SC-900 Practice Test 44 — 15 Questions

Question 1

A company wants to provide external consultants with access to a specific application using their LinkedIn or Google accounts. Which Microsoft Entra feature allows this?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) is the correct feature because it enables external users—such as consultants—to sign in using their own identity providers (IdPs) like LinkedIn or Google via federation. This allows the company to grant access to a specific application without creating separate Microsoft Entra accounts for each consultant, leveraging social identity providers through OpenID Connect or OAuth 2.0 protocols.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Question 2

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Sentinel. The query returns sign-in logs with error code 50076. What does this error indicate?

Accepted Answer

The user did not pass multi-factor authentication.. Error code 50076 in Microsoft Entra sign-in logs specifically indicates that the user did not pass multi-factor authentication (MFA). This error is returned when the MFA challenge fails, such as when the user enters an incorrect verification code, denies the push notification, or the MFA session expires. It is a direct signal that the authentication attempt was not completed successfully due to MFA failure.

Answer

The user account is disabled.

Answer

The user's password has expired.

Answer

The sign-in was blocked by a Conditional Access policy.

Question 3

Your organization uses Microsoft Entra ID with P2 licenses. You need to implement a policy that requires users to perform multifactor authentication (MFA) when accessing the finance application from an untrusted network, but not when accessing it from the corporate network. Which Microsoft Entra feature should you configure?

Accepted Answer

Microsoft Entra Conditional Access policy. Microsoft Entra Conditional Access policies allow you to enforce MFA based on conditions such as network location. By configuring a policy that targets the finance application and includes a condition for 'untrusted networks' (e.g., any location other than the corporate network's trusted IP ranges), you can require MFA only when access originates from outside the corporate network. This is the correct feature for granular, condition-based access controls.

Answer

Microsoft Entra Entitlement Management

Answer

Microsoft Entra ID Protection MFA registration policy

Answer

Microsoft Entra Privileged Identity Management (PIM)

Question 4

Your organization uses Microsoft Purview to manage compliance. You need to create a policy that ensures data is retained for a specific period and then automatically deleted. Which solution should you use?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (D) provides the ability to create retention and deletion policies that automatically retain data for a specified period and then delete it. This solution directly addresses the requirement to manage data retention and deletion schedules within Microsoft Purview.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Information Protection

Question 5

You need to allow users to reset their own passwords without contacting the help desk. Which Microsoft Entra feature should you enable?

Accepted Answer

Self-service password reset. Self-service password reset (SSPR) is the Microsoft Entra feature that allows users to reset their own passwords without contacting the help desk. It is designed to reduce help desk costs and improve user productivity by enabling password changes or unlocks through a verified authentication method, such as email, phone, or security questions.

Answer

Microsoft Authenticator

Answer

Identity Governance

Answer

Conditional Access

Question 6

A user reports that they cannot access a sensitive document in SharePoint Online. The document has a 'Highly Confidential' sensitivity label. You verify the label is applied correctly. What is the most likely reason for the access issue?

Accepted Answer

The label's encryption settings restrict access to specific users. The 'Highly Confidential' sensitivity label is configured with encryption that restricts access to specific users or groups. Since you verified the label is applied correctly, the most likely reason the user cannot access the document is that their account is not included in the encryption permissions defined by the label. Sensitivity labels in Microsoft Purview Information Protection use Azure Rights Management (Azure RMS) to enforce encryption, and only authorized users with the appropriate rights can decrypt and access the content.

Answer

The sensitivity label is missing

Answer

A DLP policy is blocking access

Answer

A retention policy is blocking access

Question 7

Your company uses Microsoft Entra ID. Security policy requires that all external guest users must be reviewed and their access approved by their sponsor every 90 days. If not approved, access should be automatically removed. Which feature should you use?

Accepted Answer

Microsoft Entra access reviews. Microsoft Entra access reviews (Option D) allow you to configure recurring reviews of guest users' access, with automatic removal of access if not approved. This directly meets the requirement for a 90-day review cycle with automatic enforcement, as access reviews can be scoped to guest users and integrated with entitlement management or groups.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra B2B collaboration settings

Answer

Microsoft Entra entitlement management

Question 8

Refer to the exhibit. You run the PowerShell command shown to investigate a potential data exfiltration incident. The output is empty. Which is the most likely reason?

Accepted Answer

Audit logging is not enabled for the tenant. The Search-UnifiedAuditLog cmdlet retrieves entries from the unified audit log. If the output is empty, the most likely cause is that unified audit logging is not enabled for the tenant. In Microsoft 365, unified audit logging must be turned on in the compliance portal or via PowerShell (Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true). Without this, no audit records are generated, so the cmdlet returns no results regardless of user activity.

Answer

The user does not have a mailbox

Answer

The command syntax is incorrect

Answer

The user did not download or access any files in the past 7 days

Question 9

A financial services firm uses Microsoft Purview Information Barriers to prevent traders from communicating with investment bankers. A new employee in the trading department cannot access a SharePoint site used for compliance training. What should the administrator do?

Accepted Answer

Add the employee to the 'Traders' segment in Microsoft Purview Information Barriers.. Microsoft Purview Information Barriers use segments to group users based on their organizational roles. Adding the new employee to the 'Traders' segment ensures that the Information Barrier policy applies to them correctly, allowing them to access the compliance training SharePoint site while still being blocked from communicating with investment bankers.

Answer

Add the employee to the 'Traders' Microsoft 365 group.

Answer

Use the 'Override' option in the Information Barrier policy.

Answer

Disable the Information Barrier policy for the trading department.

Question 10

Your organization uses Microsoft Purview to classify documents containing health information. You need to ensure that only users with explicit permission can access these documents. Which Microsoft Purview capability should you use?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels with encryption are the correct choice because they allow you to classify documents containing health information and apply encryption to restrict access to only users with explicit permissions. This ensures that even if the document is shared or moved, only authorized users can decrypt and read it, meeting the requirement for access control.

Answer

Audit logs

Answer

Retention policies

Answer

Data Loss Prevention

Question 11

Your organization uses Microsoft Entra ID. Which TWO features help protect against identity-based attacks by detecting and responding to risks?

Accepted Answer

Conditional Access. Conditional Access is correct because it enforces policy-based access controls that evaluate real-time signals (e.g., user location, device compliance, sign-in risk) to block or challenge suspicious sign-in attempts, directly mitigating identity-based attacks. Identity Protection is correct because it uses machine learning to detect risk signals such as leaked credentials, anonymous IP addresses, and atypical travel, then automatically triggers remediation actions like requiring password reset or blocking access.

Answer

Privileged Identity Management

Answer

Access reviews

Answer

Entitlement management

Question 12

Your organization uses Microsoft Purview Information Barriers to prevent certain user groups from communicating with each other. You need to test the configuration before fully enforcing it. What should you do?

Accepted Answer

Run the Information Barriers policy in test mode. Microsoft Purview Information Barriers include a dedicated test mode that allows administrators to validate policy behavior against user segments before enforcement. Running the policy in test mode evaluates whether communications between specified segments are correctly blocked or allowed, without actually preventing messages, enabling safe validation of the configuration.

Answer

Define user segments in the Microsoft Purview compliance portal

Answer

Enable audit logging and then run the policy application

Answer

Use the Compliance Manager assessment for Information Barriers

Question 13

A company uses Microsoft Intune for mobile device management (MDM). They need to ensure that corporate data on personal devices is encrypted. Which configuration profile type should they deploy?

Accepted Answer

Device restrictions profile. Device restrictions profile in Microsoft Intune allows administrators to enforce device-level security settings, including encryption of corporate data on personal devices. This profile type can require BitLocker (Windows) or FileVault (macOS) encryption, and for mobile devices, it can mandate device encryption via policies that align with platform-specific encryption standards (e.g., Android's full-disk encryption or iOS Data Protection). By deploying a device restrictions profile with encryption settings enabled, the organization ensures that corporate data stored on the device is protected at rest.

Answer

Email profile

Answer

Certificate profile

Answer

Compliance policy

Question 14

Your organization uses Microsoft Purview to label documents. Users report that some documents are automatically labeled as 'Confidential' even though the content is public. Which action should you take to resolve this issue?

Accepted Answer

Review and adjust the auto-labeling rules in the sensitivity label policies. The issue is that auto-labeling rules are incorrectly classifying public content as 'Confidential'. By reviewing and adjusting the auto-labeling rules in the sensitivity label policies, you can refine the conditions (e.g., sensitive info types or pattern matching) to prevent false positives. This directly addresses the misconfiguration causing automatic labeling of non-sensitive content.

Answer

Enable auditing to track label usage

Answer

Disable auto-labeling in all sensitivity label policies

Answer

Require users to manually apply labels

Question 15

A university wants to provide its students with a verifiable digital transcript that the students can share with potential employers. The university uses Microsoft Entra Verified ID to issue credentials. When an employer wants to verify a student's transcript, they scan a QR code or receive a link. Which Microsoft Entra ID feature allows the university to issue these tamper-proof credentials and allows employers to verify them without contacting the university directly?

Accepted Answer

Microsoft Entra Verified ID. Microsoft Entra Verified ID (option C) is the correct answer because it is the decentralized identity solution built on open standards (W3C Decentralized Identifiers and Verifiable Credentials) that allows the university to issue tamper-proof digital credentials. Employers can verify these credentials independently by scanning a QR code or following a link, without needing to contact the university, because the verification is done cryptographically against the issuer's public DID on a distributed ledger.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Permissions Management