SC-900 Practice Test 50 — 15 Questions

Question 1

An organization wants to automatically retain emails for 7 years and then delete them. They also need to place a legal hold on specific users' mailboxes to preserve all emails during litigation. Which combination of Microsoft Purview features should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Retention policies and Litigation Hold. For automatic retention and deletion, Retention policies in Microsoft Purview are ideal as they apply to entire mailboxes. To preserve emails for litigation, Litigation Hold can be enabled on specific user mailboxes, ensuring that no emails are deleted or altered. The combination of these two features meets both requirements.

Answer

Retention labels and eDiscovery

Answer

Data Lifecycle Management and Audit

Answer

Records Management and Data Loss Prevention

Question 2

Your organization uses Microsoft Purview Communication Compliance to detect potential policy violations in Microsoft Teams chats. Which action can the policy automatically take when a violation is detected?

Accepted Answer

Notify the user and their manager via email. Microsoft Purview Communication Compliance is designed to detect and remediate policy violations, but it does not enforce access controls or modify message content directly. Instead, it can automatically notify the user and their manager via email as a configurable remediation action, allowing for human review and follow-up without disrupting communication flow.

Answer

Revoke the user's access to Microsoft Teams

Answer

Block the user from sending messages

Answer

Automatically delete the violating message

Question 3

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

A conditional access policy. Conditional Access policies in Microsoft Entra ID evaluate signals (like device compliance status reported by Intune) to enforce access controls. By configuring a Conditional Access policy that requires device compliance for the Exchange Online or corporate email app, only devices marked as compliant by Intune will be granted access. This is the correct mechanism to gate access based on compliance.

Answer

A device compliance policy

Answer

A device configuration policy

Answer

An app protection policy

Question 4

A company uses Microsoft Entra ID. They want to ensure that when users access the HR portal from an unmanaged personal device, they are prompted to sign a terms of use agreement and also required to perform multifactor authentication (MFA). Which Conditional Access control should they configure to enforce both requirements?

Accepted Answer

Grant - Require MFA and Require terms of use. The Grant control in Conditional Access allows you to require multiple conditions to be satisfied before granting access. By selecting both 'Require MFA' and 'Require terms of use' under Grant, the policy enforces that the user must complete both MFA and accept the terms of use when accessing the HR portal from an unmanaged device. This directly meets the requirement for both authentication and consent.

Answer

Session control - Use app enforced restrictions

Answer

Grant - Require approved client app

Answer

Session control - Sign-in frequency

Question 5

A company needs to grant IT administrators temporary and time-limited access to privileged roles in Microsoft Entra ID (Azure AD). The access must require approval from a manager and be automatically revoked after the task is completed. Which Microsoft Entra ID feature should be used?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing administrators to activate eligible role assignments for a limited duration. It supports approval workflows (e.g., manager approval) and automatically deactivates the role when the activation time expires or the task is completed, meeting the requirement for temporary, time-limited, approved, and auto-revoked access.

Answer

Conditional Access

Answer

Identity Protection

Answer

Entitlement Management

Question 6

Your company uses Microsoft Intune to manage devices. You need to ensure that only devices that are compliant with your security policies can access corporate email via Microsoft Outlook. What should you implement?

Accepted Answer

Conditional Access policies. Conditional Access policies (D) are the correct choice because they evaluate device compliance status—determined by Intune compliance policies—as a condition for granting access. By configuring a Conditional Access policy that requires compliant devices, only devices meeting your security policies can authenticate to Microsoft Outlook and access corporate email. This is the Microsoft Entra ID/Entra ID mechanism that enforces access control based on compliance state.

Answer

Windows Information Protection

Answer

Device compliance policies

Answer

App protection policies

Question 7

Your organization uses Microsoft Purview eDiscovery to manage legal holds. You need to place a hold on mailboxes and OneDrive accounts for a specific user who is involved in a litigation. Which eDiscovery solution should you use?

Accepted Answer

eDiscovery (Standard). eDiscovery (Standard) is the correct solution because it is designed specifically for legal hold management, allowing you to place a hold on content locations such as mailboxes and OneDrive accounts for a specific user involved in litigation. This hold preserves all content in those locations, including deleted items and versions, until the hold is released. Audit, Communication Compliance, and Content search do not provide the legal hold functionality required for this scenario.

Answer

Audit

Answer

Communication Compliance

Answer

Content search

Question 8

Your organization uses Microsoft Sentinel for security operations. You need to ensure that when a high-severity incident is created, a Microsoft Teams message is sent to the SOC team automatically. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook.. Automation rules in Microsoft Sentinel allow you to define triggers (e.g., incident creation) and run a playbook as an action. A playbook can contain steps to send a Teams message. So you create an automation rule that triggers on incident creation and runs a playbook. Option B is incorrect because attaching a playbook to an analytics rule is not the standard method; analytics rules create incidents, but automation rules handle the automated response. Option C is incorrect because analytics rules do not have a direct 'automated response' for sending notifications. Option D is incorrect because workbooks are used for data visualization and dashboards, not for automation.

Answer

Create a playbook and attach it to an analytics rule.

Answer

Modify the analytics rule to include an automated response.

Answer

Configure a workbook to send email alerts.

Question 9

An organization uses Microsoft Purview Audit to meet compliance requirements. Which TWO types of audit logs can be accessed?

Accepted Answer

Purview advanced audit logs. Microsoft Purview Audit provides two primary audit log access methods: the Microsoft 365 unified audit log, which aggregates audit records from various Microsoft 365 services, and Purview advanced audit logs, which offer extended retention (up to 10 years) and high-value events like investigation of privileged access. These two options directly correspond to the core audit capabilities within Purview for compliance requirements.

Answer

Windows Security event logs

Answer

Azure Active Directory audit logs

Answer

Azure SQL Database audit logs

Question 10

An organization uses Microsoft Purview Compliance Manager. They need to track their progress against a specific regulatory standard and assign improvement actions to different teams. Which component should they use?

Accepted Answer

Compliance Manager assessments. Compliance Manager assessments are the correct component because they allow you to track progress against a specific regulatory standard (e.g., ISO 27001, SOC 2) by creating an assessment that maps controls to that standard. Improvement actions are the granular tasks within an assessment that can be assigned to different teams for remediation, directly supporting the need to track progress and assign work.

Answer

eDiscovery

Answer

Data Loss Prevention

Answer

Audit logs

Question 11

A company is moving its on-premises database to Azure SQL Database. According to the shared responsibility model, which security tasks remain the responsibility of the customer?

Accepted Answer

Managing access controls and authentication for database users. In the shared responsibility model for Azure SQL Database, Microsoft manages the physical infrastructure, including servers, storage, and network, while the customer is responsible for data and access management. Option B is correct because managing access controls and authentication for database users, such as configuring logins, users, and permissions via T-SQL or Microsoft Entra ID, falls squarely on the customer. Microsoft ensures the platform is patched and secure, but the customer must control who can access the database and what they can do.

Answer

Patching the physical servers hosting the database

Answer

Securing the hypervisor running the virtual machines

Answer

Hardening the network firewalls at the datacenter perimeter

Question 12

AdventureWorks, a multinational manufacturing company, uses Microsoft Purview and Microsoft Communication Compliance to monitor and manage internal communications. They need to: (1) detect and review emails containing offensive language or harassment; (2) allow employees to report inappropriate messages; (3) retain reviewed messages for 5 years; (4) ensure that only designated reviewers can access the communication compliance data; (5) integrate with Microsoft Teams and Exchange Online. The company has 10,000 users and Microsoft 365 E5 licenses. The compliance team wants a solution that automates detection and provides secure review. What should they configure?

Accepted Answer

Create a Communication Compliance policy with conditions for offensive language, enable user reporting, and configure a retention policy for 5 years on the original content locations (e.g., Exchange Online mailboxes, Teams chats, SharePoint sites).. Microsoft Purview Communication Compliance is purpose-built to detect offensive language, harassment, and inappropriate content across Exchange Online, Teams, and other channels, and it natively supports user-reported messages and role-scoped reviewer access. Pairing it with a retention policy applied to the original content locations (Exchange mailboxes, Teams chats, SharePoint) satisfies the 5-year retention requirement while preserving the source data for legal hold and audit. This combination meets all five requirements — detection, user reporting, retention, restricted reviewer access, and Teams/Exchange integration — within the M365 E5 licensing already in place.

Answer

Enable mailbox auditing and create a custom script to search for offensive language.

Answer

Create a Data Loss Prevention (DLP) policy to block offensive language and enable eDiscovery for review.

Answer

Configure information barriers between departments and use audit logs for review.

Question 13

Your organization recently deployed Microsoft Defender for Cloud Apps. You need to identify which users are using a personal Dropbox account to access corporate files. Which feature should you use?

Accepted Answer

Cloud Discovery. B is correct because Cloud Discovery in Microsoft Defender for Cloud Apps analyzes traffic logs from your network to identify shadow IT usage, including users accessing personal Dropbox accounts from corporate devices. It uses anonymized data from Microsoft Intelligent Security Graph to detect unsanctioned cloud apps and map user activity, enabling you to pinpoint which users are bypassing corporate storage policies.

Answer

Activity policies

Answer

File policies

Answer

App permissions

Question 14

A company uses Microsoft Sentinel for security operations. They want to automatically create an incident and assign it to a senior analyst when a high-severity alert is generated. Which feature should they use?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to automatically trigger incident creation, assignment, and other actions when an alert is generated. By configuring an automation rule with a condition for high-severity alerts, you can set it to create an incident and assign it to a specific senior analyst, streamlining the response process.

Answer

Analytics rule

Answer

Workbook

Answer

Playbook

Question 15

You are the identity administrator for a large enterprise using Microsoft Entra ID. The company has 50,000 users and recently acquired a smaller company with 2,000 users that uses a third-party identity provider (IdP) based on SAML 2.0. The acquisition must be fully integrated within 30 days. The CISO mandates that all users must use MFA for any access to cloud applications. The acquired company's users currently do not use MFA. You need to choose an approach that minimizes changes to the acquired company's current authentication infrastructure while meeting the MFA requirement. The solution must also allow the acquired company's users to access resources in the parent tenant using their existing credentials. What should you do?

Accepted Answer

Configure B2B collaboration with the acquired company's IdP and enable MFA trust. In the parent tenant, create a Conditional Access policy that requires MFA for guest users.. B2B collaboration allows the acquired company's users to authenticate against their existing SAML 2.0 IdP using their current credentials, minimizing infrastructure changes. By enabling MFA trust, the parent tenant can rely on the MFA claims already issued by the third-party IdP if it supports MFA, but since it does not, you can enforce MFA in the parent tenant via a Conditional Access policy that requires MFA for guest users. This approach meets the CISO's mandate without requiring the acquired company to deploy MFA on their own IdP or migrate users.

Answer

Set up password hash synchronization from the acquired company's IdP to the parent tenant and enable MFA for all sync'ed users.

Answer

Create new user accounts in the parent tenant for the acquired company's users and assign them Microsoft Entra ID P2 licenses to enable MFA via Conditional Access.

Answer

Migrate all acquired company users to the parent tenant's on-premises Active Directory and sync them to Microsoft Entra ID. Enable MFA via Conditional Access.