SC-900 Practice Exam 51 — 20 Questions

Question 1

A financial services firm uses Microsoft Purview Information Barriers to prevent traders from communicating with investment bankers. A new employee in the trading department cannot access a SharePoint site used for compliance training. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the employee to the 'Traders' segment in Microsoft Purview Information Barriers.. Microsoft Purview Information Barriers use segments to group users based on their organizational roles. Adding the new employee to the 'Traders' segment ensures that the Information Barrier policy applies to them correctly, allowing them to access the compliance training SharePoint site while still being blocked from communicating with investment bankers.

Answer

Add the employee to the 'Traders' Microsoft 365 group.

Answer

Use the 'Override' option in the Information Barrier policy.

Answer

Disable the Information Barrier policy for the trading department.

Question 2

Your organization uses Microsoft Purview to classify documents containing health information. You need to ensure that only users with explicit permission can access these documents. Which Microsoft Purview capability should you use?

Accepted Answer

Sensitivity labels with encryption. Sensitivity labels with encryption are the correct choice because they allow you to classify documents containing health information and apply encryption to restrict access to only users with explicit permissions. This ensures that even if the document is shared or moved, only authorized users can decrypt and read it, meeting the requirement for access control.

Answer

Audit logs

Answer

Retention policies

Answer

Data Loss Prevention

Question 3

Your organization uses Microsoft Entra ID. Which TWO features help protect against identity-based attacks by detecting and responding to risks?

Accepted Answer

Conditional Access. Conditional Access is correct because it enforces policy-based access controls that evaluate real-time signals (e.g., user location, device compliance, sign-in risk) to block or challenge suspicious sign-in attempts, directly mitigating identity-based attacks. Identity Protection is correct because it uses machine learning to detect risk signals such as leaked credentials, anonymous IP addresses, and atypical travel, then automatically triggers remediation actions like requiring password reset or blocking access.

Answer

Privileged Identity Management

Answer

Access reviews

Answer

Entitlement management

Question 4

Your organization uses Microsoft Purview Information Barriers to prevent certain user groups from communicating with each other. You need to test the configuration before fully enforcing it. What should you do?

Accepted Answer

Run the Information Barriers policy in test mode. Microsoft Purview Information Barriers include a dedicated test mode that allows administrators to validate policy behavior against user segments before enforcement. Running the policy in test mode evaluates whether communications between specified segments are correctly blocked or allowed, without actually preventing messages, enabling safe validation of the configuration.

Answer

Define user segments in the Microsoft Purview compliance portal

Answer

Enable audit logging and then run the policy application

Answer

Use the Compliance Manager assessment for Information Barriers

Question 5

A company uses Microsoft Intune for mobile device management (MDM). They need to ensure that corporate data on personal devices is encrypted. Which configuration profile type should they deploy?

Accepted Answer

Device restrictions profile. Device restrictions profile in Microsoft Intune allows administrators to enforce device-level security settings, including encryption of corporate data on personal devices. This profile type can require BitLocker (Windows) or FileVault (macOS) encryption, and for mobile devices, it can mandate device encryption via policies that align with platform-specific encryption standards (e.g., Android's full-disk encryption or iOS Data Protection). By deploying a device restrictions profile with encryption settings enabled, the organization ensures that corporate data stored on the device is protected at rest.

Answer

Email profile

Answer

Certificate profile

Answer

Compliance policy

Question 6

Your organization uses Microsoft Purview to label documents. Users report that some documents are automatically labeled as 'Confidential' even though the content is public. Which action should you take to resolve this issue?

Accepted Answer

Review and adjust the auto-labeling rules in the sensitivity label policies. The issue is that auto-labeling rules are incorrectly classifying public content as 'Confidential'. By reviewing and adjusting the auto-labeling rules in the sensitivity label policies, you can refine the conditions (e.g., sensitive info types or pattern matching) to prevent false positives. This directly addresses the misconfiguration causing automatic labeling of non-sensitive content.

Answer

Enable auditing to track label usage

Answer

Disable auto-labeling in all sensitivity label policies

Answer

Require users to manually apply labels

Question 7

A university wants to provide its students with a verifiable digital transcript that the students can share with potential employers. The university uses Microsoft Entra Verified ID to issue credentials. When an employer wants to verify a student's transcript, they scan a QR code or receive a link. Which Microsoft Entra ID feature allows the university to issue these tamper-proof credentials and allows employers to verify them without contacting the university directly?

Accepted Answer

Microsoft Entra Verified ID. Microsoft Entra Verified ID (option C) is the correct answer because it is the decentralized identity solution built on open standards (W3C Decentralized Identifiers and Verifiable Credentials) that allows the university to issue tamper-proof digital credentials. Employers can verify these credentials independently by scanning a QR code or following a link, without needing to contact the university, because the verification is done cryptographically against the issuer's public DID on a distributed ledger.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Permissions Management

Question 8

A multinational company deploys Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. The compliance team reports that a DLP policy blocks a legitimate payment processing workflow. What should the compliance administrator do to allow the workflow while maintaining protection?

Accepted Answer

Configure a DLP policy tip that allows users to override the block with a business justification.. DLP policy tips allow users to override a block by providing a business justification, which enables legitimate workflows to proceed while maintaining data protection. This approach ensures that the payment processing workflow is not permanently blocked, but the override is auditable and subject to compliance review. It balances security and operational needs without disabling or weakening the DLP policy.

Answer

Add the payment processing server to the DLP policy’s allow list.

Answer

Reduce the minimum confidence level in the DLP policy.

Answer

Disable the DLP policy for the payment processing department.

Question 9

Refer to the exhibit. You run the Azure PowerShell command for a storage account. What is the current network access configuration?

Accepted Answer

The storage account is not accessible from any network.. The Azure PowerShell command `Update-AzStorageAccountNetworkRuleSet -ResourceGroupName 'RG1' -StorageAccountName 'stgacc1' -DefaultAction Deny` sets the default network access rule to Deny. When the default action is Deny, no traffic is allowed unless explicitly permitted by a network rule (e.g., from a specific virtual network or IP address). Since no such rules are shown in the exhibit, the storage account is effectively not accessible from any network.

Answer

The storage account is accessible only from specific virtual networks.

Answer

The storage account is accessible from all networks.

Answer

The storage account is accessible only from specific IP addresses.

Question 10

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to ensure that only devices that are enrolled in Intune and compliant with your organization's security policies can access corporate email. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it enforces policy-based access controls that evaluate device compliance status reported by Microsoft Intune. By configuring a Conditional Access policy to require 'Device to be marked as compliant,' only devices enrolled in Intune and meeting security policies can access corporate email, leveraging the integration between Entra ID and Intune.

Answer

Microsoft Entra Entitlement Management

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Terms of Use

Question 11

A security operations center (SOC) team uses Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) enabled. They notice an alert about a user accessing a sensitive HR application from an unusual IP address at 3 AM. What does UEBA primarily use to detect this anomaly?

Accepted Answer

Historical behavior baselines and machine learning. UEBA in Microsoft Sentinel detects anomalies by establishing a baseline of normal user behavior over time—such as typical login times, locations, and accessed applications—using machine learning models. When a user accesses a sensitive HR app from an unusual IP at 3 AM, the deviation from this learned baseline triggers an alert, not a static rule or manual input.

Answer

Static rule-based thresholds defined by the SOC

Answer

Manual input from the SOC team

Answer

Threat intelligence feeds from Microsoft

Question 12

Your organization uses Microsoft Entra ID with P1 licenses. You need to provide a temporary access pass for a new employee to set up their account without a password. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra Temporary Access Pass. The Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator that allows a user to register passwordless authentication methods (e.g., Microsoft Authenticator, FIDO2 security key) without needing an existing password. This directly meets the requirement for a new employee to set up their account without a password, and it is available with Microsoft Entra ID P1 licenses.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Verified ID

Question 13

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to synchronize user passwords and enable password writeback for self-service password reset. Which tool should you use?

Accepted Answer

Microsoft Entra Connect Sync. Microsoft Entra Connect Sync (formerly Azure AD Connect) is the correct tool because it synchronizes on-premises Active Directory objects, including password hashes, to Microsoft Entra ID and supports password writeback, which enables self-service password reset (SSPR) to write changed passwords back to on-premises AD. The question specifically requires both password synchronization and writeback, which are core features of Entra Connect Sync.

Answer

Microsoft Entra admin center

Answer

Active Directory Federation Services (AD FS)

Answer

Azure AD Connect (deprecated)

Question 14

An organization needs to automatically apply a 'Highly Confidential' sensitivity label to all documents that contain a specific custom sensitive information type. The label should be applied when the document is created or modified. Which feature of Microsoft Purview Information Protection should be used?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview Information Protection are designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types. This feature supports both simulation and real-time enforcement, and it can be triggered when documents are created or modified, meeting the organization's requirement exactly.

Answer

Manual sensitivity labeling

Answer

Data Loss Prevention (DLP) policies

Answer

Communication Compliance policies

Question 15

Your organization uses Microsoft Copilot for Security. You want to use natural language to generate a KQL query for threat hunting. What should you do?

Accepted Answer

Use the Copilot prompt bar in the Microsoft Defender portal.. Microsoft Copilot for Security is integrated directly into the Microsoft Defender portal, allowing security analysts to use natural language prompts to generate KQL queries for threat hunting. The Copilot prompt bar interprets the natural language input and converts it into the appropriate KQL syntax, eliminating the need for manual query writing.

Answer

Manually write the KQL query in the advanced hunting page.

Answer

Install the Copilot add-in for Sentinel.

Answer

Subscribe to Microsoft 365 Copilot.

Question 16

Your company wants to protect sensitive data in Microsoft Teams. Which two Microsoft Purview features can help prevent accidental sharing of confidential information? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policies for Teams. Data Loss Prevention (DLP) policies for Teams can detect and block sharing of sensitive information (e.g., credit card numbers, social security numbers) in Teams messages and channels, preventing accidental exposure. Sensitivity labels allow you to classify and protect Teams sites and content by applying encryption, visual markings, and access restrictions, ensuring confidential data is not shared with unauthorized users.

Answer

Audit log search for Teams

Answer

eDiscovery for Teams

Answer

Retention policies for Teams messages

Question 17

Your company, Proseware, uses Microsoft Entra ID P2. You have a custom application that integrates with Microsoft Graph API to read user profiles. The application uses client credentials flow (application permissions). You need to ensure that the application can only read user profiles and not perform any other operations. Additionally, you want to review and approve the permissions periodically. What should you do?

Accepted Answer

In Microsoft Entra ID, grant the application the User.Read.All permission and configure an access review for the application permissions.. The application uses client credentials flow (application permissions), which requires granting an application permission like User.Read.All to read all user profiles. Configuring an access review for the application permissions in Microsoft Entra ID allows periodic review and approval of those permissions, meeting the requirement to ensure the app can only read user profiles and that permissions are reviewed periodically.

Answer

Create a Conditional Access policy to restrict the app to read-only operations.

Answer

Enable Privileged Identity Management for the app and require approval for each API call.

Answer

Use delegated permissions for the application and assign users to the app role.

Question 18

Which TWO are capabilities of Microsoft Entra ID Protection?

Accepted Answer

Risk-based conditional access policies. Microsoft Entra ID Protection uses risk-based conditional access policies to automatically respond to detected risks, such as blocking access or requiring multi-factor authentication, based on real-time risk levels. Option E is correct because Entra ID Protection continuously monitors for leaked credentials by analyzing known credential breaches and flagging accounts whose credentials have been exposed, enabling proactive remediation.

Answer

Device enrollment policies

Answer

Self-service password reset

Answer

Privileged role activation

Question 19

A manufacturing company experiences repeated ransomware attacks targeting their on-premises file servers. They have Microsoft 365 E5 and want to implement a solution to detect and automatically respond to such threats across hybrid environments. What should they deploy?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity is the correct solution because it uses on-premises Active Directory signals to detect, investigate, and respond to advanced threats like ransomware targeting hybrid environments. It integrates with Microsoft 365 Defender to automatically initiate response actions (e.g., disabling compromised accounts) when suspicious lateral movement or credential theft is detected, directly addressing the scenario of repeated ransomware attacks on on-premises file servers.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Question 20

A compliance officer needs to create a policy that automatically detects and blocks the sharing of credit card numbers in emails and Teams messages. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and automatically block sensitive information, such as credit card numbers, from being shared in emails and Teams messages. DLP uses built-in sensitive information types (e.g., Credit Card Number) and policies that can enforce actions like blocking the message or sending an alert, directly meeting the compliance officer's requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection