SC-900 Practice Test 45 — 15 Questions

Question 1

A multinational company deploys Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. The compliance team reports that a DLP policy blocks a legitimate payment processing workflow. What should the compliance administrator do to allow the workflow while maintaining protection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a DLP policy tip that allows users to override the block with a business justification.. DLP policy tips allow users to override a block by providing a business justification, which enables legitimate workflows to proceed while maintaining data protection. This approach ensures that the payment processing workflow is not permanently blocked, but the override is auditable and subject to compliance review. It balances security and operational needs without disabling or weakening the DLP policy.

Answer

Add the payment processing server to the DLP policy’s allow list.

Answer

Reduce the minimum confidence level in the DLP policy.

Answer

Disable the DLP policy for the payment processing department.

Question 2

Refer to the exhibit. You run the Azure PowerShell command for a storage account. What is the current network access configuration?

Accepted Answer

The storage account is not accessible from any network.. The Azure PowerShell command `Update-AzStorageAccountNetworkRuleSet -ResourceGroupName 'RG1' -StorageAccountName 'stgacc1' -DefaultAction Deny` sets the default network access rule to Deny. When the default action is Deny, no traffic is allowed unless explicitly permitted by a network rule (e.g., from a specific virtual network or IP address). Since no such rules are shown in the exhibit, the storage account is effectively not accessible from any network.

Answer

The storage account is accessible only from specific virtual networks.

Answer

The storage account is accessible from all networks.

Answer

The storage account is accessible only from specific IP addresses.

Question 3

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to ensure that only devices that are enrolled in Intune and compliant with your organization's security policies can access corporate email. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it enforces policy-based access controls that evaluate device compliance status reported by Microsoft Intune. By configuring a Conditional Access policy to require 'Device to be marked as compliant,' only devices enrolled in Intune and meeting security policies can access corporate email, leveraging the integration between Entra ID and Intune.

Answer

Microsoft Entra Entitlement Management

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Terms of Use

Question 4

A security operations center (SOC) team uses Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) enabled. They notice an alert about a user accessing a sensitive HR application from an unusual IP address at 3 AM. What does UEBA primarily use to detect this anomaly?

Accepted Answer

Historical behavior baselines and machine learning. UEBA in Microsoft Sentinel detects anomalies by establishing a baseline of normal user behavior over time—such as typical login times, locations, and accessed applications—using machine learning models. When a user accesses a sensitive HR app from an unusual IP at 3 AM, the deviation from this learned baseline triggers an alert, not a static rule or manual input.

Answer

Static rule-based thresholds defined by the SOC

Answer

Manual input from the SOC team

Answer

Threat intelligence feeds from Microsoft

Question 5

Your organization uses Microsoft Entra ID with P1 licenses. You need to provide a temporary access pass for a new employee to set up their account without a password. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra Temporary Access Pass. The Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator that allows a user to register passwordless authentication methods (e.g., Microsoft Authenticator, FIDO2 security key) without needing an existing password. This directly meets the requirement for a new employee to set up their account without a password, and it is available with Microsoft Entra ID P1 licenses.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Verified ID

Question 6

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user passwords and enable password writeback for self-service password reset. Which tool should you use?

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync (formerly Azure AD Connect) is the correct tool because it synchronizes on-premises Active Directory objects, including password hashes, to Microsoft Entra ID and supports password writeback, which enables self-service password reset (SSPR) to write changed passwords back to on-premises AD. The question specifically requires both password synchronization and writeback, which are core features of Entra Connect Sync.

Answer

Microsoft Entra admin center

Answer

Active Directory Federation Services (AD FS)

Answer

Azure AD Connect (deprecated)

Question 7

An organization needs to automatically apply a 'Highly Confidential' sensitivity label to all documents that contain a specific custom sensitive information type. The label should be applied when the document is created or modified. Which feature of Microsoft Purview Information Protection should be used?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview Information Protection are designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types. This feature supports both simulation and real-time enforcement, and it can be triggered when documents are created or modified, meeting the organization's requirement exactly.

Answer

Manual sensitivity labeling

Answer

Data Loss Prevention (DLP) policies

Answer

Communication Compliance policies

Question 8

Your organization uses Microsoft Copilot for Security. You want to use natural language to generate a KQL query for threat hunting. What should you do?

Accepted Answer

Use the Copilot prompt bar in the Microsoft Defender portal.. Microsoft Copilot for Security is integrated directly into the Microsoft Defender portal, allowing security analysts to use natural language prompts to generate KQL queries for threat hunting. The Copilot prompt bar interprets the natural language input and converts it into the appropriate KQL syntax, eliminating the need for manual query writing.

Answer

Manually write the KQL query in the advanced hunting page.

Answer

Install the Copilot add-in for Sentinel.

Answer

Subscribe to Microsoft 365 Copilot.

Question 9

Your company wants to protect sensitive data in Microsoft Teams. Which two Microsoft Purview features can help prevent accidental sharing of confidential information? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policies for Teams. Data Loss Prevention (DLP) policies for Teams can detect and block sharing of sensitive information (e.g., credit card numbers, social security numbers) in Teams messages and channels, preventing accidental exposure. Sensitivity labels allow you to classify and protect Teams sites and content by applying encryption, visual markings, and access restrictions, ensuring confidential data is not shared with unauthorized users.

Answer

Audit log search for Teams

Answer

eDiscovery for Teams

Answer

Retention policies for Teams messages

Question 10

Your company, Proseware, uses Microsoft Entra ID P2. You have a custom application that integrates with Microsoft Graph API to read user profiles. The application uses client credentials flow (application permissions). You need to ensure that the application can only read user profiles and not perform any other operations. Additionally, you want to review and approve the permissions periodically. What should you do?

Accepted Answer

In Microsoft Entra ID, grant the application the User.Read.All permission and configure an access review for the application permissions.. The application uses client credentials flow (application permissions), which requires granting an application permission like User.Read.All to read all user profiles. Configuring an access review for the application permissions in Microsoft Entra ID allows periodic review and approval of those permissions, meeting the requirement to ensure the app can only read user profiles and that permissions are reviewed periodically.

Answer

Create a Conditional Access policy to restrict the app to read-only operations.

Answer

Enable Privileged Identity Management for the app and require approval for each API call.

Answer

Use delegated permissions for the application and assign users to the app role.

Question 11

Which TWO are capabilities of Microsoft Entra ID Protection?

Accepted Answer

Risk-based conditional access policies. Microsoft Entra ID Protection uses risk-based conditional access policies to automatically respond to detected risks, such as blocking access or requiring multi-factor authentication, based on real-time risk levels. Option E is correct because Entra ID Protection continuously monitors for leaked credentials by analyzing known credential breaches and flagging accounts whose credentials have been exposed, enabling proactive remediation.

Answer

Device enrollment policies

Answer

Self-service password reset

Answer

Privileged role activation

Question 12

A manufacturing company experiences repeated ransomware attacks targeting their on-premises file servers. They have Microsoft 365 E5 and want to implement a solution to detect and automatically respond to such threats across hybrid environments. What should they deploy?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity is the correct solution because it uses on-premises Active Directory signals to detect, investigate, and respond to advanced threats like ransomware targeting hybrid environments. It integrates with Microsoft 365 Defender to automatically initiate response actions (e.g., disabling compromised accounts) when suspicious lateral movement or credential theft is detected, directly addressing the scenario of repeated ransomware attacks on on-premises file servers.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Question 13

A compliance officer needs to create a policy that automatically detects and blocks the sharing of credit card numbers in emails and Teams messages. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and automatically block sensitive information, such as credit card numbers, from being shared in emails and Teams messages. DLP uses built-in sensitive information types (e.g., Credit Card Number) and policies that can enforce actions like blocking the message or sending an alert, directly meeting the compliance officer's requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection

Question 14

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' sensitivity label to any document that contains a Social Security number. What should you create?

Accepted Answer

An auto-labeling policy for sensitivity labels. An auto-labeling policy for sensitivity labels in Microsoft Purview can automatically apply a 'Confidential' sensitivity label to documents containing sensitive information types like Social Security numbers. This policy uses content scanning and pattern matching to detect the data and apply the label without user intervention, meeting the requirement for automatic classification.

Answer

A sensitivity label policy with manual labeling

Answer

A Data Loss Prevention (DLP) policy

Answer

A retention policy

Question 15

An organization has Microsoft Sentinel and Microsoft Defender XDR. They want to automatically block a user's sign-in if a high-risk alert is triggered. Which Microsoft Entra feature integrates with these products to enforce access controls?

Accepted Answer

Conditional Access with Identity Protection integration. Conditional Access with Identity Protection integration allows organizations to create policies that automatically block sign-ins when Microsoft Sentinel or Microsoft Defender XDR triggers a high-risk alert. This integration leverages risk signals from Identity Protection to enforce real-time access controls, such as blocking authentication, without manual intervention.

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management