SC-900 Practice Test 48 — 15 Questions

Question 1

Your organization is using Microsoft Entra ID with P2 licenses. You need to ensure that all guest users are reviewed for access quarterly, and if not approved, access is automatically removed. Which Microsoft Entra feature should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Access Reviews. Microsoft Entra Access Reviews (D) is the correct feature because it allows you to create recurring reviews for guest users, set the frequency to quarterly, and configure auto-apply settings to automatically remove access if the review is not approved. This directly meets the requirement for periodic attestation and automated remediation.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Entitlement Management

Question 2

The exhibit shows a sign-in failure for John Doe. The admin wants to allow the sign-in while still enforcing MFA. What should the admin do?

Accepted Answer

Modify the Conditional Access policy to exclude Azure PowerShell or to support MFA for this client.. The sign-in failure is likely caused by a Conditional Access policy that blocks legacy authentication protocols like Azure PowerShell, which do not support MFA natively. Option A is correct because modifying the policy to exclude Azure PowerShell or to require MFA for that client app allows the sign-in while still enforcing MFA for other protocols. This ensures the user can authenticate using a modern authentication flow that supports MFA.

Answer

Disable MFA for the user.

Answer

Assign a Microsoft Entra ID P2 license to the user.

Answer

Reset the user's password.

Question 3

You are analyzing sign-in logs in Microsoft Sentinel. Based on the KQL query in the exhibit, what is the purpose of this query?

Accepted Answer

Identify users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.. The KQL query filters sign-in logs for events where the 'ResultType' is '50057', which specifically indicates a sign-in attempt from a disabled account. It then groups by user and counts occurrences, using a 'where' clause to filter for users with more than 10 such attempts. Finally, it limits the results to the last 7 days via the time range filter in the query or the workspace time filter. This directly identifies users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.

Answer

Identify all sign-in attempts from a specific IP address.

Answer

Identify impossible travel activity across different locations.

Answer

Identify locations with the highest number of failed sign-ins.

Question 4

You are a security administrator for a company that uses Microsoft 365. The company has a Microsoft Purview Data Loss Prevention (DLP) policy that blocks sharing of Social Security Numbers (SSNs) externally. Recently, a user accidentally sent an email containing SSNs to an external partner after overriding the policy by selecting a business justification. Management wants to prevent users from overriding the policy for SSNs. You need to update the DLP policy to ensure that users cannot override the block for SSNs. What should you do?

Accepted Answer

Modify the rule to set 'Allow override' to 'No' in the policy tip configuration.. The 'Allow override' setting in the policy tip configuration directly controls whether users can bypass a DLP block action by providing a business justification. Setting this to 'No' prevents any override for the rule that blocks SSNs, ensuring that the block is enforced without exception. This is the specific mechanism in Microsoft Purview DLP to disable user overrides for a given rule.

Answer

Increase the rule priority to ensure it is enforced before other rules.

Answer

Remove the policy tip from the rule to prevent users from overriding.

Answer

Change the action from 'Block with override' to 'Block' and remove the policy tip.

Question 5

A company wants to ensure that only users with specific IP addresses can access its critical applications. Which Microsoft Entra feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to create policies that enforce access controls based on conditions such as IP address location. By configuring a Conditional Access policy with a 'Locations' condition that includes only trusted IP address ranges, the company can block or grant access to critical applications based on the user's network location. This directly meets the requirement to restrict access to specific IP addresses.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Self-Service Password Reset

Question 6

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the most likely purpose of this query?

Accepted Answer

To identify potential brute-force attack attempts. The query filters for Windows Event ID 4625 (failed logon) and then counts occurrences per account and source IP within a 5-minute window, keeping only those with more than 10 failures. This pattern is the classic signature of a brute-force attack, where an attacker attempts many passwords against the same account or from the same IP. Option D is correct because the query is specifically designed to identify potential brute-force attempts by aggregating failed logons.

Answer

To identify successful logins after multiple failures

Answer

To detect privilege escalation events

Answer

To detect accounts that have been locked out

Question 7

A company uses Microsoft Entra ID. The security team wants to automatically block sign-ins from IP addresses that exhibit brute-force attack patterns. Which capability should they enable?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct capability because it uses machine learning and heuristic detection to automatically identify and block sign-ins from IP addresses exhibiting brute-force attack patterns, such as repeated failed authentication attempts. It can trigger risk-based policies, including blocking access or requiring multi-factor authentication, without manual intervention. This directly addresses the security team's requirement to automate the response to brute-force patterns.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra External Identities

Answer

Microsoft Entra Conditional Access

Question 8

A company uses Exchange Online. The security team wants to protect users from malicious email attachments. They need a solution that detonates attachments in a sandbox environment to check for malware behavior before the email is delivered to the recipient. Which Microsoft Defender for Office 365 feature should they enable?

Accepted Answer

Safe Attachments. Safe Attachments is the correct feature because it specifically detonates email attachments in a virtual sandbox environment before delivery, analyzing behavior for malicious activity. This matches the requirement to check attachments for malware behavior prior to inbox arrival, a capability unique to Safe Attachments within Defender for Office 365.

Answer

Safe Links

Answer

Anti-phishing

Answer

Anti-spam

Question 9

Your company uses Microsoft Sentinel to centralize security event monitoring. You need to create a custom analytics rule that triggers an alert when a user account is created outside of business hours. Which rule type should you use?

Accepted Answer

Scheduled query analytics rule. A scheduled query analytics rule is the correct choice because it allows you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) and triggers an alert based on conditions such as user account creation events occurring outside of business hours. This rule type is designed for custom detection scenarios where you need to evaluate log data against specific time-based or threshold-based criteria, making it ideal for monitoring user creation events with a custom schedule.

Answer

Microsoft Security incident creation rule

Answer

Anomaly analytics rule

Answer

Near-real-time (NRT) analytics rule

Question 10

Your company wants to provide a single sign-on experience for all cloud applications. Which Microsoft Entra ID feature should you implement?

Accepted Answer

App registration and SSO configuration. App registration and SSO configuration in Microsoft Entra ID enables single sign-on (SSO) by registering each cloud application as an enterprise application and configuring federation protocols such as SAML 2.0, OpenID Connect, or OAuth 2.0. This allows users to authenticate once with their Entra ID credentials and access all configured cloud applications without repeated logins.

Answer

B2B collaboration

Answer

Identity Protection

Answer

Conditional Access

Question 11

Which Microsoft Purview solution should you use to automatically retain or delete content based on regulations?

Accepted Answer

Records Management. Records Management in Microsoft Purview provides policy-based retention and deletion labels that automatically enforce regulatory compliance requirements, such as GDPR or SOX. It uses retention labels and label policies to mark content for a specified duration, after which it is either retained, deleted, or reviewed via disposition review. This directly addresses the need to automatically retain or delete content based on regulations.

Answer

Communication Compliance

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Question 12

Your company is deploying Microsoft Defender for Cloud Apps. You need to detect and block the use of unsanctioned cloud apps that exhibit risky behavior. Which feature should you configure?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs to identify unsanctioned cloud apps and assess their risk based on behavioral factors such as data upload volume, user count, and security posture. Once identified, Defender for Cloud Apps can automatically block these apps using the built-in app governance controls, enforcing policies to prevent risky app usage.

Answer

Azure Information Protection labels

Answer

Conditional Access policies

Answer

Data Loss Prevention (DLP) policies

Question 13

Your company uses Microsoft Entra ID and is implementing a zero-trust security model. You need to ensure that all access requests to sensitive applications are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID capability should you use?

Accepted Answer

Conditional Access with session controls. Conditional Access with session controls enforces continuous access evaluation (CAE) by intercepting real-time signals—such as user risk, device compliance, or location changes—after the initial authentication. This ensures that access to sensitive applications is verified throughout the session, not just at sign-in, aligning with the zero-trust principle of 'verify explicitly and continuously.'

Answer

Access reviews

Answer

Microsoft Entra Identity Protection

Answer

Privileged Identity Management

Question 14

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows users to sign in using their social media accounts, such as Google or Facebook. What should you configure?

Accepted Answer

External identities (B2B) with social identity providers. External identities (B2B) in Microsoft Entra ID allow you to configure social identity providers (e.g., Google, Facebook) as federation sources. This enables users to sign in with their existing social accounts by leveraging OAuth 2.0 and OpenID Connect protocols, without needing to create a separate Microsoft account.

Answer

Microsoft Authenticator app for passwordless sign-in

Answer

Privileged Identity Management

Answer

Self-service password reset

Question 15

Your organization uses Microsoft Entra ID. You need to ensure that only users from the finance department can access a sensitive application, and they must be granted access dynamically based on their department attribute. What should you configure?

Accepted Answer

Create a dynamic group with rule: user.department -eq "Finance".. A dynamic group in Microsoft Entra ID automatically adds or removes members based on a rule, such as `user.department -eq "Finance"`. This ensures that only users whose department attribute equals "Finance" are granted access to the sensitive application, and membership updates dynamically as the attribute changes, without manual intervention.

Answer

Create an administrative unit for the finance department.

Answer

Enable self-service group management.

Answer

Configure entitlement management with an access package for the finance application.