SC-900 Practice Test 49 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs for a user. The user successfully signed in from a mobile device running iOS, located in the US, with medium risk level. The sign-in did not require MFA. You have a Conditional Access policy that requires MFA for all users when sign-in risk is medium or higher. Why was MFA not triggered?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Conditional Access policy may exclude 'Mobile Apps and Desktop clients' client apps.. The Conditional Access policy can be configured to exclude specific client apps, such as 'Mobile Apps and Desktop clients'. If the policy excludes these client apps, the sign-in from an iOS mobile device would not be subject to the MFA requirement, even though the sign-in risk is medium. The sign-in logs confirm MFA was not required, indicating the policy did not apply to this client app type.

Answer

The device is not compliant, so MFA was not required.

Answer

The sign-in risk level is medium, which is below the threshold.

Answer

The user is not assigned to the Conditional Access policy.

Question 2

Your company is deploying Microsoft Entra ID Governance. They want to automate the review of guest user access to Microsoft Teams and remove access when guests leave the partner organization. Which feature should they implement?

Accepted Answer

Access reviews and connected organizations. Access reviews in Microsoft Entra ID Governance allow you to create recurring reviews of guest user access to resources like Microsoft Teams. By configuring the review to include connected organizations, you can automatically remove guest access when the guest's identity is no longer associated with a partner organization, such as when they leave the partner company. This automation is achieved through the integration of access reviews with the connected organization's lifecycle, ensuring that guest access is revoked without manual intervention.

Answer

Entitlement management

Answer

Terms of use

Answer

Password policies

Question 3

Your organization is using Microsoft Defender for Cloud to secure a multi-cloud environment including Azure and AWS. You need to identify misconfigurations that could lead to security breaches. Which feature should you use?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is the correct feature because it continuously assesses your multi-cloud environment (Azure and AWS) against security best practices and compliance frameworks, identifying misconfigurations that could lead to security breaches. In Microsoft Defender for Cloud, CSPM provides a unified view of security posture across clouds, detecting issues like open ports, weak encryption, or excessive permissions without requiring agents. This directly addresses the need to find misconfigurations that attackers could exploit.

Answer

Cloud Workload Protection (CWP)

Answer

Regulatory compliance dashboard

Answer

Security score

Question 4

A company wants to automatically classify documents containing credit card numbers and apply encryption at rest in SharePoint Online. Which Microsoft Purview feature should be used?

Accepted Answer

Sensitivity labels with auto-classification. Sensitivity labels with auto-classification can automatically detect sensitive data types such as credit card numbers using built-in or custom sensitive info types, and then apply a label that enforces encryption at rest in SharePoint Online. This meets the requirement of both automatic classification and encryption enforcement without manual user intervention.

Answer

eDiscovery

Answer

Microsoft Purview Audit

Answer

Data Loss Prevention (DLP) policies

Question 5

Refer to the exhibit. You run an Advanced Hunting query in Microsoft Defender XDR. What is the primary purpose of this query?

Accepted Answer

Identify accounts with high number of interactive logons, potentially indicating brute-force activity.. The query uses `AADSignInEventsBeta` to count interactive logon events per account, then filters for accounts with more than 10 such events. A high count of interactive logons from a single account is a classic indicator of brute-force activity, where an attacker repeatedly attempts to guess credentials. This makes D correct because the query's primary purpose is to identify accounts with a suspiciously high number of interactive logons.

Answer

Find IP addresses with failed logon attempts.

Answer

List all interactive logons from Office 365 applications.

Answer

Detect non-interactive logons to Office 365.

Question 6

A compliance officer needs to search for emails containing trade secrets across all mailboxes in the organization. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct solution because it is specifically designed for legal and investigative searches across all mailboxes, including the ability to search for specific content like trade secrets using keyword queries and advanced features like predictive coding and review sets. It supports searching across Exchange Online mailboxes, SharePoint sites, and OneDrive for Business, making it ideal for a compliance officer conducting a broad, targeted search for sensitive information.

Answer

Communication Compliance

Answer

Data Loss Prevention

Answer

Audit (Standard)

Question 7

A company has a policy that prohibits employees from sharing confidential customer data with unauthorized parties. The compliance team needs to detect patterns of unusual user activity that may indicate insider data theft, such as downloading large volumes of data to a personal device or emailing sensitive files to external recipients. They also want to investigate the activity and take remediation actions like generating a case for litigation or notifying the user's manager. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is designed specifically to detect, investigate, and remediate insider data theft scenarios. It uses predefined and customizable policies to identify patterns like large-volume downloads to personal devices or emailing sensitive files externally, and provides built-in remediation actions such as generating a case for litigation or notifying a user's manager.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Question 8

You are a security architect for a large enterprise using Microsoft Entra ID. You need to implement a solution that enforces least-privilege access and reduces lateral movement. Which THREE Microsoft Entra capabilities should you include in your design?

Accepted Answer

Identity Protection. Identity Protection is correct because it uses machine learning to detect and automatically respond to identity-based risks, such as leaked credentials or anomalous sign-in patterns, which directly reduces the attack surface and limits lateral movement by blocking or challenging risky authentications before an attacker can pivot.

Answer

Password hash synchronization

Answer

Microsoft Defender for Cloud Apps

Question 9

Your organization uses Microsoft Entra ID and has deployed Microsoft Entra ID Governance for entitlement management. You need to allow external partners to request access to a specific application, but only if they have a valid email address from an approved domain. Once approved, their access should automatically expire after 30 days. You also need to ensure that the partner's access is reviewed quarterly by the application owner. What should you configure?

Accepted Answer

Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, set expiration to 30 days, and add a quarterly access review.. It combines all required components: a connected organization restricts access to approved partner domains, the access package includes the application as a resource, approval ensures authorization, a 30-day expiration enforces automatic access removal, and a quarterly access review satisfies ongoing compliance. Microsoft Entra ID Governance entitlement management uses access packages to bundle resources, policies, and reviews for external collaboration.

Answer

Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, and set expiration to 30 days.

Answer

Create a dynamic group based on partner email domain and assign the application to the group with a 30-day expiration policy.

Answer

Add the partner as a guest user manually and assign the application directly with an expiration date.

Question 10

Your organization uses Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing the company's financial application. Which security feature should you use?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA specifically for the financial application by targeting the application in the policy. This provides granular control over authentication requirements based on conditions such as user, location, device state, and application, which is exactly what is needed to secure a specific app.

Answer

Security defaults

Answer

Privileged Identity Management

Answer

Identity Protection

Question 11

Your organization uses Microsoft Entra ID and wants to provide a single sign-on (SSO) experience for a third-party SaaS application that supports SAML 2.0. The app must also enforce multifactor authentication (MFA) for external users. What should you configure?

Accepted Answer

Set up SAML-based federation in Microsoft Entra ID and assign a Conditional Access policy requiring MFA. The scenario requires SAML 2.0-based federation for SSO, which Microsoft Entra ID supports natively. By assigning a Conditional Access policy that requires MFA, you enforce multifactor authentication for external users accessing the third-party SaaS application, meeting both SSO and MFA requirements.

Answer

Add the app as a Linked Sign-On application

Answer

Use password-based SSO in Microsoft Entra ID

Answer

Configure OAuth 2.0 authorization in Microsoft Entra ID

Question 12

You are the compliance administrator for a retail company that uses Microsoft 365 Business Premium. The company needs to:
- Block customers' credit card numbers from being sent via email.
- Retain all sales invoices for 3 years as per financial regulations.
- Allow managers to search and export employee emails for HR investigations.
- Ensure that only HR can access employee salary information.
Which Microsoft Purview solutions should you use?

Accepted Answer

DLP, Data Lifecycle Management, eDiscovery, and sensitivity labels. DLP (Data Loss Prevention) blocks credit card numbers from being sent via email, Data Lifecycle Management retains sales invoices for 3 years, eDiscovery allows managers to search and export employee emails for HR investigations, and sensitivity labels restrict access to salary information to HR only. Each requirement maps directly to a specific Purview solution: DLP for sensitive data protection, retention policies for compliance, eDiscovery for legal/HR investigations, and sensitivity labels for access control.

Answer

DLP, Information Barriers, eDiscovery, and sensitivity labels

Answer

Insider Risk Management, Data Lifecycle Management, eDiscovery, and sensitivity labels

Answer

Communication Compliance, Data Lifecycle Management, eDiscovery, and sensitivity labels

Question 13

A company is planning to migrate from on-premises Active Directory to Microsoft Entra ID. They have a custom line-of-business application that uses Windows Integrated Authentication and requires Kerberos. Which approach should they use to enable hybrid identity?

Accepted Answer

Deploy Microsoft Entra Kerberos authentication and register the app. Microsoft Entra Kerberos authentication enables hybrid identity for legacy on-premises applications that require Kerberos and Windows Integrated Authentication. By deploying this feature, the app can authenticate users against Microsoft Entra ID while still receiving Kerberos tickets, allowing a seamless migration without modifying the application's authentication code.

Answer

Use password hash synchronization (PHS) and configure the app for OAuth

Answer

Use pass-through authentication (PTA) and configure the app for SAML

Answer

Federate with Active Directory Federation Services (ADFS)

Question 14

Your organization is implementing Microsoft Entra Internet Access (formerly Microsoft Entra Internet Access). You need to secure access to public internet apps by enforcing traffic routing through Microsoft's network. Which feature should you enable?

Accepted Answer

Global Secure Access. Microsoft Entra Internet Access (part of Global Secure Access) routes traffic from users and devices through the Microsoft network to enforce security policies for public internet apps. Enabling Global Secure Access allows you to configure traffic forwarding profiles that redirect internet-bound traffic through Microsoft Entra Internet Access, ensuring consistent policy enforcement and threat protection.

Answer

Conditional Access

Answer

DDoS protection

Answer

Network segmentation

Question 15

Refer to the exhibit. A company has configured the above Conditional Access policy in Microsoft Entra ID. A user attempts to access Exchange Online from an untrusted location. What happens?

Accepted Answer

The user is granted access without MFA because the policy does not apply.. The Conditional Access policy shown in the exhibit is configured with 'Include: All users' and 'Exclude: All users'. When both include and exclude are set to 'All users', the exclusion takes precedence, effectively making the policy apply to no users. Therefore, when a user attempts to access Exchange Online from an untrusted location, the policy does not apply, and the user is granted access without MFA.

Answer

Access is blocked because the condition is not met.

Answer

The user is prompted for MFA because the policy applies to all users.

Answer

The user is blocked because the grant requires MFA.