SC-900 Practice Test 42 — 15 Questions

Question 1

Your company is implementing a hybrid identity solution with Microsoft Entra ID. Users report that they can sign in to Microsoft 365 but cannot access on-premises applications that are configured for integrated Windows authentication. You need to ensure seamless single sign-on (SSO) for both cloud and on-premises resources. What should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Microsoft Entra seamless SSO.. Microsoft Entra seamless SSO (Seamless SSO) is the correct choice because it automatically signs users in when they are on corporate devices connected to the corporate network, using Kerberos delegation to provide single sign-on for both cloud resources (like Microsoft 365) and on-premises applications configured for Integrated Windows Authentication (IWA). This eliminates the need for users to re-enter credentials when accessing on-premises apps after authenticating to the cloud.

Answer

Implement Passthrough Authentication.

Answer

Deploy Active Directory Federation Services (AD FS).

Answer

Configure password hash synchronization.

Question 2

A company uses Microsoft Entra ID and wants to automatically detect potential security risks such as leaked credentials and suspicious sign-in patterns. They also need the ability to investigate these risks and configure automated responses based on risk levels. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct service because it automatically detects potential security risks such as leaked credentials and suspicious sign-in patterns, provides investigation tools (e.g., risk reports and detailed risk event logs), and enables automated responses like conditional access policies that block or require MFA based on risk levels. This directly matches the scenario's requirements for detection, investigation, and automated remediation.

Answer

Microsoft Entra ID Governance

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Domain Services

Question 3

A company wants to reduce the risk of privileged account misuse. They need to provide temporary, time-bound access to administrative roles in Microsoft Entra ID (Microsoft Entra ID) and require approval from a manager before granting the access. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing administrators to activate roles for a limited, time-bound duration. It also supports approval workflows, requiring a manager's approval before role activation is granted, directly addressing the need for temporary, approved access to administrative roles.

Answer

Conditional Access policies

Answer

Identity Protection

Answer

Entra ID Governance (Access Reviews)

Question 4

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. An HR manager wants to ensure that employee records are kept for at least 1 year after last modification. The policy is applied to Exchange, SharePoint, and OneDrive. What is the outcome?

Accepted Answer

The policy will not retain content; it will delete matching content after 365 days, which may not be intended. The policy is configured as 'Delete only' with a retention period of 365 days. This means that after 365 days from the last modification, the content will be permanently deleted. It does not retain content for any minimum period; it simply deletes it after the specified duration. The HR manager wants to keep records for at least 1 year, but this policy will delete them exactly at the 1-year mark, which may not be intended if the manager expects retention beyond that point or if the policy should also preserve content until deletion.

Answer

Employee records in Exchange are retained for 365 days after last modification, then deleted

Answer

Employee records in SharePoint are deleted after 365 days from last modification if they have Department=HR

Answer

The policy retains content for 365 days and then automatically moves to archive

Question 5

A company stores critical financial reports in a SharePoint Online library. To ensure that the reports have not been tampered with, the security team compares a calculated hash of each file against a stored baseline. This verification process primarily protects which security goal?

Accepted Answer

Integrity. The verification process uses hash comparison to detect unauthorized changes to files, which directly protects data integrity. Integrity ensures that data has not been altered or tampered with during storage or transit. In SharePoint Online, hashing (e.g., SHA-256) creates a unique fingerprint; if the calculated hash matches the stored baseline, the file is unchanged.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 6

Which TWO are features of Microsoft Entra ID?

Accepted Answer

Single sign-on (SSO). Options A and E are correct. Microsoft Entra ID provides Single sign-on (SSO) and Self-service password reset (SSPR). Option B (Data loss prevention) is a feature of Microsoft Purview. Option C (Cloud app discovery) is part of Microsoft Defender for Cloud Apps. Option D (Mobile device management) is a feature of Microsoft Intune.

Answer

Data loss prevention (DLP)

Answer

Cloud app discovery

Answer

Mobile device management (MDM)

Question 7

A healthcare organization uses Microsoft Entra ID and needs to enforce that only users from the United States and Canada can access patient records. Access attempts from all other locations must be blocked. Which Microsoft Entra ID Conditional Access condition should be configured to meet this requirement?

Accepted Answer

Locations. The Locations condition in Microsoft Entra ID Conditional Access allows administrators to define named locations (e.g., countries or IP ranges) and then grant or block access based on those locations. By configuring a policy that blocks access from all countries except the United States and Canada, the organization can enforce geographic restrictions on patient record access.

Answer

Device state

Answer

Sign-in risk

Answer

Client apps

Question 8

Your organization wants to use Microsoft Entra ID to require multi-factor authentication (MFA) for all users when accessing a financial application. What should you configure?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA based on specific conditions, such as the application being accessed (the financial app). This is the correct, modern approach to require MFA for a specific application rather than for all sign-ins globally. It provides granular control by evaluating signals like user, device, location, and application before granting access.

Answer

Identity Protection policy

Answer

Per-user MFA

Answer

MFA registration policy

Question 9

A compliance officer needs to automatically detect documents containing passport numbers in SharePoint Online and apply a retention label that retains the documents for 10 years before deleting them. They also want to prevent users from permanently deleting these documents before the retention period ends. Which Microsoft Purview solution should they use to achieve this?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it enables organizations to automatically apply retention labels to sensitive content—such as documents containing passport numbers—based on sensitive information types. It also enforces a retention period (10 years) and prevents users from permanently deleting documents before that period ends, meeting both the detection and preservation requirements.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Question 10

Your company uses Microsoft Purview to manage data across Azure, on-premises SQL Server, and Amazon S3. You need to create a unified map of all data sources and their sensitivity labels. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct feature because it provides a unified, automated map of data assets across hybrid and multi-cloud environments (Azure, on-premises SQL Server, and Amazon S3). It automatically scans and classifies data sources, applies sensitivity labels, and maintains a centralized metadata repository, enabling a holistic view of the data landscape and its sensitivity.

Answer

Microsoft Purview Data Sharing

Answer

Microsoft Purview Data Estate Insights

Answer

Microsoft Purview Data Catalog

Question 11

A security manager explains that the company's security strategy relies on multiple layers of controls, such as firewalls, antivirus software, and multi-factor authentication, so that if one layer fails, another can still prevent an attack. Which security principle does this strategy best represent?

Accepted Answer

Defense in depth. Defense in depth is the correct answer because it explicitly describes a layered security strategy where multiple independent controls (firewalls, antivirus, MFA) are deployed so that if one layer is bypassed or fails, subsequent layers still provide protection. This principle is foundational to modern security architecture and directly matches the scenario of using diverse controls to prevent a single point of failure.

Answer

Least privilege

Answer

Zero Trust

Answer

Separation of duties

Question 12

Your organization, Fabrikam, has recently merged with another company. You need to provide seamless access to resources for users from both companies while maintaining separate identity directories. The users from the acquired company have their own Microsoft Entra ID tenant. You need to enable them to access applications in your tenant using their existing corporate credentials, without creating new accounts. Additionally, you want to enforce conditional access policies from your tenant for these users. Which approach should you use?

Accepted Answer

Use Microsoft Entra B2B collaboration to invite users from the other tenant as guest users, and apply conditional access policies to guest users.. Microsoft Entra B2B collaboration allows you to invite external users from another Microsoft Entra tenant to access your applications using their own corporate identities. This approach meets the requirement of not creating new accounts, and because guest users are represented as user objects in your tenant, you can enforce your own conditional access policies on them. Option D is correct because it directly addresses the need for seamless access with separate directories and policy control.

Answer

Create new user accounts in your tenant for the acquired company's users and assign them access.

Answer

Set up a federation trust between your tenant and the other company's on-premises Active Directory.

Answer

Use Microsoft Entra B2C to create a custom identity provider for the other company.

Question 13

A company wants to gain visibility into which cloud applications are being used by employees (shadow IT) and assess the risk level of each app. They use Microsoft Defender for Cloud Apps. Which feature should they enable to discover and analyze these apps?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs against the Microsoft Defender for Cloud Apps catalog of over 31,000 cloud apps to identify shadow IT usage. It provides risk scores based on factors like security certifications, data encryption, and compliance standards, enabling the company to assess each app's risk level.

Answer

App Governance

Answer

Conditional Access App Control

Answer

OAuth app policies

Question 14

A legal team is preparing for an internal investigation related to a potential policy violation. They need to identify all relevant documents stored in Exchange Online and SharePoint Online, but there are millions of items across the organization. The team wants to use a machine learning model that learns from a set of manually reviewed relevant and non-relevant documents to predict relevance and prioritize review. Which Microsoft Purview solution provides this capability?

Accepted Answer

Microsoft Purview eDiscovery (Advanced). Microsoft Purview eDiscovery (Advanced) provides predictive coding capabilities that use machine learning to analyze a seed set of manually reviewed relevant and non-relevant documents. The model learns from this training to predict the relevance of millions of items across Exchange Online and SharePoint Online, prioritizing review for internal investigations. This directly matches the need for a machine learning model to identify and prioritize relevant documents.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview Insider Risk Management

Question 15

A company uses Microsoft Entra ID and wants to enable employees to reset their own passwords without needing to contact the help desk. They want to enforce multifactor authentication when the employee performs the reset. Which Microsoft Entra feature should they enable?

Accepted Answer

Microsoft Entra Self-Service Password Reset (SSPR). Microsoft Entra Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without help desk intervention, and it can be configured to require multifactor authentication (MFA) during the reset process. This aligns directly with the scenario of enabling self-service password changes while enforcing MFA for security.

Answer

Microsoft Entra ID Federation

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management (PIM)