SC-900 Practice Questions 2 — 50 Questions

Question 1

A legal team is involved in a lawsuit and needs to ensure that all emails and documents related to the case are preserved in their original state, even if users edit or delete them. They also need the ability to search for these items and export them for legal review. Which Microsoft Purview solution should the compliance team configure to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview eDiscovery (Standard). Microsoft Purview eDiscovery (Standard) is the correct solution because it provides the ability to place a legal hold on content (preserving emails and documents in their original state even if users edit or delete them), perform searches across Exchange Online, SharePoint Online, OneDrive for Business, and Teams, and export the results for legal review. This directly meets the requirements of preservation, search, and export for litigation.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit (Standard)

Question 2

Which TWO Microsoft Purview features can be used to classify and label sensitive data in Microsoft 365?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (A) are correct because they allow organizations to automatically apply sensitivity labels to data based on conditions such as sensitive information types or pattern matching, enabling classification and labeling without manual user intervention. Sensitivity labels (D) are correct because they are the core mechanism in Microsoft Purview for classifying and protecting sensitive data by applying persistent labels that can enforce encryption, access restrictions, and visual markings across Microsoft 365 services.

Answer

Data Loss Prevention policies

Answer

Retention policies

Answer

Audit policies

Question 3

You are viewing an application registration in Microsoft Entra ID. What can you conclude about this app?

Accepted Answer

The app is a single-tenant application that is enabled but has no app roles defined. The application registration shows 'App roles' with a value of 0, which means no app roles are defined. The 'Supported account types' setting indicates 'Accounts in this organizational directory only', confirming it is a single-tenant application. The 'Enabled for users to sign-in?' toggle is set to 'Yes', so the app is enabled and can be used.

Answer

The app is disabled and cannot be used

Answer

The app has custom roles for role-based access

Answer

The app is multi-tenant and can be used by other tenants

Question 4

Your company uses Microsoft Defender for Endpoint. You need to configure attack surface reduction (ASR) rules. Which TWO of the following are ASR rules?

Accepted Answer

Block executable content from email client and webmail. ASR rules are designed to block common attack vectors by controlling specific behaviors. 'Block executable content from email client and webmail' prevents malicious scripts or executables from running when delivered via email, which is a primary infection vector. Option E is correct because 'Block Office applications from creating child processes' stops attackers from using Office apps (like Word or Excel) to spawn malicious processes (e.g., PowerShell or cmd.exe), a classic technique for code execution.

Answer

Allow only signed executables

Answer

Block inbound connections from the internet

Answer

Block untrusted fonts

Question 5

Which TWO Microsoft Entra features can be used together to enforce risk-based conditional access?

Accepted Answer

Conditional Access. Conditional Access (B) is correct because it is the policy engine that enforces access decisions based on signals, including risk levels. Identity Protection (C) is correct because it detects and calculates user and sign-in risk in real time using machine learning. Together, Identity Protection provides the risk assessment, and Conditional Access enforces the policy (e.g., block or require MFA) based on that risk.

Answer

Entra Verified ID

Answer

Self-Service Password Reset

Answer

Privileged Identity Management

Question 6

Which two scenarios are examples of using Microsoft Entra business-to-business (B2B) collaboration? (Choose two.)

Accepted Answer

A user from a partner organization is invited to access a SharePoint Online site.. Microsoft Entra B2B collaboration allows you to invite external users from partner organizations to access your company's resources, such as a SharePoint Online site. The invited user authenticates using their own home tenant credentials, and a B2B guest user object is created in your directory to represent them.

Answer

An employee uses their Microsoft Entra ID to sign in to a third-party SaaS application.

Answer

Two internal departments share resources within the same tenant.

Answer

Customers use their Facebook accounts to sign in to a company's web application.

Question 7

Which THREE Microsoft Defender XDR components are included in the unified security operations platform? (Select three.)

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR (Extended Detection and Response) unifies signals from across the Microsoft 365 Defender portal. Microsoft Defender for Office 365 is a core component because it protects email, SharePoint, OneDrive, and Teams from threats like phishing and malware, and its alerts feed directly into the unified XDR incident queue. This integration allows cross-domain correlation with endpoint, identity, and cloud app signals.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for IoT

Question 8

Your organization is implementing Microsoft Purview to govern data across Microsoft 365 and Azure. Which TWO capabilities should you use to discover and classify sensitive data?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (A) enables you to discover, classify, and protect sensitive data by applying sensitivity labels and analyzing content via data loss prevention (DLP) policies. Microsoft Purview Data Map (B) provides automated scanning and classification of data assets across Azure and Microsoft 365, building a unified map of sensitive data locations. Together, they fulfill the discovery and classification requirements.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management

Question 9

Which THREE of the following are capabilities provided by Microsoft Entra ID Protection? (Select three.)

Accepted Answer

Automated investigation and remediation of identity risks. Microsoft Entra ID Protection includes automated investigation and remediation capabilities that respond to detected identity risks. When a risk is identified, such as a compromised user account, the service can automatically trigger actions like requiring a password reset or blocking sign-in attempts, reducing the need for manual intervention.

Answer

Passwordless authentication options

Answer

Device compliance assessment

Question 10

A healthcare organization is implementing Microsoft Purview Data Lifecycle Management to retain medical records for 7 years. Which THREE components must be configured to achieve this retention requirement?

Accepted Answer

Create a retention label policy to publish the label.. A retention label policy is required to publish the retention label so that it can be automatically or manually applied to the medical records. Without publishing the label via a policy, the label itself cannot be assigned to content, and the retention period will not take effect.

Answer

Apply a sensitivity label to classify the records.

Answer

Implement Data Loss Prevention (DLP) policies to prevent data exfiltration.

Question 11

Your company, Wingtip Toys, uses Microsoft Entra ID with a Premium P1 license. You have a third-party SaaS application that supports Security Assertion Markup Language (SAML) 2.0. You need to enable single sign-on (SSO) for users to access this application. The app requires attributes like department and employee ID in the SAML token. You also need to ensure that only users from a specific security group can access the app. What should you do?

Accepted Answer

Add the app from the gallery as a SAML application, configure claims mapping to include department and employee ID, and assign the app to the security group.. With Microsoft Entra ID Premium P1, you can add the SaaS application from the gallery as a SAML application, configure custom claims to include department and employee ID in the SAML token, and assign the application to the security group. OpenID Connect is not SAML SSO. Password-based SSO cannot provide SAML attributes. Application Proxy is used for on-premises applications, not SaaS apps.

Answer

Register the app using OpenID Connect and assign users to the app.

Answer

Add the app from the gallery using password-based SSO and configure group assignment.

Answer

Use Microsoft Entra Application Proxy to publish the app and configure pre-authentication.

Question 12

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to investigate ransomware alerts. The query returns: AlertSeverity High: 5, Medium: 3, Low: 2. The security team wants to automate a response for all high-severity ransomware alerts. What should you configure?

Accepted Answer

Create an automation rule that triggers a playbook for high-severity ransomware incidents. Microsoft Sentinel automation rules allow you to define automated responses triggered when incidents are created or updated. By configuring an automation rule with a condition that checks for 'AlertSeverity' equal to 'High' and 'Ransomware' as the related alert, you can invoke a playbook to automatically respond to high-severity ransomware incidents, such as isolating affected machines or blocking indicators of compromise.

Answer

Create an analytics rule for ransomware

Answer

Create a hunting query for ransomware

Answer

Create a workbook to display ransomware alerts

Question 13

A financial services organization must prevent employees in the Research department from communicating via email or Microsoft Teams with employees in the Investment Banking department to avoid conflicts of interest. Additionally, they need to prevent any credit card numbers from being shared in emails sent to external recipients. Which combination of Microsoft Purview solutions should they implement?

Accepted Answer

Information Barriers and Data Loss Prevention. Information Barriers are designed to prevent communication and collaboration between specific groups to avoid conflicts of interest (e.g., research vs. investment banking). Data Loss Prevention (DLP) policies detect and protect sensitive information such as credit card numbers from being shared externally. Communication Compliance focuses on monitoring communications for regulatory compliance but does not block communications, and Insider Risk Management analyzes risky user activities but does not enforce segmentation.

Answer

Communication Compliance and Insider Risk Management

Answer

Information Barriers and Communication Compliance

Answer

Data Lifecycle Management and Data Loss Prevention

Question 14

A security team uses Microsoft Defender XDR to respond to incidents. Which THREE components are part of Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR is a unified extended detection and response platform that natively integrates signals from Microsoft Defender for Office 365 (email and collaboration protection), Microsoft Defender for Endpoint (endpoint detection and response), and Microsoft Defender for Identity (on-premises identity threat detection). These three components share telemetry and automate incident correlation across domains, which is the core purpose of Defender XDR.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 15

Your organization is using Microsoft Sentinel as a SIEM. You want to automatically respond to a high-severity incident by opening a ticket in ServiceNow and notifying the security team via email. What should you create?

Accepted Answer

An automation rule. Automation rules in Microsoft Sentinel can be configured to trigger automated responses when an incident is created, such as running a playbook (a Logic App) that opens a ticket in ServiceNow and sends an email notification. Option B is wrong because workbooks are for visualization and reporting, not automation. Option C is wrong because analytics rules generate alerts/incidents based on data queries, but they do not directly perform response actions; instead, automation rules handle the response. Option D is wrong because watchlists are collections of data for correlation and enrichment, not for automated response.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 16

An organization adopts a security model that requires explicit verification of every access request, uses least privilege principles, and assumes that a breach has already occurred. Which security model does this describe?

Accepted Answer

Zero Trust. Zero Trust is the correct answer because the model explicitly requires verification of every access request, enforces least privilege, and assumes breach. This aligns with the core Zero Trust principles of 'never trust, always verify,' continuous validation, and micro-segmentation, as opposed to traditional perimeter-based models that implicitly trust internal traffic.

Answer

Perimeter-based security

Answer

Defense in depth

Answer

Shared responsibility

Question 17

Which three features are available in Microsoft Entra ID P2 but not in P1? (Choose three.)

Accepted Answer

Access reviews. Access reviews are a Microsoft Entra ID P2 feature that allows administrators to automate periodic reviews of group memberships, application access, and role assignments. This capability is not available in P1, which lacks the automated review workflows and attestation features that P2 provides for governance and compliance.

Answer

Conditional Access policies

Answer

Self-service password reset (SSPR) with writeback

Question 18

Which TWO of the following are capabilities of Microsoft Purview Information Protection? (Choose two.)

Accepted Answer

Classify and label sensitive data. Microsoft Purview Information Protection (MIP) enables organizations to classify and label sensitive data based on content inspection and policy rules. It also applies encryption and usage restrictions directly through sensitivity labels, ensuring data is protected regardless of where it is stored or shared.

Answer

Block external sharing of files

Answer

Detect malware in email attachments

Answer

Monitor user activities in real-time

Question 19

A company uses Microsoft Purview Data Lifecycle Management. To comply with regulatory requirements, the company must retain financial records for 7 years and then delete them. Which THREE actions should the company configure? (Select THREE.)

Accepted Answer

Create a retention label with a retention period of 7 years. A retention label with a 7-year retention period allows you to apply specific retention and deletion rules to individual documents, such as financial records, rather than to an entire site. This granularity is necessary when only a subset of content within a SharePoint site must be retained for compliance.

Answer

Create a data loss prevention policy

Answer

Create a retention policy for the entire SharePoint site

Question 20

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy configuration for a compliance team. What is the effect of this policy?

Accepted Answer

The policy blocks access but allows users to override with a justification. The policy includes a BlockAccess action with behavior set to BlockWithOverride, meaning the action is blocked by default but the user can override with a business justification. Additionally, the NotifyUser action sends a custom notification to the user. This matches Option A. Option B is incorrect because there is no encryption action configured. Option C is incorrect because the policy does block access (with override), not just send a notification. Option D is incorrect because the policy allows user override, so it does not automatically block without override.

Answer

The policy automatically applies encryption to the content

Answer

The policy sends a notification but does not block access

Answer

The policy automatically blocks access without user override