SC-900 Practice Test 49 — 15 Questions

Question 1

A financial services company is required by the Payment Card Industry Data Security Standard (PCI-DSS) to retain all documents containing credit card numbers for at least seven years. The compliance team has created a custom sensitive information type (SIT) to detect credit card numbers in Microsoft 365. They want to automatically apply a retention label (e.g., "7-Year Retention") to any document in SharePoint or OneDrive that matches this SIT. Which Microsoft Purview solution should they configure to apply the label automatically based on content?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) in Microsoft Purview is the solution specifically designed for automatically applying retention labels based on conditions like sensitive information types (SITs). By creating a retention label policy with auto-labeling rules that reference the custom SIT for credit card numbers, DLM can automatically assign the '7-Year Retention' label to documents in SharePoint and OneDrive that contain PCI-DSS data, ensuring compliance with retention requirements.

Answer

Data Loss Prevention (DLP)

Answer

Insider Risk Management

Answer

Communication Compliance

Question 2

Which TWO Microsoft Entra ID capabilities help detect and remediate identity risks? (Select two.)

Accepted Answer

Identity Protection. Microsoft Entra ID Protection (option A) is correct because it uses Microsoft's threat intelligence and machine learning to detect identity risks such as leaked credentials, anonymous IP usage, and atypical sign-in behavior, generating risk detections and risk levels (low/medium/high) for users and sign-ins that can trigger automated remediation. Conditional Access (option E) is correct because it enforces access controls based on signals including user risk and sign-in risk reported by Identity Protection, allowing remediation actions such as requiring multi-factor authentication, forcing a secure password change, or blocking access when risk is elevated. Together, Identity Protection detects the risk and Conditional Access remediates it, which is exactly the detect-and-remediate identity risk scenario described. Identity Governance (option B) focuses on access reviews, entitlement management, and lifecycle workflows rather than risk detection. Password protection (option C) enforces banned-password lists and on-premises password policies but does not detect or remediate identity risk signals. Privileged Identity Management (option D) provides just-in-time privileged role activation, approval, and access reviews for admin roles, not risk-based detection or remediation.

Answer

Identity Governance

Answer

Password protection

Answer

Privileged Identity Management

Question 3

A company runs critical Windows virtual machines on Azure. To reduce the attack surface, the security team wants to block all inbound RDP (port 3389) traffic from the internet by default. When a security engineer needs to connect via RDP for troubleshooting, they must request access through a portal, and the RDP port will be opened for a limited time (e.g., 4 hours) only to their source IP address. Which Microsoft security solution should they use to implement this control?

Accepted Answer

Microsoft Defender for Cloud's Just-in-time (JIT) VM access. Microsoft Defender for Cloud's Just-in-time (JIT) VM access is the correct solution because it specifically provides time-limited, request-based opening of inbound ports (such as RDP port 3389) to approved source IP addresses, reducing the attack surface by keeping ports closed by default. This aligns directly with the requirement to block all inbound RDP from the internet by default and allow temporary access only through a portal request.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Azure Network Security Groups (NSGs) with application security groups

Question 4

A company uses Microsoft Purview Information Protection to classify and protect sensitive data. They want to automatically apply a sensitivity label to documents containing credit card numbers. Which should you configure?

Accepted Answer

Configure an auto-labeling policy with a sensitive info type for credit card numbers. Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents and emails that contain specific sensitive information types, such as credit card numbers. This enables automated classification and protection without requiring user intervention, directly meeting the requirement to automatically apply a label based on the presence of credit card data.

Answer

Use a manual labeling policy requiring users to apply labels

Answer

Create a trainable classifier for credit card patterns

Answer

Set up a data classification activity explorer to monitor credit card usage

Question 5

A company runs workloads in Microsoft Azure and in Google Cloud Platform (GCP). The security team needs a single dashboard to view the security posture of both cloud environments, get recommendations for misconfigurations based on best practices, and track compliance with industry standards such as ISO 27001 and PCI DSS. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct solution because it provides a unified dashboard for assessing and improving the security posture of multicloud environments, including Azure and GCP. It offers continuous assessment against best practices (e.g., the Microsoft cloud security benchmark), generates actionable recommendations for misconfigurations, and tracks compliance with industry standards like ISO 27001 and PCI DSS through built-in regulatory compliance dashboards.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Question 6

Your organization uses Microsoft Entra ID. You need to ensure that when a user is terminated, all access to SaaS applications is automatically revoked. What should you configure?

Accepted Answer

Configure Microsoft Entra lifecycle workflows to disable the user and remove group memberships upon termination.. Microsoft Entra lifecycle workflows automate the user offboarding process by disabling the user account and removing group memberships upon termination. This ensures that the user loses access to all SaaS applications that rely on Entra ID for authentication, as group membership removal revokes access tokens and disables sign-in.

Answer

Configure a conditional access policy to block access for disabled users.

Answer

Use Privileged Identity Management to remove role assignments.

Answer

Schedule an access review for quarterly review of access.

Question 7

A company manages Azure virtual machines and on-premises servers. The security team needs a single dashboard that provides a secure score and actionable recommendations to improve the security posture across both environments. Which Microsoft solution should be used?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a unified dashboard that displays a secure score and actionable recommendations for Azure virtual machines, on-premises servers, and other cloud workloads. It integrates with Azure Arc to extend security monitoring to on-premises resources, enabling a single view of security posture across hybrid environments.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 8

A company uses Microsoft Entra ID. The IT team needs to ensure that when employees leave the organization, their access to all Microsoft 365 applications is revoked immediately and their account is disabled. Which Microsoft Entra capability should the team use?

Accepted Answer

Microsoft Entra ID Governance lifecycle workflows. Lifecycle workflows in Microsoft Entra ID Governance are designed to automate identity lifecycle tasks, including offboarding. When an employee leaves, a leaver workflow can immediately disable the account and remove access to all integrated applications, ensuring compliance and security. Other options do not provide this end-to-end automation for termination scenarios.

Answer

Microsoft Entra Conditional Access policies

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra self-service password reset (SSPR)

Question 9

A company is implementing a Microsoft Entra ID tenant for a new subsidiary. They require that all users authenticate using passwordless methods, specifically the Microsoft Authenticator app. What is the minimum configuration required to enforce this?

Accepted Answer

Create a Conditional Access policy targeting all users that requires 'Require authentication strength' and select the 'Passwordless MFA' authentication strength. A Conditional Access policy with the 'Require authentication strength' setting allows you to select the 'Passwordless MFA' authentication strength, which enforces passwordless methods like the Microsoft Authenticator app. This is the minimum configuration that directly targets all users and mandates passwordless authentication, as opposed to broader or less specific settings.

Answer

Enable Microsoft Entra ID Protection and configure MFA registration policy

Answer

Turn on Security defaults

Answer

Configure Microsoft Entra Hybrid Join for all devices

Question 10

Which THREE of the following are key concepts of identity management in Microsoft Entra ID?

Accepted Answer

Federation. Authentication (E) is a core identity-management concept in Microsoft Entra ID because it verifies a user's or service principal's identity through credentials such as passwords, certificate-based authentication, Windows Hello for Business, or FIDO2 security keys, and it underpins tokens issued by the Microsoft identity platform. Authorization (D) is equally fundamental: once Entra ID authenticates an identity, it determines what that identity may access through mechanisms like role-based access control (RBAC), OAuth 2.0 scopes, app roles, and conditional access policies. Federation (B) is also a key concept because Entra ID can trust external identity providers via protocols such as SAML 2.0, WS-Federation, and OpenID Connect, enabling single sign-on and delegated authentication for partner or on-premises identities. Encryption (A) is a security control used to protect data in transit and at rest, but it is not itself an identity-management concept. Least privilege (C) is an important security principle applied within authorization and access reviews, yet it is a guiding principle rather than one of the core identity-management concepts tested here.

Answer

Encryption

Answer

Least privilege

Question 11

An organization needs to prevent users from sharing files containing trade secrets with external parties via email. The solution must allow internal sharing. Which Microsoft Purview capability should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention policies. Microsoft Purview Data Loss Prevention (DLP) policies are designed to detect and block the sharing of sensitive information—such as trade secrets—via email or other channels, while still allowing internal sharing. DLP can inspect email content and attachments for sensitive data types and apply actions like blocking external sends, making it the correct choice for this requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Sensitivity Labels with encryption

Question 12

A compliance officer is tasked with continuously assessing the organization's compliance posture against GDPR and ISO 27001. The solution should generate a compliance score based on implemented controls, provide recommended improvement actions, and track remediation progress over time. Which Microsoft Purview solution should they use?

Accepted Answer

Compliance Manager. Compliance Manager is the correct solution because it provides a continuous compliance score based on implemented controls, offers recommended improvement actions, and tracks remediation progress over time. It supports frameworks like GDPR and ISO 27001 by mapping controls to assessments and generating a dynamic score that reflects the organization's compliance posture.

Answer

Audit (Premium)

Answer

Communication Compliance

Answer

Data Lifecycle Management

Question 13

A security architect is adopting a new security model that assumes breach and verifies every access request. The model eliminates implicit trust and requires continuous validation. Which security model is being implemented?

Accepted Answer

Zero Trust. Zero Trust is the correct model because it explicitly assumes breach, eliminates implicit trust, and requires continuous validation of every access request. This aligns with the core Zero Trust principle of 'never trust, always verify,' which mandates that no user, device, or network is trusted by default, even if they are inside the corporate perimeter.

Answer

Defense in Depth

Answer

Least Privilege

Answer

Shared Responsibility

Question 14

You have a Conditional Access policy in Microsoft Entra ID. The policy has the following settings: Assignments > Users > Include: All guest and external users; Assignments > Target resources > Cloud apps: All cloud apps; Access controls > Grant: Require multi-factor authentication. What is the effect of this policy?

Accepted Answer

Requires MFA for all external users accessing any cloud app. The policy applies to all guest and external users and targets all cloud apps, with the grant control requiring multi-factor authentication. Therefore, it requires MFA for all external users accessing any cloud app. It is not limited to guest users only, does not apply to all internal users, and does not exclude external users with the Global Administrator role.

Answer

Requires MFA for guest users only

Answer

Requires MFA for all users accessing all cloud apps

Answer

Requires MFA for external users except those with global admin role

Question 15

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to ensure that when a user tries to share a document containing a credit card number externally via email, the user sees a policy tip and the email is blocked. Which DLP rule action should they configure?

Accepted Answer

Block the message and notify the user with a policy tip. The requirement is to both block the email and show a policy tip to the user. In Microsoft Purview DLP, the 'Block the message and notify the user with a policy tip' action enforces the block at the transport level while simultaneously displaying a customizable policy tip in Outlook or Outlook on the web, informing the user why the message was blocked. This meets the dual need of prevention and user notification.

Answer

Notify user with policy tip only

Answer

Block the message only

Answer

Redirect the message to the compliance admin