SC-900 Practice Exam 51 — 20 Questions

Question 1

A security analyst in your organization receives an alert from Microsoft Defender XDR indicating that a user's device may be infected with ransomware. The analyst needs to immediately isolate the device from the network to prevent further spread. What should the analyst do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation. Microsoft Defender for Endpoint includes a built-in device isolation capability that can be triggered directly from the Microsoft Defender XDR portal. This action immediately disconnects the device from all network communications (except the Defender service) to contain a confirmed ransomware infection, preventing lateral movement while allowing forensic analysis.

Answer

Revoke the user's session in Microsoft Entra ID

Answer

Open Microsoft Sentinel and run a playbook

Answer

Use Microsoft Intune to wipe the device

Question 2

Your company uses Microsoft Entra ID with P2 licenses. You want to require approval for users to activate the Global Administrator role. Which feature should you configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time privileged access, including the ability to require approval for role activation. By configuring PIM for the Global Administrator role, you can enforce that users must request activation and receive approval before gaining the role's permissions, ensuring least-privilege and auditability.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access reviews

Question 3

A security team needs to detect and investigate suspicious activities in their on-premises Active Directory environment, such as pass-the-hash attacks, Kerberoasting, and unusual service account behavior. They also want to integrate these alerts with Microsoft Defender for Cloud for a unified view across hybrid workloads. Which Microsoft security solution should they deploy on-premises?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to detect and investigate advanced threats in on-premises Active Directory environments, including pass-the-hash attacks, Kerberoasting, and anomalous service account behavior. It uses behavioral analytics and integrates directly with Microsoft Defender for Cloud to provide a unified view across hybrid workloads, enabling security teams to correlate on-premises AD signals with cloud alerts.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Question 4

A company uses Microsoft Intune to manage its devices. The security team wants to enforce that all devices running Windows 11 must have BitLocker enabled and a minimum operating system build version. Which Intune policy type should they use?

Accepted Answer

Compliance policy. Compliance policies in Microsoft Intune define the rules and settings that devices must meet to be considered compliant, such as requiring BitLocker encryption and a minimum OS build version. When a device fails to meet these conditions, Intune can mark it as non-compliant and trigger conditional access policies to block access to corporate resources. This makes compliance policy the correct choice for enforcing security baselines like BitLocker and OS version requirements.

Answer

Configuration profile

Answer

Enrollment restriction

Answer

App protection policy

Question 5

A security team wants to discover which cloud applications are being used by employees, including unsanctioned file-sharing and collaboration apps. They plan to upload network traffic logs from their firewall to analyze app usage and risk levels. Which feature of Microsoft Defender for Cloud Apps should they enable?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes network traffic logs (uploaded from firewalls or proxies) to identify which cloud applications are in use, including unsanctioned file-sharing and collaboration apps. It provides a risk score for each discovered app, enabling the security team to assess usage and enforce governance policies.

Answer

App Governance

Answer

Conditional Access App Control

Answer

Information Protection

Question 6

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender XDR. The security team needs to determine if the file 'invoice.docm' is known malware and if other devices in the organization have this file. What should they do next?

Accepted Answer

Search in Advanced Hunting for the file's SHA256 hash across all devices. Searching for the file's SHA256 hash in Advanced Hunting allows the security team to query across all devices in the organization to determine if the file is known malware (by cross-referencing with threat intelligence) and to identify which other devices have the same file. Advanced Hunting in Microsoft Defender XDR supports Kusto Query Language (KQL) queries against the DeviceFileEvents table, enabling hash-based file discovery and reputation checks.

Answer

Isolate the device DESKTOP-01 immediately

Answer

Trigger the automated investigation for this alert

Answer

Review the user jdoe's recent activities

Question 7

A company uses Microsoft Entra ID. The security manager wants to provide temporary, time-bound elevated access to the Global Administrator role only when needed, and require approval from a designated approver. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing users to activate the Global Administrator role for a limited, time-bound duration only when needed, and it enforces approval workflows from designated approvers. This directly matches the security manager's requirement for temporary, approval-based elevation.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Identity Governance (Access Reviews)

Question 8

A user reports that they cannot access the corporate portal after a password reset. The user can access other cloud apps. You verify that the user account is enabled and not locked. What should you check next?

Accepted Answer

Verify the user's registered authentication methods. The user can access other cloud apps, which rules out a global authentication or network issue. Since the account is enabled and not locked, the most likely cause is that the user's registered authentication methods (e.g., phone, authenticator app, or email) are missing, outdated, or not configured for the password reset flow. Microsoft Entra ID requires verified authentication methods to complete a password reset and subsequent sign-in, especially when the user is prompted for multifactor authentication or self-service password reset (SSPR) verification.

Answer

Disable and re-enable the user account

Answer

Reinstall the corporate portal application

Answer

Check if the user is assigned a Microsoft Entra ID P2 license

Question 9

A company uses Microsoft Entra ID. The security team wants to configure a policy so that when a user signs in from an unfamiliar location (not on the company's trusted IP ranges) or from an unfamiliar device, they are prompted for additional verification (e.g., MFA). However, if the sign-in is from a trusted location (e.g., office IP range) and a known device, no additional verification is required. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it allows administrators to define policies that evaluate sign-in context—such as user location (via named locations with trusted IP ranges) and device state (compliant or hybrid Microsoft Entra ID joined)—and then enforce actions like requiring MFA only when conditions are not met. This directly matches the requirement to prompt for additional verification from unfamiliar locations or devices while skipping it for trusted ones.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Access Reviews

Question 10

A security architect is designing a Zero Trust strategy. Which principle ensures that network location alone does not grant trust, and all access requests must be verified?

Accepted Answer

Verify explicitly. The 'Verify explicitly' principle is the core of Zero Trust, stating that every access request must be authenticated and authorized based on all available data points—including user identity, device health, location, and data sensitivity—regardless of network location. This ensures that being on a corporate network does not automatically grant trust, as all requests are verified in real time.

Answer

Least privilege

Answer

Assume breach

Answer

Segregation of duties

Question 11

Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID capability helps verify the identity of users before granting access to resources?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (D) is the correct answer because it directly addresses the Zero Trust principle of 'verify explicitly' by using real-time risk detection and conditional access policies to verify user identity before granting access. It evaluates sign-in risk, user risk, and enforces policies like multi-factor authentication (MFA) or blocking access when suspicious activity is detected, ensuring that only legitimate users can access resources.

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Governance

Question 12

A company uses Salesforce and Box as cloud apps. The security team discovers that a third-party OAuth app with excessive permissions was granted access to Salesforce data by a user. They want a solution that can detect such risky OAuth apps and automatically revoke their permissions based on policy. Which Microsoft security solution provides this capability?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is a Cloud Access Security Broker (CASB) that provides visibility into third-party OAuth apps connected to cloud services like Salesforce and Box. It can detect OAuth apps with excessive permissions and automatically revoke them based on conditional access or app governance policies, making it the correct solution for this scenario.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 13

A user receives a sensitivity label that automatically marks the email as 'Confidential' and prevents forwarding. The label was applied without user intervention. Which mechanism most likely applied the label?

Accepted Answer

Auto-classification via DLP policy. Auto-classification via DLP policy can automatically apply sensitivity labels based on sensitive content, such as credit card numbers, enabling the label to be applied without user intervention. Option A is incorrect because the Azure Information Protection file policy applies to files in Windows File Explorer, not emails. Option C is incorrect because a default label applies to all unlabeled emails but does not use content detection. Option D is incorrect because manual labeling requires the user to select the label.

Answer

Azure Information Protection file policy

Answer

Default label configured in Microsoft 365

Answer

Manual labeling by the user

Question 14

Your organization plans to migrate from on-premises Active Directory to Microsoft Entra ID. You need to design the identity synchronization strategy to support password hash synchronization and password writeback. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct tool because it supports both password hash synchronization and password writeback, which are required for the migration scenario. Password hash sync synchronizes a hash of the on-premises AD password to Entra ID, while password writeback enables password changes in the cloud to be written back to on-premises AD. Entra Connect is the primary hybrid identity tool that integrates on-premises directories with Microsoft Entra ID, offering these features natively.

Answer

Microsoft Identity Manager

Answer

Active Directory Federation Services

Answer

Microsoft Entra Cloud Sync

Question 15

A company uses a hashing algorithm to verify that a downloaded software file has not been tampered with during transmission. This practice primarily protects which security principle?

Accepted Answer

Integrity. Hashing algorithms, such as SHA-256, produce a fixed-size hash value that acts as a digital fingerprint of the file. By comparing the hash of the downloaded file with the hash provided by the publisher, any change to the file—even a single bit—results in a completely different hash, immediately detecting tampering. This directly protects the integrity of the data by ensuring it has not been altered during transmission.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 16

Match each compliance framework to its primary focus.

Accepted Answer

GDPR: Focuses on data privacy and protection for individuals in the EU. Correct matches: GDPR = data privacy, ISO 27001 = information security management, SOC 2 = trust service criteria. Common confusions include mixing GDPR with financial controls (SOX) or privacy with broader security.

Answer

GDPR: Focuses on financial reporting controls

Answer

ISO 27001: Focuses on data privacy for EU citizens

Answer

SOC 2: Focuses on international trade regulations

Question 17

A company wants to prevent users from setting weak passwords that are commonly found in leaked databases. They use Microsoft Entra ID (Microsoft Entra ID). Which feature should they enable?

Accepted Answer

Microsoft Entra ID Password Protection. Microsoft Entra ID Password Protection is the correct feature because it specifically blocks weak passwords by comparing them against a global list of commonly compromised passwords (e.g., from leaked databases) and an optional custom banned password list. This feature enforces password strength at the time of creation or reset, preventing users from setting passwords that appear in known breaches.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Conditional Access

Question 18

A legal team is preparing for litigation and needs to collect relevant data from Microsoft Teams chats, email, and SharePoint documents. They need to place a hold on the data to prevent deletion, review it, and then use advanced analytics such as relevance ranking and email threading to reduce the review set. Which Microsoft Purview solution should they use to perform these tasks?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) is the correct solution because it provides the full lifecycle of legal hold, collection, review, and advanced analytics such as relevance ranking, email threading, and predictive coding. These capabilities are specifically designed for complex litigation scenarios, whereas the Standard edition lacks the advanced analytics features needed to reduce the review set.

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Copilot

Answer

Microsoft Purview Compliance Manager

Question 19

A company uses Microsoft 365 and wants to automatically detect when employees attempt to share credit card numbers in emails or Microsoft Teams messages. The company also wants to block the message if it contains such sensitive data, and notify the sender with a policy tip. Which Microsoft Purview solution should the administrator configure?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, block, and notify users when sensitive data—such as credit card numbers—is shared in emails or Teams messages. DLP policies can be configured with built-in sensitive information types (e.g., credit card number) and actions like blocking the message and sending a policy tip to the sender.

Answer

Data Lifecycle Management

Answer

Information Protection (Sensitivity labels)

Answer

Insider Risk Management

Question 20

Your organization is implementing a new policy to ensure that only authorized users can access sensitive financial data stored in Microsoft SharePoint Online. The security team wants to enforce multi-factor authentication (MFA) for all users accessing this data, but only when accessing from outside the corporate network. Which Microsoft Entra ID conditional access policy setting should you configure to meet this requirement?

Accepted Answer

Grant access requiring multi-factor authentication when the location is not trusted. The requirement is to enforce MFA for all users accessing sensitive financial data in SharePoint Online, but only when accessing from outside the corporate network. This is achieved by creating a Conditional Access policy that targets the SharePoint Online app, includes all users, and sets the condition to 'any location' excluding trusted locations, then grants access with the requirement of multi-factor authentication.

Answer

Use app-enforced restrictions for SharePoint

Answer

Grant access requiring device to be marked as compliant when location is not trusted

Answer

Block access when the location is not trusted