SC-900 Practice Test 45 — 15 Questions

Question 1

An organization uses Microsoft Purview Compliance Manager to track compliance with regulations. The compliance officer needs to create a custom assessment for a new internal policy. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new custom assessment in Compliance Manager and add custom controls.. In Microsoft Purview Compliance Manager, assessments are built on templates that contain controls. To create a custom assessment for a new internal policy, the compliance officer must create a new custom assessment and then add custom controls, because Compliance Manager does not provide a built-in template for arbitrary internal policies. Option B correctly describes this workflow: creating a new custom assessment and adding custom controls.

Answer

Use the Microsoft 365 admin center to create a compliance assessment.

Answer

Use the built-in 'Custom' template in Compliance Manager and modify it.

Answer

Import a new assessment template from the Microsoft Service Trust Portal.

Question 2

A company uses Microsoft Sentinel for security information and event management (SIEM). The security team needs to detect and automatically respond to a potential privilege escalation attack where an attacker attempts to add a new user to the Global Administrator role in Microsoft Entra ID. What should the security team configure?

Accepted Answer

Create an analytics rule with an automated playbook in Microsoft Sentinel. Microsoft Sentinel is the SIEM solution, and analytics rules define conditions that trigger automated responses. By creating an analytics rule that detects a user being added to the Global Administrator role (e.g., via the AuditLogs or IdentityProtection logs) and linking it to an automated playbook (a logic app), the security team can automatically respond to the privilege escalation attempt without manual intervention.

Answer

Deploy a device compliance policy in Microsoft Intune

Answer

Configure a data classification label in Microsoft Purview

Answer

Create a policy in Microsoft Defender for Cloud Apps

Question 3

A compliance officer needs to create a policy that prevents users from sharing files containing medical record numbers (MRN) via email. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as medical record numbers (MRN), via email. DLP policies can inspect email content and attachments for patterns (e.g., regex for MRNs) and automatically enforce actions like blocking the message or notifying the user, preventing data exfiltration.

Answer

Sensitivity labels

Answer

eDiscovery

Answer

Insider risk management

Question 4

A company wants to prevent employees from accidentally sharing a document containing personally identifiable information (PII) with external users. The document is stored in OneDrive for Business. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the accidental sharing of sensitive data, such as PII, with external users. DLP policies can be configured to scan documents in OneDrive for Business for PII patterns (e.g., Social Security numbers, credit card numbers) and automatically block sharing with external users or trigger a policy tip to warn the employee. This directly addresses the requirement to prevent accidental external sharing of PII.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Question 5

Which Microsoft security solution provides centralized investigation and response across identities, endpoints, email, and cloud apps by correlating alerts from multiple sources?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct answer because it is specifically designed to correlate alerts from identities, endpoints, email, and cloud apps into a single incident, providing centralized investigation and response. It uses the Microsoft 365 Defender portal to unify signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, enabling automated remediation across these domains.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 6

Match each Microsoft Defender product to its focus area.

Accepted Answer

Microsoft Defender for Cloud: Secures cloud workloads. Microsoft Defender for Cloud secures cloud workloads; Defender for Endpoint secures endpoints; Defender for Identity secures identities; Defender for Office 365 secures email and collaboration; Defender for Cloud Apps secures shadow IT and app permissions.

Answer

Microsoft Defender for Office 365: Secures shadow IT and app permissions

Answer

Microsoft Defender for Cloud Apps: Secures cloud workloads

Question 7

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing social media accounts, such as Google or Facebook, while maintaining security and compliance with conditional access policies. What should you configure?

Accepted Answer

Configure Microsoft Entra External ID with social identity providers.. Microsoft Entra External ID (formerly Azure AD External Identities) allows you to configure social identity providers such as Google and Facebook as external identity sources. This enables users to sign in with their existing social media accounts while still being subject to your tenant's conditional access policies, ensuring security and compliance.

Answer

Enable Microsoft Entra Permissions Management.

Answer

Deploy Microsoft Entra Verified ID.

Answer

Configure Microsoft Entra B2B collaboration for guest users.

Question 8

You are the identity administrator for a multinational company using Microsoft Entra ID. The company has a Microsoft 365 E5 subscription. The security team wants to enforce the following requirements:

1. All users must use multi-factor authentication (MFA) when accessing sensitive applications (e.g., finance app).
2. Users from the IT department must use passwordless authentication methods (e.g., Windows Hello for Business) when accessing any resource.
3. All access to sensitive applications must be logged and monitored for anomalous activity.
4. Guest users from partner organizations must be automatically reviewed quarterly to ensure they still need access.
5. The company wants to minimize administrative overhead by automating as much as possible.

You need to design a solution that meets these requirements using Microsoft Entra ID capabilities. Which combination of actions should you take?

Accepted Answer

Create Conditional Access policies: one requiring MFA for the finance app, another requiring passwordless authentication strength for IT. Enable Microsoft Entra ID Protection to log and monitor sign-in risks. Create an access review for guest users.. It uses Conditional Access policies to enforce MFA for the finance app and passwordless authentication strength for IT, meeting requirements 1 and 2. Microsoft Entra ID Protection logs and monitors sign-in risks for sensitive apps (requirement 3), and an access review for guest users automates quarterly reviews (requirement 4). This minimizes administrative overhead by leveraging automation, aligning with requirement 5.

Answer

Configure Self-Service Password Reset (SSPR) for all users. Enable Microsoft Entra ID Protection. Create an access review for guests.

Answer

Use Microsoft Entra ID Protection to enforce MFA based on risk. Implement Privileged Identity Management (PIM) for IT. Configure access reviews for guests.

Answer

Enable security defaults to enforce MFA for all users. Configure Microsoft Entra ID Protection to monitor anomalies. Use Microsoft Entra ID Governance to automate guest access reviews.

Question 9

Your organization uses Microsoft Sentinel to detect threats. A security analyst needs to create a custom analytics rule that triggers an incident when a user accesses more than 1000 files from an external IP address within 5 minutes. Which rule type should the analyst configure?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows the analyst to define a custom KQL query that counts file access events from external IPs and triggers an incident when the threshold of 1000 files within 5 minutes is exceeded. This rule type supports aggregation, time windows, and custom thresholds, making it ideal for detecting specific behavioral patterns like high-volume access from external sources.

Answer

Fusion rule

Answer

ML Behavior Analytics rule

Answer

Near-real-time (NRT) query rule

Question 10

An organization uses Microsoft Entra ID for identity management and wants to allow external partners to access their resources using their own corporate credentials. Which feature should they enable?

Accepted Answer

Entra External ID. Entra External ID (formerly Azure AD B2B) enables organizations to invite external partners to access resources using their own corporate credentials. This feature leverages federation protocols such as SAML, WS-Fed, or OpenID Connect to authenticate the partner's identity in their home tenant, eliminating the need for separate local accounts.

Answer

Identity Protection

Answer

Conditional Access

Answer

Privileged Identity Management

Question 11

A company deploys Microsoft Entra ID Protection. The security team wants to automatically block sign-ins from anonymous IP addresses. They configure a Conditional Access policy. Which assignment condition should they use?

Accepted Answer

Sign-in risk level condition with 'High'. C is correct because the sign-in risk level condition in Conditional Access allows you to target sign-ins that have been assessed by Microsoft Entra ID Protection as risky. Anonymous IP addresses are a specific sign-in risk detection, and configuring the policy to block sign-ins with a 'High' sign-in risk level will automatically block those sign-ins. This directly addresses the security team's requirement to block sign-ins from anonymous IP addresses.

Answer

User risk level condition with 'Medium'

Answer

Device condition with 'Compliant'

Answer

Location condition with 'Any IP'

Question 12

Your organization uses Microsoft Defender for Cloud Apps. A security analyst notices anomalous file downloads from a SharePoint site by a user flagged as high risk. What should the analyst configure to automatically block such activity?

Accepted Answer

Configure a session policy. Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user activities based on risk level. When a user is flagged as high risk, a session policy can be configured to automatically block anomalous file downloads from SharePoint by intercepting the session and applying actions such as block, allow, or restrict. This is the correct choice because it directly addresses the need to prevent the specific activity in real time.

Answer

Configure a file policy

Answer

Configure an access policy

Answer

Configure an app permission policy

Question 13

A company uses Microsoft 365 and wants to protect against sophisticated phishing attacks that use malicious links in email. They also want real-time analysis of URLs at the time of click. Which Microsoft Defender for Office 365 feature provides this?

Accepted Answer

Safe Links. Safe Links is the correct answer because it provides URL scanning and real-time click-time verification of links in email messages and Office documents. When a user clicks a link, Defender for Office 365 checks the URL against a dynamic list of known malicious sites and performs a real-time analysis to determine if the link is safe at that moment, protecting against sophisticated phishing attacks that use malicious links.

Answer

Safe Attachments

Answer

Anti-spam

Answer

Anti-malware

Question 14

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically trigger a playbook when a high-severity incident is created. Which automation option should be used?

Accepted Answer

Automation rule in Microsoft Sentinel. Microsoft Sentinel automation rules are specifically designed to trigger automated responses—such as running playbooks—based on incident creation or update conditions, including severity level. When a high-severity incident is created, an automation rule can invoke a playbook without requiring manual intervention or external orchestration.

Answer

Azure Policy assignment

Answer

Microsoft Power Automate flow directly from Sentinel

Answer

Azure Logic Apps HTTP trigger

Question 15

A company needs to ensure that only approved devices can access corporate resources. Which Microsoft Entra feature should they combine with Microsoft Intune?

Accepted Answer

Conditional Access. Conditional Access is the Microsoft Entra feature that enforces policies to grant or block access based on conditions such as device compliance. When combined with Microsoft Intune, which manages device compliance policies (e.g., requiring encryption, a specific OS version, or a healthy device health attestation), Conditional Access can block access from non-compliant or unapproved devices. This integration ensures that only devices marked as compliant by Intune can access corporate resources.

Answer

Application Proxy

Answer

Identity Protection

Answer

Privileged Identity Management