SC-900 Practice Test 43 — 15 Questions

Question 1

You are a security architect for a large enterprise using Microsoft Entra ID. You need to implement a solution that enforces least-privilege access and reduces lateral movement. Which THREE Microsoft Entra capabilities should you include in your design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Identity Protection. Identity Protection is correct because it uses machine learning to detect and automatically respond to identity-based risks, such as leaked credentials or anomalous sign-in patterns, which directly reduces the attack surface and limits lateral movement by blocking or challenging risky authentications before an attacker can pivot.

Answer

Password hash synchronization

Answer

Microsoft Defender for Cloud Apps

Question 2

Your organization uses Microsoft Entra ID and has deployed Microsoft Entra ID Governance for entitlement management. You need to allow external partners to request access to a specific application, but only if they have a valid email address from an approved domain. Once approved, their access should automatically expire after 30 days. You also need to ensure that the partner's access is reviewed quarterly by the application owner. What should you configure?

Accepted Answer

Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, set expiration to 30 days, and add a quarterly access review.. It combines all required components: a connected organization restricts access to approved partner domains, the access package includes the application as a resource, approval ensures authorization, a 30-day expiration enforces automatic access removal, and a quarterly access review satisfies ongoing compliance. Microsoft Entra ID Governance entitlement management uses access packages to bundle resources, policies, and reviews for external collaboration.

Answer

Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, and set expiration to 30 days.

Answer

Create a dynamic group based on partner email domain and assign the application to the group with a 30-day expiration policy.

Answer

Add the partner as a guest user manually and assign the application directly with an expiration date.

Question 3

Your organization uses Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing the company's financial application. Which security feature should you use?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA specifically for the financial application by targeting the application in the policy. This provides granular control over authentication requirements based on conditions such as user, location, device state, and application, which is exactly what is needed to secure a specific app.

Answer

Security defaults

Answer

Privileged Identity Management

Answer

Identity Protection

Question 4

Your organization uses Microsoft Entra ID and wants to provide a single sign-on (SSO) experience for a third-party SaaS application that supports SAML 2.0. The app must also enforce multifactor authentication (MFA) for external users. What should you configure?

Accepted Answer

Set up SAML-based federation in Microsoft Entra ID and assign a Conditional Access policy requiring MFA. The scenario requires SAML 2.0-based federation for SSO, which Microsoft Entra ID supports natively. By assigning a Conditional Access policy that requires MFA, you enforce multifactor authentication for external users accessing the third-party SaaS application, meeting both SSO and MFA requirements.

Answer

Add the app as a Linked Sign-On application

Answer

Use password-based SSO in Microsoft Entra ID

Answer

Configure OAuth 2.0 authorization in Microsoft Entra ID

Question 5

You are the compliance administrator for a retail company that uses Microsoft 365 Business Premium. The company needs to:
- Block customers' credit card numbers from being sent via email.
- Retain all sales invoices for 3 years as per financial regulations.
- Allow managers to search and export employee emails for HR investigations.
- Ensure that only HR can access employee salary information.
Which Microsoft Purview solutions should you use?

Accepted Answer

DLP, Data Lifecycle Management, eDiscovery, and sensitivity labels. DLP (Data Loss Prevention) blocks credit card numbers from being sent via email, Data Lifecycle Management retains sales invoices for 3 years, eDiscovery allows managers to search and export employee emails for HR investigations, and sensitivity labels restrict access to salary information to HR only. Each requirement maps directly to a specific Purview solution: DLP for sensitive data protection, retention policies for compliance, eDiscovery for legal/HR investigations, and sensitivity labels for access control.

Answer

DLP, Information Barriers, eDiscovery, and sensitivity labels

Answer

Insider Risk Management, Data Lifecycle Management, eDiscovery, and sensitivity labels

Answer

Communication Compliance, Data Lifecycle Management, eDiscovery, and sensitivity labels

Question 6

A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have a custom line-of-business application that uses Windows Integrated Authentication and requires Kerberos. Which approach should they use to enable hybrid identity?

Accepted Answer

Deploy Microsoft Entra Kerberos authentication and register the app. Microsoft Entra Kerberos authentication enables hybrid identity for legacy on-premises applications that require Kerberos and Windows Integrated Authentication. By deploying this feature, the app can authenticate users against Microsoft Entra ID while still receiving Kerberos tickets, allowing a seamless migration without modifying the application's authentication code.

Answer

Use password hash synchronization (PHS) and configure the app for OAuth

Answer

Use pass-through authentication (PTA) and configure the app for SAML

Answer

Federate with Active Directory Federation Services (ADFS)

Question 7

Your organization is implementing Microsoft Entra Internet Access (formerly Microsoft Entra Internet Access). You need to secure access to public internet apps by enforcing traffic routing through Microsoft's network. Which feature should you enable?

Accepted Answer

Global Secure Access. Microsoft Entra Internet Access (part of Global Secure Access) routes traffic from users and devices through the Microsoft network to enforce security policies for public internet apps. Enabling Global Secure Access allows you to configure traffic forwarding profiles that redirect internet-bound traffic through Microsoft Entra Internet Access, ensuring consistent policy enforcement and threat protection.

Answer

Conditional Access

Answer

DDoS protection

Answer

Network segmentation

Question 8

Refer to the exhibit. A company has configured the above Conditional Access policy in Microsoft Entra ID. A user attempts to access Exchange Online from an untrusted location. What happens?

Accepted Answer

The user is granted access without MFA because the policy does not apply.. The Conditional Access policy shown in the exhibit is configured with 'Include: All users' and 'Exclude: All users'. When both include and exclude are set to 'All users', the exclusion takes precedence, effectively making the policy apply to no users. Therefore, when a user attempts to access Exchange Online from an untrusted location, the policy does not apply, and the user is granted access without MFA.

Answer

Access is blocked because the condition is not met.

Answer

The user is prompted for MFA because the policy applies to all users.

Answer

The user is blocked because the grant requires MFA.

Question 9

A company wants to provide employees with single sign-on access to both Microsoft 365 and a third-party SaaS application. Which feature of Microsoft Entra ID should they use?

Accepted Answer

Federation. Federation (Option C) is correct because it establishes a trust relationship between Microsoft Entra ID and the third-party SaaS application's identity provider using standards like SAML 2.0 or WS-Federation. This allows users to authenticate once with their corporate credentials and gain access to both Microsoft 365 and the third-party app without separate logins, enabling true single sign-on (SSO).

Answer

Identity Protection

Answer

Conditional Access

Answer

Privileged Identity Management

Question 10

A company wants to monitor employee communications for potential harassment or policy violations. Which Microsoft Purview solution should they use?

Accepted Answer

Communication compliance. Communication compliance is the correct solution because it is specifically designed to detect and remediate inappropriate communications, such as harassment, threats, or policy violations, by analyzing email, Microsoft Teams, and third-party messages. It uses customizable policies to scan for sensitive content, keywords, or patterns, and provides alerts for review by designated investigators.

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Answer

Insider risk management

Question 11

Your organization is planning to implement Microsoft Entra ID for identity and access management. Which TWO capabilities are provided by Microsoft Entra ID?

Accepted Answer

Identity governance (e.g., access reviews). Microsoft Entra ID provides identity governance capabilities such as access reviews, which allow administrators to automate the process of reviewing and certifying user access to applications and groups. This ensures compliance and security by regularly validating that users have appropriate access rights. Single sign-on (SSO) is a core feature of Entra ID, enabling users to authenticate once and access multiple cloud applications without re-entering credentials, leveraging protocols like OAuth 2.0 and SAML 2.0.

Answer

External identity management for customer-facing apps

Answer

Security event log analysis

Answer

Mobile device management (MDM)

Question 12

Your organization wants to enforce MFA for all users accessing the Azure portal. However, users accessing from the corporate office network should not be prompted for MFA. Which Conditional Access assignment should you configure?

Accepted Answer

Include all locations, exclude trusted locations.. Conditional Access policies evaluate assignments based on conditions such as user, app, and location. To enforce MFA for all users accessing the Azure portal while excluding the corporate office network, you must include all users and the Azure portal app, then exclude trusted locations (the corporate network). This ensures MFA is required only when access originates from outside the trusted corporate network.

Answer

Include all users, include trusted locations.

Answer

Include all trusted locations.

Answer

Include Azure portal app, exclude trusted locations.

Question 13

Your organization needs to prevent sensitive data in SharePoint Online from being shared externally. Which Microsoft Purview solution should you use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct Microsoft Purview solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), by applying policies that can block external sharing in SharePoint Online. DLP policies can be configured to scan content in real-time and enforce actions like blocking access or sending notifications when sensitive data is detected in external sharing scenarios.

Answer

eDiscovery

Answer

Sensitivity labels

Answer

Insider Risk Management

Question 14

A tenant administrator runs the PowerShell cmdlet shown in the exhibit. The output shows that some compliance policies have IsAssigned = $false. What does this indicate?

Accepted Answer

The compliance policy is not assigned to any user or device group. The `IsAssigned` property in the output of a compliance policy PowerShell cmdlet (such as `Get-DeviceCompliancePolicy`) directly indicates whether the policy has been assigned to any user or device group. When `IsAssigned = $false`, it means the policy exists in the tenant but has not been linked to any group via an assignment, so it is not being enforced on any devices. This is a core concept in Microsoft Intune and Microsoft 365 compliance: a policy must be assigned to a group to take effect.

Answer

The compliance policy is scheduled to be assigned in the future

Answer

The compliance policy has been evaluated and found non-compliant

Answer

The compliance policy is a built-in policy that cannot be assigned

Question 15

Your company needs to detect and prevent employees from sharing confidential product plans via email with external parties. Which Microsoft Purview solution should you configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive information, such as confidential product plans, via email and other channels. DLP policies can inspect email content and attachments for sensitive data types (e.g., custom keywords or patterns) and automatically block or quarantine the message if it is sent to external recipients. This aligns directly with the requirement to prevent employees from sharing confidential plans externally.

Answer

Sensitivity labels

Answer

Communication compliance

Answer

Retention policies