SC-900 Practice Test 46 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID P1. You need to implement a solution that allows users to reset their own passwords without administrator intervention. The solution must also enforce a policy that requires users to verify their identity with two methods before resetting. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable self-service password reset (SSPR) and configure the number of methods required to reset to 2.. Self-service password reset (SSPR) in Microsoft Entra ID P1 allows users to reset their own passwords without administrator intervention. By configuring SSPR and setting the number of methods required to reset to 2, you enforce the policy that users must verify their identity with two authentication methods before resetting their password.

Answer

Configure Privileged Identity Management (PIM) to require approval for password reset.

Answer

Create an Identity Protection user risk policy to force password reset.

Answer

Configure a Conditional Access policy to require MFA for password changes.

Question 2

Your organization uses Microsoft Intune for mobile device management. You need to ensure that users cannot copy corporate data from managed apps to personal apps. Which policy should you configure?

Accepted Answer

App Protection Policy. App Protection Policies (APP) in Microsoft Intune are designed to manage how data is handled within applications, regardless of device enrollment. By configuring a 'Save as' or 'Copy/paste' restriction between managed and unmanaged apps, you can prevent corporate data from being transferred to personal apps. This policy operates at the app layer, not the device layer, making it the correct choice for this data leakage scenario.

Answer

App Configuration Policy

Answer

Device Compliance Policy

Answer

Conditional Access Policy

Question 3

Your organization uses Microsoft Entra ID P1. You need to implement a solution that allows users to reset their own passwords without administrator intervention. The solution must also enforce a policy that requires users to verify their identity with two methods before resetting. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is the correct integration because it provides Cloud Access Security Broker (CASB) functionality, enabling session policies via reverse proxy to control user actions like blocking downloads from unmanaged devices. These policies are enforced in real-time by inspecting and modifying traffic to cloud apps based on device compliance signals from Microsoft Entra ID.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 4

Refer to the exhibit. You run the cmdlet and get a list of risk detections. What does this cmdlet retrieve?

Accepted Answer

Risk detections for the unfamiliar sign-in properties risk event type. The cmdlet `Get-MgRiskDetection` retrieves all risk detections in the tenant, but when combined with the `-Filter` parameter for `riskEventType eq 'unfamiliarSigninProperties'`, it specifically returns only those risk detections that match the unfamiliar sign-in properties risk event type. This is because the cmdlet supports filtering by the `riskEventType` property, which corresponds to the type of risk detection as defined by Microsoft Entra ID Protection.

Answer

Users who have been flagged for risky sign-ins

Answer

All risk detections in the tenant

Answer

All sign-in logs with unfamiliar properties

Question 5

Refer to the exhibit. A user reports being unable to access Exchange Online from their personal laptop. The sign-in log shows failure due to device non-compliance. What should you configure to allow access while maintaining security?

Accepted Answer

Create a Conditional Access policy requiring compliant device. The sign-in log indicates the failure is due to device non-compliance, meaning the user's personal laptop does not meet your organization's compliance policies (e.g., missing antivirus, encryption, or required updates). Creating a Conditional Access policy that requires a compliant device will block access from non-compliant devices while allowing access from compliant ones, maintaining security by enforcing device health checks before granting access to Exchange Online.

Answer

Reset the user's password

Answer

Block all personal devices

Answer

Enable MFA for the user

Question 6

A company deploys full disk encryption on all employee laptops to protect data in case a device is lost or stolen. Which security goal does this measure primarily address?

Accepted Answer

Confidentiality. Full disk encryption (FDE) ensures that data stored on the laptop's hard drive is unreadable without the correct decryption key. This directly protects the confidentiality of the data by preventing unauthorized access if the device is lost or stolen, as the encrypted data cannot be deciphered without the key.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 7

Refer to the exhibit. You are reviewing a Microsoft Purview sensitivity label configuration. A user reports that a document containing a sensitive info type with confidence 80 was not automatically labeled. What is the most likely cause?

Accepted Answer

The auto-labeling policy is not configured to apply this label.. Auto-labeling in Microsoft Purview requires a specific auto-labeling policy to be configured and published to the user or location. Even if a sensitivity label exists and a sensitive info type (SIT) is detected with high confidence, the label will not be applied automatically unless an auto-labeling policy is explicitly set to apply that label to documents matching the SIT. The user's report indicates the label was not applied, which points to the policy not being configured, not a user override or encryption issue.

Answer

The user has overridden the label application.

Answer

The encryption is disabled.

Answer

The encryption template ID is missing.

Question 8

A security analyst downloads a software installer from a vendor's website. To ensure the file has not been tampered with during transmission, the analyst compares the SHA-256 hash of the downloaded file against the hash published on the vendor's official site. This practice primarily validates which security goal?

Accepted Answer

Integrity. Comparing the SHA-256 hash of the downloaded installer against the vendor's published hash verifies that the file has not been altered during transmission. This directly validates integrity, which ensures data remains unchanged from its original source. Hashing is a one-way cryptographic function; any change in the file, even a single bit, produces a completely different hash value, making tampering detectable.

Answer

Confidentiality

Answer

Availability

Answer

Authentication

Question 9

An organization wants to implement a zero-trust security model. They plan to require multi-factor authentication (MFA) for all users accessing sensitive applications, but only when the sign-in risk is medium or higher. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra ID Conditional Access policy with risk condition. B is correct because Microsoft Entra ID Conditional Access policies allow administrators to enforce MFA based on sign-in risk level, which is evaluated by Microsoft Entra ID Protection. By configuring a policy with a risk condition (e.g., medium or higher), the organization can require MFA only when the sign-in risk meets that threshold, aligning with a zero-trust model that grants access based on real-time risk assessment rather than a static rule.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Defender for Cloud Apps access policy

Answer

Microsoft Entra ID Protection risk detection policy

Question 10

An attacker gains access to a company's email system and reads confidential customer emails. Which security principle has been compromised?

Accepted Answer

Confidentiality. Confidentiality is the security principle that ensures data is accessible only to authorized users. When an attacker reads confidential customer emails without authorization, the confidentiality of that data has been breached, as the information was exposed to an unintended party.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 11

Your organization wants to protect sensitive documents from being copied to unauthorized cloud services. Which Microsoft Purview capability should you use?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers or health records—when users attempt to copy or share it with unauthorized cloud services like personal OneDrive or third-party storage apps. By scanning content in transit and applying actions like blocking the action or encrypting the data, DLP directly addresses the requirement to prevent data exfiltration to unauthorized cloud destinations.

Answer

Audit log

Answer

Retention policy

Answer

Sensitivity label

Question 12

Your organization uses Microsoft Entra ID and wants to enforce multi-factor authentication (MFA) for all users. Which policy should you create?

Accepted Answer

Conditional Access policy. Conditional Access policies are the correct mechanism to enforce MFA for all users because they allow granular, policy-driven access controls based on signals like user, location, device, and application. By creating a Conditional Access policy that requires MFA for all cloud apps, you can target all users and enforce MFA at authentication time, providing a flexible and scalable solution.

Answer

Identity Protection policy

Answer

Security defaults

Answer

Privileged Identity Management

Question 13

A company uses Microsoft Entra ID. Employees often forget their passwords and contact the IT helpdesk to reset them. The company wants to reduce helpdesk costs by allowing users to reset their own passwords using a verified mobile phone number or email address. Which Microsoft Entra ID feature should the administrator enable?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the correct feature because it allows users to reset their own passwords without helpdesk intervention, using a verified mobile phone number or email address as authentication methods. This directly reduces helpdesk costs by shifting password reset responsibility to the user, while maintaining security through verification of registered contact methods.

Answer

Microsoft Entra ID Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Question 14

Refer to the exhibit. You are deploying a custom assessment automation in Microsoft Defender for Cloud using Bicep. The deployment fails with an error that the resource type is not valid. What is the most likely reason?

Accepted Answer

The property 'supportedCloud' should be 'supportedClouds' as an array.. In Bicep for Microsoft Defender for Cloud custom assessments, the property that defines which cloud environments the assessment applies to must be named 'supportedClouds' and must be an array of strings (e.g., ['Azure', 'AWS', 'GCP']). Using the singular 'supportedCloud' is invalid syntax and causes the deployment to fail with a resource type validation error.

Answer

The API version is not supported.

Answer

The name property is missing.

Answer

The resource type is misspelled.

Question 15

Your organization wants to protect against phishing attacks by verifying the sender's identity for incoming emails. Which Microsoft Defender for Office 365 feature should you configure?

Accepted Answer

Anti-phishing policy with SPF/DKIM/DMARC settings. The anti-phishing policy in Microsoft Defender for Office 365 includes sender verification settings that leverage SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance). These protocols authenticate the sender's domain and verify that the email originated from an authorized server, directly addressing the requirement to protect against phishing by verifying sender identity.

Answer

Anti-malware policy

Answer

Safe Links policy

Answer

Safe Attachments policy