Access policy that grants access only when MFA is performed, and excludes trusted network locations. This ensures that MFA is enforced only when users connect from untrusted networks, meeting the security team's requirement.

Answer

Session control: 'Use app enforced restrictions' to block access from untrusted networks.

Answer

Assignments: 'Users and groups' including all users, then grant control: 'Require multifactor authentication' without conditions.

Answer

Grant control: 'Require device to be marked as compliant' with a condition on 'Client apps'.

Question 7

Your organization needs to retain all customer communications data for 7 years due to regulatory requirements. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (D) is the correct solution because it enables organizations to define retention and deletion policies for data, ensuring that customer communications data is retained for the required 7-year regulatory period and then securely disposed of. This solution directly addresses data retention requirements by applying policies at the workload level (e.g., Exchange Online, SharePoint) to manage the lifecycle of content based on specific rules, such as regulatory compliance.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Loss Prevention

Question 8

Your organization uses Microsoft Purview Compliance Manager to track compliance with regulatory standards. You need to create a custom assessment for a new internal policy. What should you do first?

Accepted Answer

Create a custom template with your internal controls. In Microsoft Purview Compliance Manager, assessments are built from templates that define the controls, improvement actions, and scoring parameters. To create a custom assessment for a new internal policy, you must first create a custom template that includes your own controls, because assessments cannot be created from scratch without a template. This template serves as the foundation for the assessment, allowing you to define the specific controls and actions that map to your internal policy.

Answer

Define the score calculation method for the assessment

Answer

Create control actions and assign them to the assessment

Answer

Use an existing Microsoft template and modify the improvement actions

Question 9

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' label to documents that contain salary information. Which type of sensitivity label configuration should you use?

Accepted Answer

Auto-labeling with sensitive information types. Auto-labeling with sensitive information types allows Microsoft Purview to automatically apply a 'Confidential' label to documents containing salary information based on predefined patterns, such as employee salary data. This configuration uses content scanning to detect sensitive data (e.g., via built-in or custom sensitive information types) and applies the label without user intervention, meeting the requirement for automatic classification.

Answer

Manual labeling

Answer

Default labeling for SharePoint libraries

Answer

Mandatory labeling policy

Question 10

A company uses Microsoft 365. The security team wants to protect users from clicking malicious URLs in email messages. The solution should rewrite all links in incoming emails so that when a user clicks them, the URL is checked in real time against a dynamic list of known malicious sites. Which Microsoft Defender for Office 365 feature should they enable?

Accepted Answer

Safe Links. Safe Links is the correct feature because it is specifically designed to protect users from malicious URLs in email messages and Office documents. It rewrites all links in incoming emails so that when a user clicks them, the URL is checked in real time against a dynamic list of known malicious sites, providing time-of-click protection.

Answer

Anti-phishing policies

Answer

Safe Attachments

Answer

Anti-spam policies

Question 11

Your organization wants to use Microsoft Defender for Cloud Apps to detect anomalous user behavior across cloud applications. Which feature should you enable?

Accepted Answer

Anomaly detection policies. Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then trigger alerts for deviations, such as impossible travel, unusual data exfiltration, or risky sign-in patterns. This directly addresses the requirement to detect anomalous user behavior across cloud applications.

Answer

App connectors

Answer

Secure Score

Answer

Cloud Discovery

Question 12

Your organization uses Microsoft Purview to govern data in Azure Data Lake Storage. You need to create a data classification policy that automatically tags files containing personally identifiable information (PII) such as social security numbers. Which scanning solution should you use?

Accepted Answer

Microsoft Purview Data Map scanning. Microsoft Purview Data Map scanning is the correct solution because it provides automated scanning and classification of data assets across Azure Data Lake Storage and other sources. It uses built-in classifiers to detect sensitive data types like social security numbers and applies the classification labels directly to the files, enabling governance and policy enforcement.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Question 13

A company wants to protect against ransomware by detecting and blocking malicious files in email attachments. Which Microsoft security solution should be used?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Attachments and Safe Links features that scan email attachments in real-time using detonation chambers and machine learning to detect and block ransomware and other malicious files. This solution is specifically designed to protect Exchange Online and SharePoint Online from threats delivered via email, making it the correct choice for blocking malicious attachments.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Question 14

Your organization uses Microsoft Entra ID Governance. You need to ensure that access to a critical application is reviewed every 90 days by the application owner. If the review is not completed, access should be revoked automatically. Which feature should you configure?

Accepted Answer

Access reviews. Access reviews in Microsoft Entra ID Governance allow you to create recurring reviews of group memberships or application assignments, with automatic revocation of access if the review is not completed. By configuring a review every 90 days and setting the 'Auto apply' action to 'Remove access', you ensure that the application owner must certify access or it is automatically revoked.

Answer

Terms of use

Answer

Privileged Identity Management

Answer

Entitlement management

Question 15

Your company uses Microsoft Purview Data Lifecycle Management. You need to ensure that emails in users' mailboxes are retained for 7 years for compliance, but users should be able to delete emails they no longer need before that period. Which configuration achieves this?

Accepted Answer

Apply a retention policy without a preservation lock. A retention policy without a preservation lock (Option D) allows you to define a retention period (7 years) for emails while still permitting users to delete items before that period ends. When a user deletes an email, it is moved to the Recoverable Items folder and retained for the remainder of the 7-year period, after which it is permanently deleted. This meets the compliance requirement without preventing user deletion.

Answer

Configure a Data Loss Prevention policy

Answer

Place a litigation hold on the mailboxes

Answer

Apply a retention label with record locking