SC-900 Practice Exam 52 — 20 Questions

Question 1

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' sensitivity label to any document that contains a Social Security number. What should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An auto-labeling policy for sensitivity labels. An auto-labeling policy for sensitivity labels in Microsoft Purview can automatically apply a 'Confidential' sensitivity label to documents containing sensitive information types like Social Security numbers. This policy uses content scanning and pattern matching to detect the data and apply the label without user intervention, meeting the requirement for automatic classification.

Answer

A sensitivity label policy with manual labeling

Answer

A Data Loss Prevention (DLP) policy

Answer

A retention policy

Question 2

An organization has Microsoft Sentinel and Microsoft Defender XDR. They want to automatically block a user's sign-in if a high-risk alert is triggered. Which Microsoft Entra feature integrates with these products to enforce access controls?

Accepted Answer

Conditional Access with Identity Protection integration. Conditional Access with Identity Protection integration allows organizations to create policies that automatically block sign-ins when Microsoft Sentinel or Microsoft Defender XDR triggers a high-risk alert. This integration leverages risk signals from Identity Protection to enforce real-time access controls, such as blocking authentication, without manual intervention.

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 3

An organization uses Microsoft Defender for Cloud to secure its Azure workloads. They want to receive recommendations for improving the security posture of their virtual machines. What should they enable?

Accepted Answer

Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM). Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) provides continuous assessment of Azure workloads, including virtual machines, against security baselines and best practices. It generates actionable recommendations to improve the security posture, such as applying missing system updates or enabling encryption. This is the correct feature for receiving VM-specific security recommendations.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Answer

Azure Policy

Question 4

Your organization uses Microsoft Entra ID P2 licenses. You need to implement a process to automatically remove users from a group if they have not signed in for 90 days. Which feature should you use?

Accepted Answer

Access reviews in Identity Governance. Access reviews in Identity Governance allow you to automate the review and removal of group memberships based on inactivity criteria, such as users who haven't signed in for 90 days. This feature is specifically designed for periodic attestation and lifecycle management of group memberships, leveraging Microsoft Entra ID P2 licenses.

Answer

Conditional Access policy

Answer

Privileged Identity Management

Answer

Microsoft Entra ID Protection

Question 5

Your company uses Microsoft Entra ID with P1 licenses. You need to implement a policy that blocks access to Microsoft 365 from countries that are not authorized, except for users who are members of a specific security group. Which Microsoft Entra feature should you use?

Accepted Answer

Conditional Access policy with location condition and group exclusion.. D is correct because Conditional Access policies in Microsoft Entra ID allow you to define access controls based on location conditions, such as blocking access from specific countries. You can then exclude a security group from the block, ensuring that members of that group can still access Microsoft 365 from unauthorized countries. This directly meets the requirement of blocking access except for users in a specific group.

Answer

Microsoft Entra Identity Protection.

Answer

Microsoft Entra entitlement management.

Answer

Microsoft Entra B2B collaboration.

Question 6

Refer to the exhibit. The JSON shows a Conditional Access policy. What is the primary purpose of this policy?

Accepted Answer

Block legacy authentication protocols. The policy targets 'Block legacy authentication' by applying a condition that blocks authentication attempts using legacy protocols (e.g., POP3, IMAP4, SMTP, ActiveSync) which do not support modern authentication methods like MFA. This is a common security measure to prevent credential-stuffing and password-spray attacks that exploit the lack of MFA enforcement in legacy protocols.

Answer

Require MFA for all applications

Answer

Disable the policy for emergency access

Answer

Allow only iOS devices

Question 7

Refer to the exhibit. You are reviewing a Conditional Access policy JSON in Microsoft Entra ID. What will this policy do?

Accepted Answer

Block access when user risk is high. The policy JSON specifies `"userRiskLevels": ["high"]` and `"builtInControls": ["block"]`, meaning it blocks access when the user risk level is high. User risk reflects the likelihood that the user's identity is compromised, based on Microsoft's risk detection signals. Option D correctly identifies this behavior.

Answer

Block access when user risk is medium or high

Answer

Block sign-ins when sign-in risk is high

Answer

Require MFA when user risk is high

Question 8

Your organization is using Microsoft Entra Permissions Management (CIEM). You need to identify overprivileged identities in AWS. Which capability should you use?

Accepted Answer

Permissions Analytics Report. Permissions Analytics Report is the correct capability because it specifically analyzes permissions across AWS, Azure, and GCP to identify overprivileged identities, unused permissions, and risky actions. It generates a detailed report that highlights identities with excessive permissions, enabling remediation to enforce least privilege. This aligns directly with the CIEM (Cloud Infrastructure Entitlement Management) goal of reducing privilege risks.

Answer

Audit trail

Answer

Identity governance

Answer

Activity trail

Question 9

Refer to the exhibit. You are reviewing a Microsoft Purview classification rule. The rule is enabled and set to apply a sensitivity label. However, you notice that documents containing EU personal data are not being labeled automatically. What is the most likely cause?

Accepted Answer

The rule does not include a condition to detect sensitive data. The rule is enabled and applies a sensitivity label, but documents containing EU personal data are not being labeled automatically. For automatic labeling to occur, the classification rule must include a condition that detects sensitive data types (e.g., EU passport numbers or GDPR-defined personal data). Without such a condition, the rule has no trigger to identify the content and apply the label, even if the rule is active and scoped correctly.

Answer

The label ID is invalid

Answer

The rule status is Disabled

Answer

The rule is not scoped to SharePoint Online

Question 10

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender for Endpoint. The SOC team needs to decode the PowerShell command to understand the malicious intent. Which tool or method should they use?

Accepted Answer

Decode the Base64 string using a built-in decoder or online tool. The exhibit shows a PowerShell command encoded in Base64, which is a common obfuscation technique used by attackers to hide malicious intent. Decoding the Base64 string using a built-in decoder (e.g., `[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String()`) or an online tool directly reveals the plaintext command. This is the correct approach because Base64 is not encryption—it is an encoding scheme that can be reversed without any keys.

Answer

Search for the SHA256 hash in threat intelligence feeds

Answer

Decrypt the command using the device's decryption keys

Answer

Use PowerShell script block logging to capture the decoded command

Question 11

Which TWO Microsoft Purview solutions can be used to discover and classify sensitive data in Microsoft 365? (Select two.)

Accepted Answer

Information Protection. Information Protection (option B) provides the ability to discover, classify, and protect sensitive data across Microsoft 365 by using trainable classifiers and content scanning. Data Classification (option E) offers a unified view of sensitive data across the tenant, including classification results from sensitivity labels and retention labels, enabling administrators to identify and monitor sensitive information at scale.

Answer

Data Loss Prevention

Answer

Sensitivity labels

Answer

Audit

Question 12

Refer to the exhibit. An administrator runs this KQL query in Microsoft Purview Audit. What is the purpose of this query?

Accepted Answer

To identify file types that a specific user uploaded more than 10 times in the last 30 days. The KQL query uses `| summarize Count = count() by FileType` to group audit log entries by file type, then `| where Count > 10` filters for file types that appear more than 10 times. The `where UserId == 'user@domain.com'` restricts the results to a specific user, and `| where TimeGenerated > ago(30d)` limits the time range to the last 30 days. This directly identifies file types uploaded more than 10 times by that user, matching option D.

Answer

To find the total number of file uploads by all users in the last 30 days

Answer

To find files larger than a certain size uploaded by a specific user

Answer

To list all files deleted by a specific user in the last 30 days

Question 13

Refer to the exhibit. You are reviewing the results of a Microsoft Purview eDiscovery search. Which statement is correct about the search results?

Accepted Answer

The search returned results from both Exchange Online and SharePoint Online. The search results show items from both Exchange Online (email messages) and SharePoint Online (documents), as indicated by the 'Location' column listing both 'Exchange Online' and 'SharePoint Online' sources. This confirms that the eDiscovery search was configured to search across multiple workloads, returning results from both platforms.

Answer

The search only returned results from Exchange Online

Answer

The document is an email message

Answer

The email has an attachment

Question 14

Which TWO Microsoft Entra features can help protect against credential attacks?

Accepted Answer

Microsoft Entra password protection. Microsoft Entra password protection (C) helps defend against credential attacks by automatically blocking weak passwords and common variations of known compromised passwords, such as those from botnets or public password lists. Smart lockout (E) protects against brute-force attacks by locking an account after a configurable number of failed sign-in attempts, using intelligent heuristics to distinguish between legitimate users and attackers. Both features directly mitigate password-based attacks like password spraying and brute force.

Answer

Microsoft Entra Connect

Answer

Self-service password reset

Answer

Access reviews

Question 15

Refer to the exhibit. The Conditional Access policy is configured to block access for high-risk users. A user with a medium risk level attempts to sign in. What will happen?

Accepted Answer

Access is granted. The Conditional Access policy is configured to block access for high-risk users only. Since the user has a medium risk level, the policy condition is not met, so the policy does not apply. Therefore, access is granted based on the default behavior of allowing sign-in when no Conditional Access policy is triggered.

Answer

Access is blocked

Answer

User is redirected to a password reset page

Answer

User is prompted for MFA

Question 16

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all storage accounts have soft delete enabled to protect against accidental deletion. Which policy should you implement?

Accepted Answer

Azure Policy with a built-in policy for storage accounts. Azure Policy with a built-in policy for storage accounts is correct because it allows you to enforce organizational standards and assess compliance at scale. The built-in policy 'Storage accounts should have soft delete enabled' can be assigned to a subscription or resource group to automatically audit or remediate storage accounts that do not have soft delete configured, ensuring protection against accidental deletion.

Answer

Azure Blueprints

Answer

Azure role-based access control (RBAC)

Answer

Defender for Cloud security recommendations

Question 17

A healthcare organization must demonstrate compliance with HIPAA by assessing their current posture against regulatory controls, tracking improvement actions, and generating reports for auditors. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a built-in assessment template for HIPAA, enabling the organization to assess its current compliance posture against regulatory controls, track improvement actions, and generate auditor-ready reports. It offers a compliance score, automated control mapping, and evidence collection workflows specifically designed for regulatory frameworks like HIPAA.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Insider Risk Management

Question 18

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their existing Facebook accounts without creating a separate Microsoft Entra ID account. What should you configure?

Accepted Answer

Create a Microsoft Entra External ID tenant and add Facebook as an identity provider. Microsoft Entra External ID (formerly Azure AD B2C) is designed to allow external identities, such as social identity providers like Facebook, to authenticate users without requiring a separate Microsoft Entra ID account. By creating an External ID tenant and adding Facebook as an identity provider, you enable users to sign in using their existing Facebook credentials via OAuth 2.0 or OpenID Connect protocols.

Answer

Configure Microsoft Entra ID Protection

Answer

Enable Microsoft Entra ID Domain Services

Answer

Configure Microsoft Entra ID Governance

Question 19

A company uses Microsoft Entra ID. The IT department wants to automatically assign a Microsoft 365 E5 license to all users in the Sales department based on their department attribute. Which Microsoft Entra ID feature should they use?

Accepted Answer

Dynamic Groups. Dynamic Groups in Microsoft Entra ID allow automatic user membership based on user attributes, such as the department attribute. By creating a dynamic group rule like `user.department -eq "Sales"`, the system automatically assigns the group membership and can then apply a Microsoft 365 E5 license via group-based licensing.

Answer

Administrative Units

Answer

Identity Protection

Answer

Access Reviews

Question 20

A company wants to prevent users from using common passwords like 'Password123' and custom banned passwords such as 'Contoso2024' during sign-up or password change. They also need to apply a common list of banned passwords across tenant-wide. Which Microsoft Entra feature should they configure?

Accepted Answer

Microsoft Entra ID Password Protection. Microsoft Entra ID Password Protection allows administrators to enforce both a global banned password list (Microsoft-managed) and a custom banned password list (tenant-specific). This feature blocks weak passwords like 'Password123' and custom entries like 'Contoso2024' during sign-up or password change operations, making it the correct choice for tenant-wide password policy enforcement.

Answer

Conditional Access

Answer

Identity Protection

Answer

Multifactor Authentication (MFA)