SC-900 Practice Test 42 — 15 Questions

Question 1

A company uses Microsoft Purview Information Protection to classify and label sensitive documents. The compliance team wants to automatically apply a 'Confidential' label to documents containing an employee's passport number. Which method should they use?

Accepted Answer

Auto-labeling policy. Auto-labeling in Microsoft Purview uses sensitive info types to automatically apply labels based on content. Option B is wrong because it's manual; Option C is wrong because it's for classification, not labeling; Option D is wrong because it's for DLP.

Answer

Manual labeling by users

Answer

Trainable classifiers

Answer

DLP policy

Question 2

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

A conditional access policy in Microsoft Entra ID. Option C is correct because conditional access policies in Microsoft Entra ID can require compliant devices. Option A is incorrect because compliance policies define compliance but do not enforce access. Option B is incorrect because in Azure AD, now Entra ID, it's conditional access. Option D is incorrect because the Microsoft 365 admin center does not configure device compliance enforcement.

Answer

An app protection policy in Microsoft 365 admin center

Answer

A conditional access policy in Azure AD

Answer

A device compliance policy in Intune

Question 3

Your organization uses Microsoft Defender for Cloud Apps. Security team wants to be alerted when a user accesses a cloud app from a risky IP address. Which solution should you use to create a policy that triggers an alert based on this activity?

Accepted Answer

Create an activity policy.. Correct: Activity policy in Defender for Cloud Apps can monitor specific activities (e.g., logins) and trigger alerts based on risk factors like IP. Option A: Access policies control access, not alerting. Option C: Session policies control sessions. Option D: App discovery policies are for discovering shadow IT.

Answer

Create a session policy.

Answer

Create an app discovery policy.

Answer

Create an access policy.

Question 4

Which THREE of the following are capabilities of Microsoft Sentinel? (Select THREE.)

Accepted Answer

Security information and event management (SIEM). Correct: SIEM (B), SOAR (C), and UEBA (E). Option A: Device management is Intune. Option D: DLP is Purview.

Answer

Mobile device management

Answer

Data loss prevention

Question 5

A company wants to use Microsoft Defender for Cloud to secure their hybrid cloud environment. Which TWO resource types can be assessed by Defender for Cloud?

Accepted Answer

Azure Virtual Machines. Defender for Cloud assesses Azure VMs and on-premises servers via Azure Arc. AWS accounts are not directly assessed; only Azure resources. SQL Server on-premises is not supported unless via arc. Kubernetes is not a resource type listed.

Answer

AWS EC2 instances

Answer

Kubernetes clusters

Answer

On-premises SQL Server

Question 6

A company uses Microsoft Sentinel as its SIEM. They need to create a custom analytics rule that runs every hour and queries for failed logins from a specific IP address. Which rule scheduling option should they configure?

Accepted Answer

Run every 1 hour with a 1-hour query period. Analytics rules in Sentinel have run frequency and query period. Option A is wrong because it's too frequent; Option B is correct but the query period should be set to cover the data; Option C is wrong because it's for over a day; Option D is wrong because it's for real-time.

Answer

Run every 5 minutes with a 5-minute query period

Answer

Run every 24 hours with a 24-hour query period

Answer

Run every 1 hour with a 5-minute query period

Question 7

Your company uses Microsoft Purview Data Lifecycle Management. You need to automatically delete all emails in users' mailboxes that are older than three years, except for emails that have a legal hold. What should you configure?

Accepted Answer

A retention policy with a retention action of 'Delete items' and an adaptive scope for Exchange mailboxes. Option A is correct because a retention policy with retention action 'Delete items' and an adaptive scope can target all mailboxes. Option B is incorrect because a retention label with auto-labeling is for classification, not automatic deletion. Option C is incorrect because a DLP policy does not delete items. Option D is incorrect because a sensitivity label does not delete items.

Answer

A data loss prevention (DLP) policy for Exchange

Answer

A retention label with auto-labeling for all Exchange emails

Answer

A sensitivity label with mandatory labeling

Question 8

Contoso uses Microsoft Sentinel. They want to automate response to a high-severity incident by blocking the source IP in Azure Firewall and sending a notification to the SOC team via email. Which feature should they use?

Accepted Answer

Create an automation rule.. Correct: Automation rules in Microsoft Sentinel run playbooks based on trigger conditions (e.g., incident creation). Option A: Workbooks are for visualization. Option B: Hunting queries are for proactive threat hunting. Option D: Fusion is a correlation engine.

Answer

Create a hunting query.

Answer

Enable Fusion.

Answer

Create a workbook.

Question 9

Which TWO of the following are features of Microsoft Purview Data Loss Prevention (DLP)? (Select TWO.)

Accepted Answer

Provide policy tips to users. Correct: Monitor and prevent sharing of sensitive data (A) and Provide policy tips to users (D). Option B: Threat protection is Defender. Option C: Sensitivity labels are Information Protection. Option E: Identity governance is Entra ID Governance.

Answer

Detect and block malware

Answer

Apply sensitivity labels

Answer

Manage user access rights

Question 10

A security team uses Microsoft Defender XDR to respond to incidents. Which THREE components are part of Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Defender for Endpoint, Office 365, and Identity are core components. Sentinel is separate, and Intune is MDM.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 11

Your organization uses Microsoft Defender XDR (formerly Microsoft 365 Defender). A user reports receiving a suspicious email with a link. The email was not blocked by Exchange Online Protection (EOP). Which feature should you use to investigate the link's reputation in real time?

Accepted Answer

Safe Links policy. Option B is correct because Safe Links in Defender for Office 365 provides real-time link protection and investigation. Option A is incorrect because Safe Attachments is for file attachments. Option C is incorrect because anti-phish policies handle phishing detection but not link investigation. Option D is incorrect because EOP is the baseline but not for real-time link analysis.

Answer

Exchange Online Protection (EOP) filtering

Answer

Anti-phish policy

Answer

Safe Attachments policy

Question 12

An organization uses Microsoft Defender for Endpoint (MDE). The security team wants to identify devices that have not received a security update in the last 30 days. Which report should they use?

Accepted Answer

Device health report. Correct: Device health report in MDE shows missing updates. Option A: Threat analytics is for threat intelligence. Option B: Vulnerability management dashboard shows vulnerabilities but not specifically missing updates. Option D: Secure Score is for overall posture.

Answer

Threat analytics report

Answer

Vulnerability management dashboard

Answer

Microsoft Secure Score report

Question 13

An organization uses Microsoft Purview Information Protection to classify and protect data. Which TWO methods can be used to apply sensitivity labels automatically?

Accepted Answer

Auto-labeling policies in Microsoft 365 compliance center. Auto-labeling policies can apply labels based on conditions. Client-side labeling via the Azure Information Protection unified labeling client also supports automatic classification. Manual labeling is not automatic. Labeling in Microsoft 365 Apps is default but not automatic. PowerShell cannot directly apply labels automatically without scripts.

Answer

Default labeling policy for Microsoft 365 Apps

Answer

Manual labeling by end users

Answer

PowerShell scripts to apply labels on export

Question 14

Your organization wants to ensure that all external emails are automatically tagged with a disclaimer at the top of the email body. Which Microsoft Exchange Online feature should you configure?

Accepted Answer

Mail flow rule (transport rule). Option C is correct because mail flow rules (transport rules) can add disclaimers to emails. Option A is incorrect because DLP policies do not add disclaimers. Option B is incorrect because Safe Links adds URL protection, not disclaimers. Option D is incorrect because journaling archives emails.

Answer

Journal rule

Answer

Data loss prevention (DLP) policy

Answer

Safe Links policy

Question 15

Your company uses Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to documents containing a credit card number. What should they create?

Accepted Answer

An auto-labeling policy. Correct: Auto-labeling policy in Purview automatically labels documents based on sensitive info types. Option A: Sensitivity label alone defines the label but doesn't auto-apply. Option C: DLP policy prevents sharing but doesn't label. Option D: Retention label is for retention, not sensitivity.

Answer

A sensitivity label

Answer

A data loss prevention (DLP) policy

Answer

A retention label policy