SC-900 Practice Test 43 — 15 Questions

Question 1

Your organization is deploying Microsoft Entra ID Governance. You need to automate the process of removing user access to a critical application when the user leaves the company. Which feature should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Entitlement Management. Entitlement Management in Microsoft Entra ID Governance allows you to create access packages that govern access to resources like critical applications. By configuring an access package with a 'Remove access when user leaves' policy, you can automatically revoke the user's assignments when their lifecycle state changes to 'leaving', ensuring access is removed without manual intervention.

Answer

Privileged Identity Management

Answer

Access Reviews

Answer

Lifecycle Workflows

Question 2

A company uses a cloud-based SaaS (Software as a Service) application for customer relationship management. According to the shared responsibility model, which security responsibility is primarily handled by the customer?

Accepted Answer

Managing user access and permissions for the application. In a SaaS model like a cloud-based CRM application, the customer is responsible for managing user access and permissions, including identity and access management (IAM), multi-factor authentication (MFA), and role-based access control (RBAC). The cloud provider handles the underlying infrastructure, platform, and application security, but the customer must control who can access the application and what they can do within it.

Answer

Physical security of the data center hosting the application

Answer

Security of the underlying networking infrastructure

Answer

Applying security patches to the application's code

Question 3

A security operations team uses Microsoft Sentinel to centralize security log analysis. They need to ingest logs from a third-party firewall that does not have a native connector. What should the team use to bring the firewall logs into Microsoft Sentinel?

Accepted Answer

Data connectors. Microsoft Sentinel uses data connectors to ingest logs from various sources, including third-party devices that lack native connectors. For a firewall without a built-in connector, the team can use the Common Event Format (CEF) connector or Syslog connector, which are both categorized as data connectors. These connectors allow the firewall to forward logs via Syslog or CEF over UDP/TCP, which Sentinel then parses and ingests into the Log Analytics workspace.

Answer

Playbooks

Answer

Workbooks

Answer

Analytics rules

Question 4

A company has discovered that many account compromise attacks are using legacy authentication protocols (e.g., IMAP, POP3, SMTP) which do not support multi-factor authentication. They want to block all sign-ins that use these protocols to reduce risk. Which Microsoft Entra ID feature should they use to enforce this block?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID can be configured to block access from legacy authentication protocols (such as IMAP, POP3, and SMTP) by targeting the 'Client apps' condition. Since these protocols do not support modern authentication methods like MFA, blocking them directly reduces the attack surface for account compromise. This is the correct feature to enforce the block.

Answer

Identity Protection

Answer

Azure AD Application Proxy

Answer

Privileged Identity Management (PIM)

Question 5

A security architect is explaining identity management concepts to the IT team. Which statement correctly describes the difference between authentication and authorization?

Accepted Answer

Authentication verifies the identity of a user, while authorization determines the resources they can access.. Authentication is the process of verifying a user's identity (e.g., via password, biometric, or certificate), while authorization determines what resources or actions that authenticated identity is permitted to access. In Microsoft Entra ID, authentication occurs first via protocols like OAuth 2.0 or OpenID Connect, and authorization is then enforced through role-based access control (RBAC) or conditional access policies.

Answer

Authentication verifies what a user can do, while authorization verifies who the user is.

Answer

Authorization must always occur before authentication.

Answer

Authentication and authorization are synonymous terms in identity management.

Question 6

A healthcare organization must comply with HIPAA. They need to automatically detect protected health information (PHI) in emails sent from Exchange Online, prevent users from sharing these emails with unauthorized external recipients, and apply a retention label that retains PHI emails for six years. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Information Protection and Data Loss Prevention. Microsoft Purview Information Protection and Data Loss Prevention (DLP) is the correct solution because it combines sensitive data classification (to detect PHI via built-in HIPAA data classifiers) with policy-based enforcement (to block sharing with unauthorized external recipients) and can automatically apply a retention label (via auto-labeling policies) to retain PHI emails for six years. This directly addresses all three requirements: detection, prevention, and retention.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Insider Risk Management

Question 7

A security analyst needs to investigate a phishing campaign that targeted multiple users. They want to correlate email threat data with user actions and device signals. Which Microsoft security solution should they use as the primary investigation console?

Accepted Answer

Microsoft 365 Defender. Microsoft 365 Defender (now Microsoft Defender XDR) is the correct choice because it provides a unified incident investigation and response experience that correlates signals across email, endpoints, identities, and cloud apps. For a phishing campaign targeting multiple users, the analyst needs to correlate email threat data (from Defender for Office 365) with user actions (from Azure AD/Identity) and device signals (from Defender for Endpoint) — this cross-domain correlation is the primary function of Microsoft 365 Defender's incident queue and advanced hunting.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 8

A company is deploying a web application on Azure App Service. The security officer states that according to the shared responsibility model, the customer is responsible for managing access to the application and securing the application code. Which of the following responsibilities does Microsoft retain for Azure App Service?

Accepted Answer

Patching the underlying operating system of the App Service host. For Azure App Service, Microsoft retains responsibility for patching the underlying operating system of the host infrastructure. This is part of the shared responsibility model where the cloud provider manages the host OS and hypervisor, while the customer manages the application code, data, and access configurations.

Answer

Configuring network firewall rules for the App Service

Answer

Managing user authentication and authorization

Answer

Applying encryption to the application data at rest

Question 9

A company has on-premises Active Directory. They want to detect advanced attacks like Pass-the-Hash, DCSync, and malicious Kerberos activity using behavioral analytics. Which Microsoft security solution should they deploy on their domain controllers?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it uses behavioral analytics and machine learning to detect advanced attacks specifically targeting on-premises Active Directory, such as Pass-the-Hash, DCSync, and malicious Kerberos activity. MDI monitors domain controller traffic, including Kerberos authentication and NTLM relay, to identify anomalous patterns indicative of these attacks.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Question 10

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that users can use the same password on-premises and in the cloud without having to sync password hashes. Additionally, you want to prevent accounts from being locked out after a few bad password attempts in the cloud. Which Microsoft Entra feature should you implement?

Accepted Answer

Deploy password writeback and enable Microsoft Entra smart lockout.. Password writeback enables password changes made in the cloud to be written back to on-premises Active Directory, ensuring the same password is used without syncing password hashes. Microsoft Entra smart lockout prevents accounts from being locked out after a few bad password attempts in the cloud by intelligently recognizing and blocking malicious sign-in attempts while allowing legitimate users to continue, without locking the on-premises account.

Answer

Use password hash synchronization and set up custom lockout policies.

Answer

Implement federation with Active Directory Federation Services (AD FS).

Answer

Implement pass-through authentication and configure on-premises lockout thresholds.

Question 11

Your organization uses Microsoft Defender for Cloud Apps. A security analyst needs to receive an alert whenever a user accesses a cloud app from a new IP address that is not in the organization's trusted IP range. What should the analyst configure?

Accepted Answer

An anomaly detection policy. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user activities, such as access from a new IP address outside the organization's trusted IP range. This policy leverages machine learning to establish a baseline of normal behavior and triggers alerts when deviations occur, making it the correct choice for this scenario.

Answer

A file policy

Answer

A session policy

Answer

An app permission policy

Question 12

A company uses Microsoft Entra ID. They want to allow employees to access the expense reporting application only from managed devices that are compliant with security policies and from trusted IP ranges. Additionally, if the user's sign-in risk is high, access must be blocked. Which of the following conditions should the administrator configure in a Conditional Access policy to enforce these requirements?

Accepted Answer

Device state, Locations, and Sign-in risk. The scenario requires three distinct conditions: device compliance (Device state), trusted network locations (Locations), and high sign-in risk (Sign-in risk). Conditional Access policies in Microsoft Entra ID allow combining these assignments to enforce granular access controls. Only by including all three can the administrator block access when the user's sign-in risk is high, while also requiring a managed device and trusted IP range.

Answer

Only Device state and Locations

Answer

Only Sign-in risk and Device state

Answer

Only Locations and Sign-in risk

Question 13

A company uses Microsoft Entra ID and Intune for mobile device management. They want to grant access to a confidential project management site only from devices that are encrypted and have the latest anti-malware updates. Which Conditional Access assignment should they configure to enforce this requirement?

Accepted Answer

Device state. (Device state) is correct because Conditional Access policies can use the 'Device state' condition to require that devices are marked as compliant or are hybrid Azure AD joined. Compliance is determined by Intune compliance policies, which can enforce requirements like encryption and up-to-date anti-malware. By setting the 'Device state' condition to 'Compliant device' or 'Hybrid Azure AD joined device', access to the confidential site is granted only to devices meeting those security baselines.

Answer

Sign-in risk

Answer

User risk

Answer

Application

Question 14

A company uses Microsoft Entra ID. They want to ensure that only users with a specific role can reset passwords for other users in their organization. Which feature should they use?

Accepted Answer

Administrative Units. Administrative Units allow you to delegate administrative tasks, such as password resets, to users who have a specific role scoped to a subset of users. By assigning the Helpdesk Administrator role to an Administrative Unit, you ensure that only those users can reset passwords for members of that unit, meeting the requirement precisely.

Answer

Privileged Identity Management

Answer

Conditional Access

Answer

Identity Protection

Question 15

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that company data on personal devices is protected if the device is lost or stolen. What should you configure?

Accepted Answer

Selective wipe action. Selective wipe (Option D) is the correct configuration because it removes only corporate data from a personal device while preserving the user's personal apps, photos, and settings. In Microsoft Intune, a selective wipe targets managed app data and company email profiles via Exchange ActiveSync, leaving the device usable for personal purposes. This is the appropriate action for protecting company data on a lost or stolen BYOD device without overstepping into the user's private information.

Answer

Compliance policy with device health requirements

Answer

Conditional Access policy requiring compliant devices

Answer

Full wipe action