SC-900 Practice Exam 52 — 20 Questions

Question 1

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. You need to ensure that when a user attempts to share a document containing a credit card number via email, the email is blocked and the user receives a policy tip. Which action should you configure in the DLP policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Block with user notification. The 'Block with user notification' action in a Microsoft Purview DLP policy blocks the email when sensitive data like credit card numbers is detected and simultaneously shows the user a policy tip explaining why. This matches both requirements: blocking the email and notifying the user.

Answer

Notify user

Answer

Audit only

Answer

Block override

Question 2

A company wants to ensure that emails containing credit card numbers are blocked from being sent externally. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and protect sensitive data, such as credit card numbers, by scanning email content and attachments. When a DLP policy is configured to block external sharing of this sensitive information, it can automatically prevent the email from being sent, ensuring compliance with data protection regulations.

Answer

Sensitivity labels

Answer

Communication compliance

Answer

Information barriers

Question 3

Your organization uses Microsoft Purview for data governance. You need to ensure that when a user marks an email as 'Confidential' using a sensitivity label, the email is automatically encrypted and cannot be forwarded. What configuration is required?

Accepted Answer

Configure the sensitivity label with encryption and a rights management template that prohibits forwarding. Microsoft Purview sensitivity labels can be configured with encryption settings that use Azure Rights Management (Azure RMS) to enforce usage restrictions. By selecting the 'Do Not Forward' template, the email is automatically encrypted and the recipient cannot forward, copy, or print the message, meeting the requirement.

Answer

Create a DLP policy that detects the 'Confidential' label and applies encryption

Answer

Use the Azure Information Protection unified labeling scanner

Answer

Apply a retention label that triggers encryption

Question 4

You are a security analyst using Microsoft Sentinel. You run the following Kusto query:

SecurityAlert
| where TimeGenerated > ago(7d)
| where AlertName contains "MFA"
| summarize Count = count() by bin(TimeGenerated, 1d)
| render timechart

What does this query do?

Accepted Answer

Counts security alerts containing 'MFA' per day for the last 7 days. The query filters the SecurityAlert table to the last 7 days, keeps only alerts whose AlertName contains 'MFA', then summarizes by counting rows grouped into 1-day bins of TimeGenerated, and renders the result as a time chart. The output is therefore a daily count of MFA-related security alerts over the past week.

Answer

Lists all identities that triggered MFA alerts

Answer

Counts distinct users with MFA alerts per day

Answer

Counts alerts by severity over the last week

Question 5

You are investigating a potential data leak. You need to find all emails that contain the word 'confidential' sent to external recipients in the last 30 days. Which Microsoft Purview tool should you use?

Accepted Answer

Content Search. Content Search (option C) is the correct tool because it allows you to perform targeted eDiscovery searches across Exchange Online mailboxes, including searching for specific keywords like 'confidential' and filtering by date range and recipient type (external recipients). It provides the exact capability to locate all emails containing the word 'confidential' sent to external recipients in the last 30 days, making it the appropriate choice for investigating a potential data leak.

Answer

Communication Compliance

Answer

Audit Log Search

Answer

Data loss prevention (DLP) policy

Question 6

An organization uses Microsoft Intune to manage devices. They want to ensure that only devices that are compliant with security policies (e.g., encryption enabled, latest patches) can access corporate email. Which Microsoft Entra feature should they use to enforce this requirement?

Accepted Answer

Conditional Access in Microsoft Entra ID. Conditional Access in Microsoft Entra ID is the policy engine that evaluates signals (user, device, location, app) and enforces access decisions such as requiring a compliant device before granting access to corporate email. It specifically integrates with Intune's device compliance status via the 'Require device to be marked as compliant' grant control, blocking non-compliant devices from Exchange Online and other cloud apps.

Answer

Microsoft Defender for Endpoint

Answer

Device compliance policies in Microsoft Intune

Answer

Azure AD Join

Question 7

Your organization uses Microsoft Purview to classify sensitive data. You need to create a custom sensitive information type that detects employee IDs matching the pattern 'EMP-XXXXX' (where X is a digit). Which rule pack element must you define?

Accepted Answer

Regular expression. A custom sensitive information type (SIT) in Microsoft Purview is built from one or more pattern-matching elements; to detect a structured pattern like 'EMP-XXXXX' where X is a digit, you must define a regular expression (regex) that matches the literal 'EMP-' followed by exactly five digits. Regex is the only rule-pack element that can express this positional, character-class pattern. Supporting elements like keyword lists or functions can raise confidence but cannot define the pattern itself.

Answer

Keyword list

Answer

Data store reference

Answer

Function

Question 8

A security administrator receives an alert about a suspicious sign-in from an unfamiliar location. The user verified the sign-in as legitimate. Which Microsoft Entra ID feature should be used to reduce false positives for this user?

Accepted Answer

Identity Protection confirm user safe. Microsoft Entra ID Identity Protection's 'Confirm user safe' feature allows administrators to manually override a risk detection when a user confirms a suspicious sign-in was legitimate. This reduces false positives by telling Identity Protection to ignore that specific risk event for that user, preventing future alerts based on the same detection.

Answer

Passwordless authentication

Answer

Privileged Identity Management

Answer

Conditional Access policies

Question 9

Order the steps to create a conditional access policy in Azure AD.

Accepted Answer

Sign in, navigate to Conditional Access, create new policy, configure assignments and controls, enable policy and create.. Creating a conditional access policy requires admin sign-in, navigating to Conditional Access, creating a new policy, configuring assignments and controls, then enabling it.

Answer

Sign in, navigate to Conditional Access, create new policy, enable policy, then configure assignments and controls.

Answer

Navigate to Conditional Access, sign in, create new policy, configure assignments and controls, enable policy.

Answer

Sign in, create new policy, navigate to Conditional Access, configure assignments and controls, enable policy.

Question 10

Order the steps to respond to a data breach using Microsoft 365 Defender incident response.

Accepted Answer

Identify the breach, then Isolate affected systems, then Investigate the scope and impact, then Contain the threat, then Remediate. Incident response typically starts with identification, isolation, investigation, containment, then remediation.

Answer

Identify the breach, then Investigate the scope and impact, then Contain the threat, then Isolate affected systems, then Remediate

Answer

Contain the threat, then Identify the breach, then Investigate the scope and impact, then Isolate affected systems, then Remediate

Answer

Identify the breach, then Isolate affected systems, then Remediate, then Investigate the scope and impact, then Contain the threat

Question 11

Arrange the steps to investigate a user compromise using Azure AD Identity Protection.

Accepted Answer

Access the Azure AD Identity Protection portal, then review the risky users report, then select a specific user, then analyze the risk events for that user, then take remediation action.. Identity Protection investigation involves accessing the portal, reviewing risks, selecting a user, analyzing events, and taking action.

Answer

Access the Azure AD Identity Protection portal, then select a specific user, then analyze the risk events for that user, then review the risky users report, then take remediation action.

Answer

Access the Azure AD Identity Protection portal, then review the risky users report, then take remediation action, then select a specific user, then analyze the risk events.

Answer

Access the Azure AD Identity Protection portal, then analyze the risk events, then review the risky users report, then select a specific user, then take remediation action.

Question 12

Sequence the steps to configure a retention policy in Microsoft Purview compliance portal.

Accepted Answer

Sign in to Compliance Portal, navigate to Retention, create a new retention policy, select locations and conditions, set retention duration.. Retention policies require signing in, navigating to retention, creating a policy, selecting locations/conditions, and setting duration.

Answer

Navigate to Retention, sign in to Compliance Portal, create a new retention policy, select locations and conditions, set retention duration.

Answer

Sign in to Compliance Portal, navigate to Retention, select locations and conditions, create a new retention policy, set retention duration.

Answer

Sign in to Compliance Portal, create a new retention policy, navigate to Retention, select locations and conditions, set retention duration.

Question 13

Which THREE are features of Microsoft Defender for Cloud?

Accepted Answer

Just-in-time VM access. Just-in-time (JIT) VM access (A) is a Defender for Cloud capability that blocks inbound management ports (RDP 3389, SSH 22) by default and opens them only for approved, time-limited requests, reducing the attack surface of Azure VMs. Secure Score (B) is a core Defender for Cloud feature that continuously assesses resources against security recommendations and expresses the resulting posture as a percentage score with remediation guidance. The regulatory compliance dashboard (D) is also a Defender for Cloud feature that maps assessments to standards such as PCI DSS, ISO 27001, and NIST SP 800-53 and shows compliance state per control. Data classification (C) belongs to Microsoft Purview Information Protection, not Defender for Cloud, and incident investigation (E) is a Microsoft Defender XDR / Microsoft Sentinel capability rather than a Defender for Cloud feature.

Answer

Data classification

Answer

Incident investigation

Question 14

Your organization needs to retain all email communications with customers for 7 years due to regulatory requirements. Which Microsoft Purview solution should you use?

Accepted Answer

Retention policies. Retention policies in Microsoft Purview are designed to retain data for a specified period to meet regulatory or legal requirements. For email communications, a retention policy can be applied to Exchange mailboxes to ensure all messages are preserved for exactly 7 years, regardless of user deletion. This directly addresses the need to retain all customer emails for the mandated duration.

Answer

Sensitivity labels

Answer

eDiscovery (Standard)

Answer

Data Loss Prevention policies

Question 15

Your organization has implemented Microsoft Defender for Cloud to protect Azure resources. You are responsible for security posture management. You need to ensure that all Azure VMs have the latest security updates installed. You have enabled automatic VM patching via Azure Update Manager. However, some VMs are not receiving updates because they are not registered with the Update Manager. You need to identify which VMs are missing updates and ensure they are patched. What should you do?

Accepted Answer

Use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs.. The Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' is specifically designed to assess the security update status of your VMs and identify which ones are missing patches. Once identified, you can enable auto-patching for those VMs through Azure Update Manager, ensuring they receive updates. This approach directly addresses the requirement to both identify and remediate unpatched VMs.

Answer

Create an Azure Policy to enforce automatic updates on all VMs.

Answer

Review Microsoft Defender for Cloud security alerts for 'Missing system updates'.

Answer

Use Azure Update Manager's compliance view to export a list of VMs with missing updates.

Question 16

Your organization has a Microsoft Purview compliance portal. You need to audit who deleted a specific file from SharePoint Online last week. What should you do?

Accepted Answer

Search the unified audit log in Microsoft Purview. The unified audit log in Microsoft Purview records all user and admin activities, including file deletions in SharePoint Online. By searching this log, you can find the specific event that shows who deleted the file, when it happened, and from which location. This is the correct tool for auditing past actions like file deletions.

Answer

Use Content Search in eDiscovery

Answer

Configure a retention policy for SharePoint

Answer

Review the data classification dashboard

Question 17

Your organization wants to use Microsoft Entra ID to provide single sign-on (SSO) for a third-party SaaS application. What must you configure in Microsoft Entra ID?

Accepted Answer

Enterprise application registration. To provide SSO for a third-party SaaS application using Microsoft Entra ID, you must configure an enterprise application registration, which represents the application in your tenant and enables SAML or OIDC-based SSO. This registration includes the necessary configuration for single sign-on, such as the reply URL and claims.

Answer

Identity Protection policy

Answer

Conditional Access policy

Answer

Self-service password reset

Question 18

A multinational corporation uses Microsoft Entra ID. The IT department wants to allow regional IT administrators in Europe to manage users and groups only for their own region, without granting them permissions to manage users in other regions. Which Microsoft Entra ID feature should they use?

Accepted Answer

B. Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions scoped to a subset of users, groups, or devices. By creating an AU for the Europe region and assigning regional IT administrators to it, you restrict their management scope to only those objects within that AU, preventing them from managing users in other regions.

Answer

A. Conditional Access

Answer

C. Privileged Identity Management

Answer

D. Identity Governance

Question 19

A healthcare organization must comply with HIPAA regulations. They use Microsoft Purview to classify and label patient data. Which Microsoft Purview capability helps them enforce data protection policies automatically?

Accepted Answer

Data loss prevention (DLP) policies. Data loss prevention (DLP) policies in Microsoft Purview are designed to automatically detect sensitive information (such as HIPAA-regulated data) and enforce protection actions like blocking sharing or applying encryption. DLP uses sensitivity labels and sensitive information types to identify content and then applies policy actions automatically across Exchange, SharePoint, OneDrive, and Teams. This directly enforces data protection policies without manual intervention.

Answer

eDiscovery

Answer

Audit logs

Answer

Sensitivity labels

Question 20

You are reviewing a conditional access policy in Microsoft Entra ID. The policy is enabled, applies to all cloud apps, and is configured to include users assigned to the Global Administrator or Exchange Administrator roles. Which users are affected by this policy?

Accepted Answer

All users who are members of the Global Administrator or Exchange Administrator role. The conditional access policy includes users assigned to the Global Administrator or Exchange Administrator roles. Therefore, only users with those specific roles are affected. It does not include all administrative roles or all users in the organization.

Answer

All users who are members of any Azure AD administrative role

Answer

All users who are members of the Global Administrator role only

Answer

All users in the organization