SC-900 Practice Test 50 — 15 Questions

Question 1

A company wants to provide employees with single sign-on access to both Microsoft 365 and a third-party SaaS application. Which feature of Microsoft Entra ID should they use?

Accepted Answer

Federation. Federation (Option C) is correct because it establishes a trust relationship between Microsoft Entra ID and the third-party SaaS application's identity provider using standards like SAML 2.0 or WS-Federation. This allows users to authenticate once with their corporate credentials and gain access to both Microsoft 365 and the third-party app without separate logins, enabling true single sign-on (SSO).

Answer

Identity Protection

Answer

Conditional Access

Answer

Privileged Identity Management

Question 2

A company wants to monitor employee communications for potential harassment or policy violations. Which Microsoft Purview solution should they use?

Accepted Answer

Communication compliance. Communication compliance is the correct solution because it is specifically designed to detect and remediate inappropriate communications, such as harassment, threats, or policy violations, by analyzing email, Microsoft Teams, and third-party messages. It uses customizable policies to scan for sensitive content, keywords, or patterns, and provides alerts for review by designated investigators.

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Answer

Insider risk management

Question 3

Your organization is planning to implement Microsoft Entra ID for identity and access management. Which TWO capabilities are provided by Microsoft Entra ID?

Accepted Answer

Identity governance (e.g., access reviews). Microsoft Entra ID provides identity governance capabilities such as access reviews, which allow administrators to automate the process of reviewing and certifying user access to applications and groups. This ensures compliance and security by regularly validating that users have appropriate access rights. Single sign-on (SSO) is a core feature of Entra ID, enabling users to authenticate once and access multiple cloud applications without re-entering credentials, leveraging protocols like OAuth 2.0 and SAML 2.0.

Answer

External identity management for customer-facing apps

Answer

Security event log analysis

Answer

Mobile device management (MDM)

Question 4

Your organization wants to enforce MFA for all users accessing the Azure portal. However, users accessing from the corporate office network should not be prompted for MFA. Which Conditional Access assignment should you configure?

Accepted Answer

Include all locations, exclude trusted locations.. Conditional Access policies evaluate assignments based on conditions such as user, app, and location. To enforce MFA for all users accessing the Azure portal while excluding the corporate office network, you must include all users and the Azure portal app, then exclude trusted locations (the corporate network). This ensures MFA is required only when access originates from outside the trusted corporate network.

Answer

Include all users, include trusted locations.

Answer

Include all trusted locations.

Answer

Include Azure portal app, exclude trusted locations.

Question 5

Your organization needs to prevent sensitive data in SharePoint Online from being shared externally. Which Microsoft Purview solution should you use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct Microsoft Purview solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), by applying policies that can block external sharing in SharePoint Online. DLP policies can be configured to scan content in real-time and enforce actions like blocking access or sending notifications when sensitive data is detected in external sharing scenarios.

Answer

eDiscovery

Answer

Sensitivity labels

Answer

Insider Risk Management

Question 6

A tenant administrator runs the PowerShell cmdlet shown in the exhibit. The output shows that some compliance policies have IsAssigned = $false. What does this indicate?

Accepted Answer

The compliance policy is not assigned to any user or device group. The `IsAssigned` property in the output of a compliance policy PowerShell cmdlet (such as `Get-DeviceCompliancePolicy`) directly indicates whether the policy has been assigned to any user or device group. When `IsAssigned = $false`, it means the policy exists in the tenant but has not been linked to any group via an assignment, so it is not being enforced on any devices. This is a core concept in Microsoft Intune and Microsoft 365 compliance: a policy must be assigned to a group to take effect.

Answer

The compliance policy is scheduled to be assigned in the future

Answer

The compliance policy has been evaluated and found non-compliant

Answer

The compliance policy is a built-in policy that cannot be assigned

Question 7

Your company needs to detect and prevent employees from sharing confidential product plans via email with external parties. Which Microsoft Purview solution should you configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive information, such as confidential product plans, via email and other channels. DLP policies can inspect email content and attachments for sensitive data types (e.g., custom keywords or patterns) and automatically block or quarantine the message if it is sent to external recipients. This aligns directly with the requirement to prevent employees from sharing confidential plans externally.

Answer

Sensitivity labels

Answer

Communication compliance

Answer

Retention policies

Question 8

A company wants to provide external consultants with access to a specific application using their LinkedIn or Google accounts. Which Microsoft Entra feature allows this?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD External Identities) is the correct feature because it enables external users—such as consultants—to sign in using their own identity providers (IdPs) like LinkedIn or Google via federation. This allows the company to grant access to a specific application without creating separate Microsoft Entra accounts for each consultant, leveraging social identity providers through OpenID Connect or OAuth 2.0 protocols.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Question 9

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Sentinel. The query returns sign-in logs with error code 50076. What does this error indicate?

Accepted Answer

The user did not pass multi-factor authentication.. Error code 50076 in Microsoft Entra sign-in logs specifically indicates that the user did not pass multi-factor authentication (MFA). This error is returned when the MFA challenge fails, such as when the user enters an incorrect verification code, denies the push notification, or the MFA session expires. It is a direct signal that the authentication attempt was not completed successfully due to MFA failure.

Answer

The user account is disabled.

Answer

The user's password has expired.

Answer

The sign-in was blocked by a Conditional Access policy.

Question 10

Your organization uses Microsoft Entra ID with P2 licenses. You need to implement a policy that requires users to perform multifactor authentication (MFA) when accessing the finance application from an untrusted network, but not when accessing it from the corporate network. Which Microsoft Entra feature should you configure?

Accepted Answer

Microsoft Entra Conditional Access policy. Microsoft Entra Conditional Access policies allow you to enforce MFA based on conditions such as network location. By configuring a policy that targets the finance application and includes a condition for 'untrusted networks' (e.g., any location other than the corporate network's trusted IP ranges), you can require MFA only when access originates from outside the corporate network. This is the correct feature for granular, condition-based access controls.

Answer

Microsoft Entra Entitlement Management

Answer

Microsoft Entra ID Protection MFA registration policy

Answer

Microsoft Entra Privileged Identity Management (PIM)

Question 11

Your organization uses Microsoft Purview to manage compliance. You need to create a policy that ensures data is retained for a specific period and then automatically deleted. Which solution should you use?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (D) provides the ability to create retention and deletion policies that automatically retain data for a specified period and then delete it. This solution directly addresses the requirement to manage data retention and deletion schedules within Microsoft Purview.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Information Protection

Question 12

You need to allow users to reset their own passwords without contacting the help desk. Which Microsoft Entra feature should you enable?

Accepted Answer

Self-service password reset. Self-service password reset (SSPR) is the Microsoft Entra feature that allows users to reset their own passwords without contacting the help desk. It is designed to reduce help desk costs and improve user productivity by enabling password changes or unlocks through a verified authentication method, such as email, phone, or security questions.

Answer

Microsoft Authenticator

Answer

Identity Governance

Answer

Conditional Access

Question 13

A user reports that they cannot access a sensitive document in SharePoint Online. The document has a 'Highly Confidential' sensitivity label. You verify the label is applied correctly. What is the most likely reason for the access issue?

Accepted Answer

The label's encryption settings restrict access to specific users. The 'Highly Confidential' sensitivity label is configured with encryption that restricts access to specific users or groups. Since you verified the label is applied correctly, the most likely reason the user cannot access the document is that their account is not included in the encryption permissions defined by the label. Sensitivity labels in Microsoft Purview Information Protection use Azure Rights Management (Azure RMS) to enforce encryption, and only authorized users with the appropriate rights can decrypt and access the content.

Answer

The sensitivity label is missing

Answer

A DLP policy is blocking access

Answer

A retention policy is blocking access

Question 14

Your company uses Microsoft Entra ID. Security policy requires that all external guest users must be reviewed and their access approved by their sponsor every 90 days. If not approved, access should be automatically removed. Which feature should you use?

Accepted Answer

Microsoft Entra access reviews. Microsoft Entra access reviews (Option D) allow you to configure recurring reviews of guest users' access, with automatic removal of access if not approved. This directly meets the requirement for a 90-day review cycle with automatic enforcement, as access reviews can be scoped to guest users and integrated with entitlement management or groups.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra B2B collaboration settings

Answer

Microsoft Entra entitlement management

Question 15

Refer to the exhibit. You run the PowerShell command shown to investigate a potential data exfiltration incident. The output is empty. Which is the most likely reason?

Accepted Answer

Audit logging is not enabled for the tenant. The Search-UnifiedAuditLog cmdlet retrieves entries from the unified audit log. If the output is empty, the most likely cause is that unified audit logging is not enabled for the tenant. In Microsoft 365, unified audit logging must be turned on in the compliance portal or via PowerShell (Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true). Without this, no audit records are generated, so the cmdlet returns no results regardless of user activity.

Answer

The user does not have a mailbox

Answer

The command syntax is incorrect

Answer

The user did not download or access any files in the past 7 days