SC-900 Practice Test 46 — 15 Questions

Question 1

An organization uses Microsoft Defender for Cloud to secure its Azure workloads. They want to receive recommendations for improving the security posture of their virtual machines. What should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM). Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) provides continuous assessment of Azure workloads, including virtual machines, against security baselines and best practices. It generates actionable recommendations to improve the security posture, such as applying missing system updates or enabling encryption. This is the correct feature for receiving VM-specific security recommendations.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Answer

Azure Policy

Question 2

Your organization uses Microsoft Entra ID P2 licenses. You need to implement a process to automatically remove users from a group if they have not signed in for 90 days. Which feature should you use?

Accepted Answer

Access reviews in Identity Governance. Access reviews in Identity Governance allow you to automate the review and removal of group memberships based on inactivity criteria, such as users who haven't signed in for 90 days. This feature is specifically designed for periodic attestation and lifecycle management of group memberships, leveraging Microsoft Entra ID P2 licenses.

Answer

Conditional Access policy

Answer

Privileged Identity Management

Answer

Microsoft Entra ID Protection

Question 3

Which TWO of the following are included in Microsoft Entra ID Protection?

Accepted Answer

Risk-based Conditional Access policies. Option C (Risk-based Conditional Access policies) is correct because Microsoft Entra ID Protection surfaces user and sign-in risk levels that can be consumed directly by Conditional Access as conditions, allowing policies to block access or require MFA/password change when risk is detected. Option D (Sign-in risk detections such as anonymous IP address) is correct because ID Protection natively detects and reports sign-in risks like anonymous IP, atypical travel, malware-linked IP, and unfamiliar sign-in properties, and these detections feed the risk evaluations used by the service. Options A, B, and E are not part of ID Protection: DLP is a Microsoft Purview/Defender for Cloud Apps capability, PIM is a separate Microsoft Entra ID Governance/Privileged Identity Management service for just-in-time role activation, and passwordless authentication (FIDO2, Windows Hello, Authenticator) is a Microsoft Entra authentication method feature rather than an ID Protection component.

Answer

Data loss prevention (DLP)

Answer

Privileged Identity Management (PIM)

Answer

Passwordless authentication support

Question 4

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps?

Accepted Answer

Cloud Discovery to identify shadow IT. Microsoft Defender for Cloud Apps provides Cloud Discovery (option B), which analyzes traffic logs from firewalls and proxies to detect and identify shadow IT and unsanctioned cloud apps in use across the organization. It also provides data loss prevention for cloud apps (option C) through its DLP policies and session controls, which can detect and block sensitive data sharing in sanctioned SaaS apps via Conditional Access App Control. Email security (option A) is delivered by Microsoft Defender for Office 365, not Defender for Cloud Apps. Endpoint detection and response (option D) is a capability of Microsoft Defender for Endpoint. Identity protection (option E) is provided by Microsoft Entra ID Protection, not Defender for Cloud Apps.

Answer

Email security

Answer

Endpoint detection and response

Answer

Identity protection

Question 5

Your company uses Microsoft Entra ID with P1 licenses. You need to implement a policy that blocks access to Microsoft 365 from countries that are not authorized, except for users who are members of a specific security group. Which Microsoft Entra feature should you use?

Accepted Answer

Conditional Access policy with location condition and group exclusion.. D is correct because Conditional Access policies in Microsoft Entra ID allow you to define access controls based on location conditions, such as blocking access from specific countries. You can then exclude a security group from the block, ensuring that members of that group can still access Microsoft 365 from unauthorized countries. This directly meets the requirement of blocking access except for users in a specific group.

Answer

Microsoft Entra Identity Protection.

Answer

Microsoft Entra entitlement management.

Answer

Microsoft Entra B2B collaboration.

Question 6

Refer to the exhibit. The JSON shows a Conditional Access policy. What is the primary purpose of this policy?

Accepted Answer

Block legacy authentication protocols. The policy targets 'Block legacy authentication' by applying a condition that blocks authentication attempts using legacy protocols (e.g., POP3, IMAP4, SMTP, ActiveSync) which do not support modern authentication methods like MFA. This is a common security measure to prevent credential-stuffing and password-spray attacks that exploit the lack of MFA enforcement in legacy protocols.

Answer

Require MFA for all applications

Answer

Disable the policy for emergency access

Answer

Allow only iOS devices

Question 7

Which THREE of the following are features of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Provide policy tips to users. Option A is correct because Microsoft Purview DLP can display policy tips to users in supported workloads (for example, Outlook and Office apps) to warn them when they are about to share content that matches a DLP rule, helping them make informed decisions before sending or sharing. Option B is correct because DLP is designed to detect sensitive information types (such as credit card numbers, national ID numbers, or custom regex/keyword patterns) in Exchange Online email messages and take policy actions like block, encrypt, or notify. Option E is correct because Purview DLP supports endpoint DLP, which monitors sensitive data activities on onboarded Windows and macOS devices, including copying to USB, printing, and uploading to cloud services. Option C is not a DLP feature but a capability of Microsoft Purview Information Protection sensitivity labels, which can be auto-applied via label policies or client-side auto-labeling. Option D is not a DLP feature but a retention capability provided by Microsoft Purview Data Lifecycle Management retention policies and retention labels.

Answer

Apply sensitivity labels automatically

Answer

Retain data for a specified period

Question 8

Refer to the exhibit. You are reviewing a Conditional Access policy JSON in Microsoft Entra ID. What will this policy do?

Accepted Answer

Block access when user risk is high. The policy JSON specifies `"userRiskLevels": ["high"]` and `"builtInControls": ["block"]`, meaning it blocks access when the user risk level is high. User risk reflects the likelihood that the user's identity is compromised, based on Microsoft's risk detection signals. Option D correctly identifies this behavior.

Answer

Block access when user risk is medium or high

Answer

Block sign-ins when sign-in risk is high

Answer

Require MFA when user risk is high

Question 9

Your organization is using Microsoft Entra Permissions Management (CIEM). You need to identify overprivileged identities in AWS. Which capability should you use?

Accepted Answer

Permissions Analytics Report. Permissions Analytics Report is the correct capability because it specifically analyzes permissions across AWS, Azure, and GCP to identify overprivileged identities, unused permissions, and risky actions. It generates a detailed report that highlights identities with excessive permissions, enabling remediation to enforce least privilege. This aligns directly with the CIEM (Cloud Infrastructure Entitlement Management) goal of reducing privilege risks.

Answer

Audit trail

Answer

Identity governance

Answer

Activity trail

Question 10

Refer to the exhibit. You are reviewing a Microsoft Purview classification rule. The rule is enabled and set to apply a sensitivity label. However, you notice that documents containing EU personal data are not being labeled automatically. What is the most likely cause?

Accepted Answer

The rule does not include a condition to detect sensitive data. The rule is enabled and applies a sensitivity label, but documents containing EU personal data are not being labeled automatically. For automatic labeling to occur, the classification rule must include a condition that detects sensitive data types (e.g., EU passport numbers or GDPR-defined personal data). Without such a condition, the rule has no trigger to identify the content and apply the label, even if the rule is active and scoped correctly.

Answer

The label ID is invalid

Answer

The rule status is Disabled

Answer

The rule is not scoped to SharePoint Online

Question 11

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender for Endpoint. The SOC team needs to decode the PowerShell command to understand the malicious intent. Which tool or method should they use?

Accepted Answer

Decode the Base64 string using a built-in decoder or online tool. The exhibit shows a PowerShell command encoded in Base64, which is a common obfuscation technique used by attackers to hide malicious intent. Decoding the Base64 string using a built-in decoder (e.g., `[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String()`) or an online tool directly reveals the plaintext command. This is the correct approach because Base64 is not encryption—it is an encoding scheme that can be reversed without any keys.

Answer

Search for the SHA256 hash in threat intelligence feeds

Answer

Decrypt the command using the device's decryption keys

Answer

Use PowerShell script block logging to capture the decoded command

Question 12

Which TWO Microsoft Purview solutions can be used to discover and classify sensitive data in Microsoft 365? (Select two.)

Accepted Answer

Information Protection. Information Protection (option B) provides the ability to discover, classify, and protect sensitive data across Microsoft 365 by using trainable classifiers and content scanning. Data Classification (option E) offers a unified view of sensitive data across the tenant, including classification results from sensitivity labels and retention labels, enabling administrators to identify and monitor sensitive information at scale.

Answer

Data Loss Prevention

Answer

Sensitivity labels

Answer

Audit

Question 13

Refer to the exhibit. An administrator runs this KQL query in Microsoft Purview Audit. What is the purpose of this query?

Accepted Answer

To identify file types that a specific user uploaded more than 10 times in the last 30 days. The KQL query uses `| summarize Count = count() by FileType` to group audit log entries by file type, then `| where Count > 10` filters for file types that appear more than 10 times. The `where UserId == 'user@domain.com'` restricts the results to a specific user, and `| where TimeGenerated > ago(30d)` limits the time range to the last 30 days. This directly identifies file types uploaded more than 10 times by that user, matching option D.

Answer

To find the total number of file uploads by all users in the last 30 days

Answer

To find files larger than a certain size uploaded by a specific user

Answer

To list all files deleted by a specific user in the last 30 days

Question 14

Refer to the exhibit. You are reviewing the results of a Microsoft Purview eDiscovery search. Which statement is correct about the search results?

Accepted Answer

The search returned results from both Exchange Online and SharePoint Online. The search results show items from both Exchange Online (email messages) and SharePoint Online (documents), as indicated by the 'Location' column listing both 'Exchange Online' and 'SharePoint Online' sources. This confirms that the eDiscovery search was configured to search across multiple workloads, returning results from both platforms.

Answer

The search only returned results from Exchange Online

Answer

The document is an email message

Answer

The email has an attachment

Question 15

Which TWO Microsoft Entra features can help protect against credential attacks?

Accepted Answer

Microsoft Entra password protection. Microsoft Entra password protection (C) helps defend against credential attacks by automatically blocking weak passwords and common variations of known compromised passwords, such as those from botnets or public password lists. Smart lockout (E) protects against brute-force attacks by locking an account after a configurable number of failed sign-in attempts, using intelligent heuristics to distinguish between legitimate users and attackers. Both features directly mitigate password-based attacks like password spraying and brute force.

Answer

Microsoft Entra Connect

Answer

Self-service password reset

Answer

Access reviews