SC-900 Practice Test 44 — 15 Questions

Question 1

A company is involved in a lawsuit. The legal team needs to preserve all emails, documents, and Teams messages from five key employees (custodians) that are related to a specific project. The data must be collected securely and provided for legal review without modifying the original data. Which Microsoft Purview solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct solution because it is specifically designed for legal investigations, allowing organizations to identify, preserve, collect, and export relevant data (emails, documents, Teams messages) from custodians without altering the original data. It supports legal hold, advanced search, and secure export for legal review, meeting the lawsuit requirements.

Answer

Data Lifecycle Management

Answer

Records Management

Answer

Communication Compliance

Question 2

A company wants to improve its security awareness program by periodically sending simulated phishing emails to employees to test their ability to identify malicious messages. The results should be tracked in a dashboard that shows which employees clicked the links. Which Microsoft 365 Defender capability should they use?

Accepted Answer

Attack Simulation Training. Attack Simulation Simulation Training is the correct answer because it is the specific Microsoft 365 Defender capability designed to create and launch simulated phishing campaigns, track employee interactions (e.g., clicks on malicious links), and report results in a dashboard. This feature is part of Microsoft Defender for Office 365 but is a distinct workload focused on security awareness training and measurement.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft 365 Defender Incident Response

Question 3

A company implements multiple layers of security controls, including firewalls, antivirus software, access controls, and security awareness training. Which security concept does this approach best represent?

Accepted Answer

Defense in depth. Defense in depth is the correct concept because it involves layering multiple independent security controls—such as firewalls, antivirus, access controls, and training—so that if one layer fails, others continue to protect the asset. This approach reduces the likelihood of a single point of failure and is a foundational strategy in cybersecurity architecture.

Answer

Zero Trust

Answer

Shared responsibility

Answer

Least privilege

Question 4

Refer to the exhibit. You are a compliance administrator managing a DLP policy in Microsoft Purview. The policy is set to 'enforce' mode but you notice that internal users can still share credit card numbers via email to external recipients. What is the most likely cause?

Accepted Answer

The action only blocks access to the content from external users, not sharing by internal users. A DLP policy in 'enforce' mode can still allow internal users to share sensitive data if the policy action is configured to 'block access to content from external users' rather than 'block sharing by internal users'. In Microsoft Purview, the 'block access' action restricts external recipients from viewing the content but does not prevent the internal sender from transmitting the email. To stop internal users from sending, the policy must use the 'block sending' action, which prevents the message from being delivered.

Answer

The policy is in test mode, not enforce mode

Answer

The policy is not applied to the user's mailbox

Answer

The condition requires a minimum count of 5

Question 5

Your company uses Microsoft Defender for Endpoint. A security analyst reports that a device is showing multiple alerts for the same malware variant, but the alerts are being automatically suppressed after the initial detection. What is the most likely reason for this behavior?

Accepted Answer

Alert suppression is enabled to reduce noise from repeated detections. Microsoft Defender for Endpoint includes alert suppression as a built-in feature to reduce alert fatigue from repeated detections of the same malware variant on the same device. When the same file or behavior is detected multiple times, the system automatically suppresses subsequent alerts after the initial detection, consolidating them into a single incident. This behavior is controlled by suppression rules that are enabled by default for common malware patterns, ensuring security analysts are not overwhelmed by duplicate alerts.

Answer

The alerts are classified as low severity

Answer

The device is not properly onboarded to Microsoft Defender for Endpoint

Answer

Automatic investigation and remediation resolved the alerts

Question 6

A company has an on-premises Active Directory and wants to synchronize user accounts to Microsoft Entra ID. They also need to enable password hash synchronization so users can sign in to cloud resources with the same password. Which Microsoft tool should they use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct tool because it is specifically designed to synchronize on-premises Active Directory user accounts to Microsoft Entra ID and supports password hash synchronization (PHS). PHS enables users to sign in to cloud resources using the same password as their on-premises environment by synchronizing a hash of the password hash to Entra ID.

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Identity Manager

Answer

Microsoft Entra Domain Services

Question 7

A healthcare organization must comply with HIPAA regulations. They need to automatically detect and classify sensitive health information such as medical record numbers stored in SharePoint Online and OneDrive. When detected, the solution should apply encryption and restrict access to only authorized personnel. Which Microsoft Purview solution should they configure?

Accepted Answer

Information Protection. Microsoft Purview Information Protection (specifically sensitivity labels and auto-labeling policies) can automatically detect sensitive health information like medical record numbers using built-in sensitive information types (e.g., U.S. HIPAA-defined types). When detected, it can apply encryption via Rights Management and restrict access to authorized personnel, meeting HIPAA compliance requirements.

Answer

Data Lifecycle Management

Answer

Audit

Answer

eDiscovery

Question 8

A company uses Microsoft Defender for Cloud Apps to protect its SaaS apps. The security team needs to detect when a user downloads more than 100 files from SharePoint Online within 10 minutes. Which policy type should they create?

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning to establish a baseline of normal user behavior and then trigger alerts when deviations occur, such as a user downloading over 100 files from SharePoint Online within 10 minutes. This specific scenario—unusually high download volume in a short time—is a classic example of a behavioral anomaly that an anomaly detection policy is designed to catch, as it may indicate a data exfiltration attempt.

Answer

Activity policy

Answer

Threat detection policy

Answer

Compliance policy

Question 9

Your organization has a Microsoft Entra ID tenant with 5,000 users. You need to implement a solution that automatically detects and remediates users with leaked credentials. Additionally, you need to require users to change their password when a high risk is detected. Which Microsoft Entra features should you configure?

Accepted Answer

Enable Microsoft Entra Identity Protection, configure a user risk policy to require password change when risk is medium or high.. Microsoft Entra Identity Protection detects leaked credentials by monitoring for credential exposures on the dark web and other sources. Configuring a user risk policy to require a password change when risk is medium or high automatically remediates the detected risk by forcing the user to update their password, directly addressing the requirement for automatic detection and remediation.

Answer

Create an Access Review for all users and require them to confirm their access quarterly.

Answer

Enable Privileged Identity Management (PIM) and require multi-factor authentication for all role activations.

Answer

Configure a Conditional Access policy to require password change when sign-in risk is high.

Question 10

Fabrikam Inc., a global financial services company, uses Microsoft Purview to manage compliance. They have the following requirements: (1) Prevent users from sending emails containing credit card numbers (CCN) to external recipients; (2) automatically encrypt emails containing CCN; (3) notify users when an email is blocked; (4) allow users to override the block for business justifications; (5) generate incident reports for compliance teams. The company uses Microsoft 365 E5 licenses and has Exchange Online configured. The compliance team wants to implement a solution with minimal administrative overhead. What should the administrator configure?

Accepted Answer

Create a Data Loss Prevention (DLP) policy in the Microsoft Purview compliance portal with conditions for CCN, and configure actions to block, encrypt, notify, and allow override.. A DLP policy can block, encrypt, notify, and allow override, with incident reports. Option A is wrong because information barriers prevent communication between groups, not data exfiltration. Option C is wrong because sensitivity labels with auto-labeling classify but do not prevent sending. Option D is wrong because message encryption without DLP does not block or provide override.

Answer

Configure information barriers between the finance department and external recipients.

Answer

Create a sensitivity label that automatically classifies emails with CCN and configure a label policy to encrypt them.

Answer

Enable Microsoft Purview Message Encryption and create a mail flow rule in Exchange to encrypt emails with CCN.

Question 11

A security administrator needs to enforce that all Microsoft 365 documents containing credit card numbers are automatically encrypted before being shared externally. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically detect sensitive data types, such as credit card numbers, in Microsoft 365 documents and enforce protective actions like encryption before external sharing. DLP policies use sensitive information types (e.g., Credit Card Number) and conditions to trigger encryption via Azure Information Protection, ensuring data is protected at rest and in transit.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Information Protection

Question 12

You are investigating an alert in Microsoft Sentinel. The exhibit shows the JSON output of an alert that was generated from a sign-in log. The alert is linked to an active incident. Which action should you take to prioritize the incident for investigation?

Accepted Answer

Change the incident severity to critical. Changing the incident severity to critical in Microsoft Sentinel directly influences the prioritization and triage workflow. By elevating the severity, the incident is flagged for immediate attention, ensuring it appears at the top of the queue for investigation. This action aligns with the incident management best practice of using severity levels to indicate business impact and urgency.

Answer

Close the incident as a false positive

Answer

Delete the alert from the incident

Answer

Reassign the incident to another analyst

Question 13

A hospital stores patient medical records electronically. An attacker gains access to the system and modifies patient diagnoses. Which principle of the CIA triad has been violated?

Accepted Answer

Integrity. The CIA triad's Integrity principle ensures that data is not modified by unauthorized parties. In this scenario, the attacker altered patient diagnoses, which directly violates data integrity. Confidentiality (unauthorized disclosure) and Availability (denial of service) are not the primary concerns here.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 14

A multinational corporation must comply with the General Data Protection Regulation (GDPR). They use Microsoft Purview Compliance Manager to manage compliance activities. The compliance manager wants to automatically assign each control to the appropriate team member for remediation. What should they configure?

Accepted Answer

Configure improvement actions with owners. To automatically assign each control to the appropriate team member for remediation in Microsoft Purview Compliance Manager, you must configure improvement actions with owners. Each improvement action can be assigned to a specific user who is responsible for implementing the remediation steps, and this assignment triggers automatic notifications and tracking within the compliance score.

Answer

Create new assessments for each regulation

Answer

Set up connectors to import external risk data

Answer

Use the Microsoft 365 admin center to delegate tasks

Question 15

A company uses Microsoft 365 and allows employees to access corporate email and documents from their personal devices. The security team wants to protect against malicious links in emails and Microsoft Teams messages. When a user clicks a link, it should be checked in real-time to see if it leads to a known malicious site. If it does, access should be blocked. Which Microsoft security solution provides this capability?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Links, which provides real-time URL scanning at the time of click. When a user clicks a link in an email or Teams message, the URL is rewritten and checked against a dynamic list of known malicious sites. If the link is determined to be malicious, access is blocked, and the user is redirected to a warning page.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity