SC-900 Practice Test 48 — 15 Questions

Question 1

A company configures its access control system so that each user can only access the data and perform actions that are strictly necessary for their job role. This configuration is a direct implementation of which security principle?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Least privilege. The configuration described—granting each user only the access and actions strictly necessary for their job role—is the direct definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required permissions via Azure RBAC roles (e.g., Reader instead of Contributor) or using Microsoft Entra Privileged Identity Management (PIM) for just-in-time access. This minimizes the attack surface by ensuring users cannot exceed their authorized scope.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero Trust

Question 2

A financial services firm is required by regulatory bodies to monitor employee communications (email, Teams chats) for potential insider trading or market manipulation. They need a solution that allows them to define policies to detect messages containing specific keywords or phrases (e.g., 'confidential', 'insider info'), and then assign flagged messages to designated reviewers for investigation. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect policy violations in employee communications, such as email and Teams chats, by scanning for sensitive keywords or phrases like 'confidential' or 'insider info'. It then automatically flags and routes these messages to designated reviewers for investigation, directly meeting the regulatory requirement for monitoring potential insider trading or market manipulation.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview eDiscovery (Standard or Premium)

Answer

Microsoft Purview Audit (Standard or Premium)

Question 3

Which THREE are features of Microsoft Entra ID Protection? (Choose THREE.)

Accepted Answer

Sign-in risk detection. Microsoft Entra ID Protection is specifically designed to detect, investigate, and remediate identity-based risks, so option B (Sign-in risk detection) is correct because it evaluates each sign-in attempt in real time and flags events such as anonymous IP usage, atypical travel, or malware-linked IP addresses as low, medium, or high risk. Option C (Detection of leaked credentials) is correct because ID Protection scans for compromised username/password pairs exposed on the dark web or paste sites and surfaces them as 'leaked credentials' user-risk detections. Option D (Risk-based conditional access) is correct because ID Protection feeds its sign-in risk and user risk signals into Conditional Access policies, allowing administrators to require MFA, password change, or block access when risk is elevated. Option A (Privileged role management) is not a feature of ID Protection; privileged identity management is delivered by Microsoft Entra Privileged Identity Management (PIM), which handles just-in-time role activation and approvals. Option E (Identity governance) is also not part of ID Protection; identity governance capabilities such as access reviews, entitlement management, and lifecycle workflows belong to Microsoft Entra ID Governance.

Answer

Privileged role management

Answer

Identity governance

Question 4

A security team needs to detect and automatically respond to ransomware attacks on Windows servers and desktops. They require the solution to automatically isolate affected devices from the network and, if necessary, roll back files that have been modified by ransomware using a built-in recovery feature. Which Microsoft security solution provides these specific capabilities?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) provides automated investigation and remediation capabilities that include network containment (isolating a device from the network) and rollback of files modified by ransomware using its built-in recovery feature. This is achieved through MDE's endpoint detection and response (EDR) and automated investigation capabilities, which can trigger device isolation and file restoration from Volume Shadow Copy or MDE's own rollback mechanism.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Question 5

Your organization is planning to use Microsoft Sentinel as a SIEM solution. Which TWO of the following are required components for Sentinel? (Select TWO.)

Accepted Answer

A Log Analytics workspace. Microsoft Sentinel is built on top of Azure Monitor Logs, so option A, a Log Analytics workspace, is required because it is the underlying data store where all ingested security events, alerts, and incidents are collected, queried with KQL, and retained. Option C, data connectors to ingest security data, is also required because Sentinel must receive telemetry from sources such as Microsoft 365 Defender, Azure Activity, AWS, or syslog before analytics rules, incidents, or hunting queries can operate on that data. Playbooks (B) are optional SOAR components used for automated response, workbooks (D) are optional visualization tools for dashboards, and KQL queries (E) are used within analytics rules or hunting but are not a separate required deployment component beyond the workspace and ingestion path.

Answer

A playbook for automated response

Answer

A workbook for dashboards

Answer

A KQL query for threat detection

Question 6

A company uses Microsoft Entra ID and has multiple departments with separate organizational units (OUs) in its on-premises Active Directory. The help desk team needs to be able to reset passwords for users only in the Finance department. What feature should be used to delegate this administrative scope?

Accepted Answer

Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions over a subset of users, groups, or devices without granting broader tenant-wide access. By creating an AU for the Finance department and assigning the Helpdesk Administrator role scoped to that AU, the help desk team can reset passwords only for Finance users, matching the on-premises OU structure.

Answer

Dynamic groups

Answer

Conditional Access policies

Answer

Privileged Identity Management (PIM)

Question 7

Which TWO of the following are required to use Microsoft Purview Audit (Premium)?

Accepted Answer

Unified audit log enabled in the Microsoft 365 Defender portal. Option A is correct because Microsoft Purview Audit (Premium) builds on the unified audit log, so auditing must first be turned on in the Microsoft 365 Defender portal (or via Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true) before premium features such as longer retention and high-value events can be captured. Option B is correct because Audit (Premium) capabilities are licensed through Microsoft 365 E5/A5 (or the E5/A5 Compliance add-on) assigned to each user whose premium audit data is generated. Option C is not required because audit records are stored in Microsoft's service, not in a customer Azure subscription. Option D is not required because Power BI Pro is unrelated to audit ingestion or retention. Option E is not required because Microsoft Sentinel is a separate SIEM product and is not a prerequisite for Audit (Premium).

Answer

An Azure subscription for log storage

Answer

Power BI Pro licenses for all users

Answer

Microsoft Sentinel enabled

Question 8

Which THREE are benefits of using Microsoft Entra ID as an identity provider? (Choose three.)

Accepted Answer

Conditional Access policies. Option B (Conditional Access policies) is correct because Microsoft Entra ID provides a policy engine that evaluates signals such as user, device, location, and risk to enforce access controls like requiring MFA or blocking access, which is a core identity-provider benefit. Option D (Multifactor authentication) is correct because Entra ID natively supports MFA methods (Microsoft Authenticator, FIDO2 keys, SMS/voice, OATH tokens) and can enforce them through security defaults or Conditional Access. Option E (Single sign-on to thousands of cloud apps) is correct because Entra ID acts as an IdP using protocols like SAML 2.0, WS-Federation, OpenID Connect, and OAuth 2.0, with a gallery of thousands of pre-integrated SaaS applications for SSO. Option A (Web application hosting) is not a benefit of an identity provider, since hosting compute and web content is the role of services like Azure App Service or IIS, not Entra ID. Option C (Centralized database management) is also unrelated, as Entra ID stores identity objects (users, groups, app registrations) but does not provide general-purpose database management like Azure SQL Database or SQL Server.

Answer

Web application hosting

Answer

Centralized database management

Question 9

A company uses Microsoft Entra ID. They want to enforce multifactor authentication (MFA) for all access to a sensitive HR application. However, they only want to require MFA when the sign-in risk is assessed as medium or high, and block access if the risk is high. Which Conditional Access components must the administrator configure to meet these requirements? (Choose the best answer)

Accepted Answer

Conditions (Sign-in risk) and Grant controls (Require multifactor authentication, Block access). The scenario requires evaluating sign-in risk as a condition, which is configured under Conditions (Sign-in risk) in Conditional Access. The Grant controls then enforce 'Require multifactor authentication' for medium/high risk and 'Block access' for high risk, directly matching the requirements.

Answer

Assignments (Users and cloud apps) and Session controls (Sign-in frequency)

Answer

Conditions (Device platforms) and Grant controls (Require approved client app)

Answer

Grant controls (Require multifactor authentication) and Session controls (Application enforce restrictions)

Question 10

A company uses Microsoft Entra ID and wants to enforce multi-factor authentication (MFA) only for external guest users, while allowing internal employees to sign in without MFA. Which Conditional Access setting should be configured?

Accepted Answer

Target the 'Guest or external users' identity type. Conditional Access allows targeting the 'Guest or external users' identity type, which enables MFA enforcement exclusively for external guest users without affecting internal employees. This setting leverages the user type attribute in Microsoft Entra ID to differentiate between internal and external identities, providing granular control over authentication requirements.

Answer

Require MFA for all users

Answer

Exclude internal users by group

Answer

Use Identity Protection's user risk policy

Question 11

You are the identity administrator for Contoso Ltd., a global company with over 10,000 employees. The company uses Microsoft Entra ID P2 and Microsoft Intune. Employees use both company-owned and personal devices. The security team requires that all access to corporate applications be protected with multifactor authentication (MFA). However, to minimize user friction, they want to exempt MFA for users who are on the corporate network and using compliant devices. Additionally, for users with privileged roles (e.g., Global Administrator), MFA must always be required regardless of location or device. You need to configure a Conditional Access policy to meet these requirements. Which of the following approaches should you take?

Accepted Answer

Create two Conditional Access policies: Policy 1 targets all users except privileged roles, requires MFA, and excludes trusted locations and compliant devices. Policy 2 targets privileged roles and requires MFA with no exclusions.. It uses two separate Conditional Access policies to handle the two distinct user groups. Policy 1 targets all users except privileged roles, requires MFA, and excludes trusted locations and compliant devices, which satisfies the requirement to minimize friction for users on the corporate network with compliant devices. Policy 2 targets privileged roles and requires MFA with no exclusions, ensuring that Global Administrators and other privileged role members always must perform MFA regardless of location or device compliance.

Answer

Create one Conditional Access policy that targets all users and requires MFA. Create a second policy that targets privileged roles and excludes trusted locations.

Answer

Create one Conditional Access policy that targets all users, requires MFA, and excludes trusted locations and compliant devices. Do not create any additional policies.

Answer

Create one Conditional Access policy that targets all users and requires MFA. Use Microsoft Intune compliance policies to exempt compliant devices from MFA.

Question 12

A multinational company uses Microsoft Entra ID. They want to ensure that users from a specific country only access a sensitive application from compliant devices. Additionally, they want to block access if the sign-in risk is medium or high. Which combination of policies should they create?

Accepted Answer

A Conditional Access policy with conditions for location, device compliance, and sign-in risk. A single Conditional Access policy can combine multiple conditions—such as location (country), device compliance (via integration with Intune), and sign-in risk—to enforce granular access controls. This allows the company to require compliant devices and block access when sign-in risk is medium or high, all within one policy.

Answer

A Conditional Access session policy to enforce sign-in frequency

Answer

A device compliance policy in Microsoft Intune

Answer

A Conditional Access policy requiring MFA from that country

Question 13

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers in emails to external recipients. Which DLP rule action should you configure?

Accepted Answer

Block the message from being sent. Microsoft Purview DLP allows you to configure rule actions that enforce protective measures. When you need to prevent users from sharing credit card numbers in emails to external recipients, the 'Block the message from being sent' action stops the email from being delivered, ensuring the sensitive data is not leaked. This action can be combined with a notification or override option, but the core enforcement is blocking the message.

Answer

Audit the activity only

Answer

Allow the message but notify the user

Answer

Allow the message with a policy tip

Question 14

An organization uses Microsoft Entra ID for identity management. They want to implement a risk-based conditional access policy that requires multi-factor authentication (MFA) when sign-in risk is medium or high. Which policy settings should they configure?

Accepted Answer

Assign 'Sign-in risk' condition to 'Medium and above' and grant 'Require MFA'. The scenario explicitly requires a risk-based conditional access policy that triggers MFA based on sign-in risk level. In Microsoft Entra ID, the 'Sign-in risk' condition evaluates the likelihood that the authentication attempt is not legitimate, using signals such as anonymous IP addresses, atypical travel, or malware-linked IPs. By setting this condition to 'Medium and above' and granting 'Require MFA', the policy enforces MFA only when the sign-in risk is assessed as medium or high, directly matching the requirement.

Answer

Assign 'User risk' condition to 'Medium and above' and grant 'Require MFA'

Answer

Assign 'Device compliance' condition to 'Compliant' and grant 'Require MFA'

Answer

Assign 'Location' condition to 'All trusted locations' and grant 'Require MFA'

Question 15

A financial organization implements a security control that logs every access attempt to sensitive financial records, including who accessed the data, when it was accessed, and from which device. The logs are regularly reviewed by the security team. This control primarily addresses which security concept?

Accepted Answer

Accountability. Accountability ensures that actions affecting sensitive data can be traced uniquely to an individual. By logging who accessed the data, when, and from which device, the organization creates an audit trail that holds users responsible for their actions. This directly supports non-repudiation and forensic analysis, which are the core goals of accountability.

Answer

Confidentiality

Answer

Integrity

Answer

Availability