SC-900 Practice Test 42 — 15 Questions

Question 1

Your company is deploying Microsoft Defender for Cloud Apps. You need to detect and block the use of unsanctioned cloud apps that exhibit risky behavior. Which feature should you configure?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs to identify unsanctioned cloud apps and assess their risk based on behavioral factors such as data upload volume, user count, and security posture. Once identified, Defender for Cloud Apps can automatically block these apps using the built-in app governance controls, enforcing policies to prevent risky app usage.

Answer

Azure Information Protection labels

Answer

Conditional Access policies

Answer

Data Loss Prevention (DLP) policies

Question 2

Your company uses Microsoft Entra ID and is implementing a zero-trust security model. You need to ensure that all access requests to sensitive applications are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID capability should you use?

Accepted Answer

Conditional Access with session controls. Conditional Access with session controls enforces continuous access evaluation (CAE) by intercepting real-time signals—such as user risk, device compliance, or location changes—after the initial authentication. This ensures that access to sensitive applications is verified throughout the session, not just at sign-in, aligning with the zero-trust principle of 'verify explicitly and continuously.'

Answer

Access reviews

Answer

Microsoft Entra Identity Protection

Answer

Privileged Identity Management

Question 3

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows users to sign in using their social media accounts, such as Google or Facebook. What should you configure?

Accepted Answer

External identities (B2B) with social identity providers. External identities (B2B) in Microsoft Entra ID allow you to configure social identity providers (e.g., Google, Facebook) as federation sources. This enables users to sign in with their existing social accounts by leveraging OAuth 2.0 and OpenID Connect protocols, without needing to create a separate Microsoft account.

Answer

Microsoft Authenticator app for passwordless sign-in

Answer

Privileged Identity Management

Answer

Self-service password reset

Question 4

An organization wants to use a cloud-based SIEM to collect security data from multiple sources, including on-premises servers and cloud applications. Which Microsoft solution should they choose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR solution, built on Azure and designed to ingest security data from multiple sources — including on-premises servers via agents, cloud applications via connectors, and Microsoft 365/Azure services. It provides analytics rules, incident management, workbooks, and automation playbooks, making it the correct choice for a cloud-based SIEM.

Answer

Microsoft Intune

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Cloud

Question 5

Refer to the exhibit. You are configuring a sensitivity label in Microsoft Purview. The label is set to automatically apply when credit card numbers are detected. However, users report that the label is not being applied to documents containing credit card numbers. What is the most likely cause?

Accepted Answer

The label is not published to a label policy. For a sensitivity label to be applied — whether manually or automatically — it must be published to a label policy that targets the relevant users and locations. If the label exists in the compliance portal but is not included in a published label policy, it will not be available to the client apps or the auto-labeling service, so documents with credit card numbers will never receive it. This is the most likely cause of the reported behavior.

Answer

The encryption is misconfigured

Answer

The auto-labeling condition is incorrect

Answer

The user permissions are missing

Question 6

Your organization uses Microsoft Entra ID. You need to ensure that only users from the finance department can access a sensitive application, and they must be granted access dynamically based on their department attribute. What should you configure?

Accepted Answer

Create a dynamic group with rule: user.department -eq "Finance".. A dynamic group in Microsoft Entra ID automatically adds or removes members based on a rule, such as `user.department -eq "Finance"`. This ensures that only users whose department attribute equals "Finance" are granted access to the sensitive application, and membership updates dynamically as the attribute changes, without manual intervention.

Answer

Create an administrative unit for the finance department.

Answer

Enable self-service group management.

Answer

Configure entitlement management with an access package for the finance application.

Question 7

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs for a user. The user successfully signed in from a mobile device running iOS, located in the US, with medium risk level. The sign-in did not require MFA. You have a Conditional Access policy that requires MFA for all users when sign-in risk is medium or higher. Why was MFA not triggered?

Accepted Answer

The Conditional Access policy may exclude 'Mobile Apps and Desktop clients' client apps.. The Conditional Access policy can be configured to exclude specific client apps, such as 'Mobile Apps and Desktop clients'. If the policy excludes these client apps, the sign-in from an iOS mobile device would not be subject to the MFA requirement, even though the sign-in risk is medium. The sign-in logs confirm MFA was not required, indicating the policy did not apply to this client app type.

Answer

The device is not compliant, so MFA was not required.

Answer

The sign-in risk level is medium, which is below the threshold.

Answer

The user is not assigned to the Conditional Access policy.

Question 8

Your company is deploying Microsoft Entra ID Governance. They want to automate the review of guest user access to Microsoft Teams and remove access when guests leave the partner organization. Which feature should they implement?

Accepted Answer

Access reviews and connected organizations. Access reviews in Microsoft Entra ID Governance allow you to create recurring reviews of guest user access to resources like Microsoft Teams. By configuring the review to include connected organizations, you can automatically remove guest access when the guest's identity is no longer associated with a partner organization, such as when they leave the partner company. This automation is achieved through the integration of access reviews with the connected organization's lifecycle, ensuring that guest access is revoked without manual intervention.

Answer

Entitlement management

Answer

Terms of use

Answer

Password policies

Question 9

Your organization is using Microsoft Defender for Cloud to secure a multi-cloud environment including Azure and AWS. You need to identify misconfigurations that could lead to security breaches. Which feature should you use?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is the correct feature because it continuously assesses your multi-cloud environment (Azure and AWS) against security best practices and compliance frameworks, identifying misconfigurations that could lead to security breaches. In Microsoft Defender for Cloud, CSPM provides a unified view of security posture across clouds, detecting issues like open ports, weak encryption, or excessive permissions without requiring agents. This directly addresses the need to find misconfigurations that attackers could exploit.

Answer

Cloud Workload Protection (CWP)

Answer

Regulatory compliance dashboard

Answer

Security score

Question 10

A company wants to automatically classify documents containing credit card numbers and apply encryption at rest in SharePoint Online. Which Microsoft Purview feature should be used?

Accepted Answer

Sensitivity labels with auto-classification. Sensitivity labels with auto-classification can automatically detect sensitive data types such as credit card numbers using built-in or custom sensitive info types, and then apply a label that enforces encryption at rest in SharePoint Online. This meets the requirement of both automatic classification and encryption enforcement without manual user intervention.

Answer

eDiscovery

Answer

Microsoft Purview Audit

Answer

Data Loss Prevention (DLP) policies

Question 11

Which TWO features are available in Microsoft Entra ID P2 licenses? (Choose two.)

Accepted Answer

Privileged Identity Management (PIM). Microsoft Entra ID P2 includes Privileged Identity Management (PIM) (option B), which provides just-in-time role activation, approval workflows, and access reviews for privileged roles, and this capability is exclusive to the P2 tier. Option D, Identity Protection with risk-based policies, is also a P2 feature that uses Microsoft's threat intelligence to detect risky users and sign-ins and to enforce risk-based Conditional Access policies. Options A (SSPR), C (MFA), and E (password hash synchronization) are not P2-exclusive: SSPR and MFA are available in Entra ID Free/P1 (with full SSPR for cloud users in Free and broader SSPR in P1), and password hash synchronization is a core Microsoft Entra Connect capability available with any Entra ID edition, so they do not satisfy the P2-only requirement.

Answer

Self-service password reset (SSPR)

Answer

Multifactor authentication (MFA)

Answer

Password hash synchronization

Question 12

Refer to the exhibit. You run an Advanced Hunting query in Microsoft Defender XDR. What is the primary purpose of this query?

Accepted Answer

Identify accounts with high number of interactive logons, potentially indicating brute-force activity.. The query uses `AADSignInEventsBeta` to count interactive logon events per account, then filters for accounts with more than 10 such events. A high count of interactive logons from a single account is a classic indicator of brute-force activity, where an attacker repeatedly attempts to guess credentials. This makes D correct because the query's primary purpose is to identify accounts with a suspiciously high number of interactive logons.

Answer

Find IP addresses with failed logon attempts.

Answer

List all interactive logons from Office 365 applications.

Answer

Detect non-interactive logons to Office 365.

Question 13

A compliance officer needs to search for emails containing trade secrets across all mailboxes in the organization. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct solution because it is specifically designed for legal and investigative searches across all mailboxes, including the ability to search for specific content like trade secrets using keyword queries and advanced features like predictive coding and review sets. It supports searching across Exchange Online mailboxes, SharePoint sites, and OneDrive for Business, making it ideal for a compliance officer conducting a broad, targeted search for sensitive information.

Answer

Communication Compliance

Answer

Data Loss Prevention

Answer

Audit (Standard)

Question 14

A company has a policy that prohibits employees from sharing confidential customer data with unauthorized parties. The compliance team needs to detect patterns of unusual user activity that may indicate insider data theft, such as downloading large volumes of data to a personal device or emailing sensitive files to external recipients. They also want to investigate the activity and take remediation actions like generating a case for litigation or notifying the user's manager. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is designed specifically to detect, investigate, and remediate insider data theft scenarios. It uses predefined and customizable policies to identify patterns like large-volume downloads to personal devices or emailing sensitive files externally, and provides built-in remediation actions such as generating a case for litigation or notifying a user's manager.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Question 15

A financial services company uses Microsoft 365 and must comply with PCI DSS. They want to automatically prevent users from sending emails that contain credit card numbers to external recipients. If a user tries to send such an email, the system should block the message and notify the user with a policy tip. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block sensitive data, such as credit card numbers, in transit (e.g., email). DLP policies can be configured with conditions to match credit card number patterns (using a built-in sensitive info type) and set actions to block the message and display a policy tip to the sender, meeting the PCI DSS compliance requirement.

Answer

Communication Compliance

Answer

Information Protection

Answer

Insider Risk Management