SC-900 Practice Test 41 — 15 Questions

Question 1

A compliance administrator creates the above custom sensitive information type for detecting social security numbers (SSNs). What is required for a document to be classified as containing an SSN?

Accepted Answer

The document must contain a pattern matching the SSN regex and at least one keyword. A custom sensitive information type in Microsoft Purview uses a primary element (the SSN regex pattern) and requires at least one supporting element (a keyword) to trigger a match. This ensures that the document is not falsely classified by the regex alone, which could match random number sequences. The compliance administrator configured the type with a minimum count of one keyword as a proximity requirement, so the document must contain both the regex pattern and at least one keyword.

Answer

The document must contain either the SSN regex or a keyword

Answer

The document must contain the SSN regex with high confidence level

Answer

The document must contain a pattern matching the SSN regex and at least two keywords

Question 2

A company wants to grant temporary, time-limited access to a critical Azure resource for an external consultant. Which Microsoft Entra feature should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources, allowing administrators to grant time-bound, temporary access that automatically expires. This aligns directly with the requirement for temporary, time-limited access for an external consultant, as PIM supports activation windows, approval workflows, and audit logging for such scenarios.

Answer

Entra Verified ID

Answer

Identity Protection

Answer

Conditional Access

Question 3

Your organization is deploying Microsoft Entra ID. You need to ensure that users can sign in using their existing on-premises Active Directory credentials without creating new cloud passwords. Which feature should you configure?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct feature because it synchronizes on-premises Active Directory identities to Microsoft Entra ID and enables password hash synchronization or pass-through authentication, allowing users to sign in with their existing on-premises credentials without creating new cloud passwords. This ensures a seamless hybrid identity experience where the same username and password work for both on-premises and cloud resources.

Answer

Microsoft Entra Multifactor Authentication

Answer

Microsoft Entra Self-Service Password Reset

Answer

Microsoft Entra Privileged Identity Management (PIM)

Question 4

Your organization is using Microsoft Entra ID with P2 licenses. You need to ensure that all guest users are reviewed for access quarterly, and if not approved, access is automatically removed. Which Microsoft Entra feature should you configure?

Accepted Answer

Microsoft Entra Access Reviews. Microsoft Entra Access Reviews (D) is the correct feature because it allows you to create recurring reviews for guest users, set the frequency to quarterly, and configure auto-apply settings to automatically remove access if the review is not approved. This directly meets the requirement for periodic attestation and automated remediation.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Entitlement Management

Question 5

The exhibit shows a sign-in failure for John Doe. The admin wants to allow the sign-in while still enforcing MFA. What should the admin do?

Accepted Answer

Modify the Conditional Access policy to exclude Azure PowerShell or to support MFA for this client.. The sign-in failure is likely caused by a Conditional Access policy that blocks legacy authentication protocols like Azure PowerShell, which do not support MFA natively. Option A is correct because modifying the policy to exclude Azure PowerShell or to require MFA for that client app allows the sign-in while still enforcing MFA for other protocols. This ensures the user can authenticate using a modern authentication flow that supports MFA.

Answer

Disable MFA for the user.

Answer

Assign a Microsoft Entra ID P2 license to the user.

Answer

Reset the user's password.

Question 6

You are analyzing sign-in logs in Microsoft Sentinel. Based on the KQL query in the exhibit, what is the purpose of this query?

Accepted Answer

Identify users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.. The KQL query filters sign-in logs for events where the 'ResultType' is '50057', which specifically indicates a sign-in attempt from a disabled account. It then groups by user and counts occurrences, using a 'where' clause to filter for users with more than 10 such attempts. Finally, it limits the results to the last 7 days via the time range filter in the query or the workspace time filter. This directly identifies users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.

Answer

Identify all sign-in attempts from a specific IP address.

Answer

Identify impossible travel activity across different locations.

Answer

Identify locations with the highest number of failed sign-ins.

Question 7

You are a security administrator for a company that uses Microsoft 365. The company has a Microsoft Purview Data Loss Prevention (DLP) policy that blocks sharing of Social Security Numbers (SSNs) externally. Recently, a user accidentally sent an email containing SSNs to an external partner after overriding the policy by selecting a business justification. Management wants to prevent users from overriding the policy for SSNs. You need to update the DLP policy to ensure that users cannot override the block for SSNs. What should you do?

Accepted Answer

Modify the rule to set 'Allow override' to 'No' in the policy tip configuration.. The 'Allow override' setting in the policy tip configuration directly controls whether users can bypass a DLP block action by providing a business justification. Setting this to 'No' prevents any override for the rule that blocks SSNs, ensuring that the block is enforced without exception. This is the specific mechanism in Microsoft Purview DLP to disable user overrides for a given rule.

Answer

Increase the rule priority to ensure it is enforced before other rules.

Answer

Remove the policy tip from the rule to prevent users from overriding.

Answer

Change the action from 'Block with override' to 'Block' and remove the policy tip.

Question 8

A company wants to ensure that only users with specific IP addresses can access its critical applications. Which Microsoft Entra feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to create policies that enforce access controls based on conditions such as IP address location. By configuring a Conditional Access policy with a 'Locations' condition that includes only trusted IP address ranges, the company can block or grant access to critical applications based on the user's network location. This directly meets the requirement to restrict access to specific IP addresses.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Self-Service Password Reset

Question 9

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the most likely purpose of this query?

Accepted Answer

To identify potential brute-force attack attempts. The query filters for Windows Event ID 4625 (failed logon) and then counts occurrences per account and source IP within a 5-minute window, keeping only those with more than 10 failures. This pattern is the classic signature of a brute-force attack, where an attacker attempts many passwords against the same account or from the same IP. Option D is correct because the query is specifically designed to identify potential brute-force attempts by aggregating failed logons.

Answer

To identify successful logins after multiple failures

Answer

To detect privilege escalation events

Answer

To detect accounts that have been locked out

Question 10

A company uses Microsoft Entra ID and wants to allow external business partners to request access to a specific application through an approval process. The access should be time-limited and automatically expired. Which Microsoft Entra ID feature should be configured?

Accepted Answer

Entitlement management. Entitlement management in Microsoft Entra ID (part of Identity Governance) provides access packages that bundle resources such as applications, groups, and SharePoint sites. External users can request access through a self-service portal, with approval workflows, time-limited assignments, and automatic expiration. This exactly matches the requirement for partner access requests with approval and time limits.

Answer

Conditional Access

Answer

Privileged Identity Management (PIM)

Answer

Self-service group management

Question 11

A company uses Microsoft Entra ID. The security team wants to automatically block sign-ins from IP addresses that exhibit brute-force attack patterns. Which capability should they enable?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct capability because it uses machine learning and heuristic detection to automatically identify and block sign-ins from IP addresses exhibiting brute-force attack patterns, such as repeated failed authentication attempts. It can trigger risk-based policies, including blocking access or requiring multi-factor authentication, without manual intervention. This directly addresses the security team's requirement to automate the response to brute-force patterns.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra External Identities

Answer

Microsoft Entra Conditional Access

Question 12

A company uses Exchange Online. The security team wants to protect users from malicious email attachments. They need a solution that detonates attachments in a sandbox environment to check for malware behavior before the email is delivered to the recipient. Which Microsoft Defender for Office 365 feature should they enable?

Accepted Answer

Safe Attachments. Safe Attachments is the correct feature because it specifically detonates email attachments in a virtual sandbox environment before delivery, analyzing behavior for malicious activity. This matches the requirement to check attachments for malware behavior prior to inbox arrival, a capability unique to Safe Attachments within Defender for Office 365.

Answer

Safe Links

Answer

Anti-phishing

Answer

Anti-spam

Question 13

Your company uses Microsoft Sentinel to centralize security event monitoring. You need to create a custom analytics rule that triggers an alert when a user account is created outside of business hours. Which rule type should you use?

Accepted Answer

Scheduled query analytics rule. A scheduled query analytics rule is the correct choice because it allows you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) and triggers an alert based on conditions such as user account creation events occurring outside of business hours. This rule type is designed for custom detection scenarios where you need to evaluate log data against specific time-based or threshold-based criteria, making it ideal for monitoring user creation events with a custom schedule.

Answer

Microsoft Security incident creation rule

Answer

Anomaly analytics rule

Answer

Near-real-time (NRT) analytics rule

Question 14

Your company wants to provide a single sign-on experience for all cloud applications. Which Microsoft Entra ID feature should you implement?

Accepted Answer

App registration and SSO configuration. App registration and SSO configuration in Microsoft Entra ID enables single sign-on (SSO) by registering each cloud application as an enterprise application and configuring federation protocols such as SAML 2.0, OpenID Connect, or OAuth 2.0. This allows users to authenticate once with their Entra ID credentials and access all configured cloud applications without repeated logins.

Answer

B2B collaboration

Answer

Identity Protection

Answer

Conditional Access

Question 15

Which Microsoft Purview solution should you use to automatically retain or delete content based on regulations?

Accepted Answer

Records Management. Records Management in Microsoft Purview provides policy-based retention and deletion labels that automatically enforce regulatory compliance requirements, such as GDPR or SOX. It uses retention labels and label policies to mark content for a specified duration, after which it is either retained, deleted, or reviewed via disposition review. This directly addresses the need to automatically retain or delete content based on regulations.

Answer

Communication Compliance

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery