SC-900 Practice Exam 53 — 20 Questions

Question 1

Refer to the exhibit. A security analyst in your SOC runs the provided KQL query in Microsoft Sentinel to identify users with repeated MFA or suspicious sign-in alerts. The query returns no results even though alerts exist. What is the most likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The alert names do not contain the strings 'MFA' or 'Suspicious sign-in'.. The KQL query filters SecurityAlert records using 'where AlertName has "MFA" or AlertName has "Suspicious sign-in"'. If the actual alert names in Microsoft Sentinel do not contain those exact substrings, the filter returns zero rows even though alerts exist. The most likely issue is therefore that the alert names do not match the strings used in the query.

Answer

The 'extend' operator fails because 'Entities' array is empty.

Answer

The TimeGenerated filter is too restrictive; alerts older than 7 days are excluded.

Answer

The 'has' operator is case-sensitive and the alert names are in uppercase.

Question 2

Refer to the exhibit. You are a security administrator for a company using Azure Virtual Network Manager. You have deployed the security admin configuration shown. What is the impact of this rule?

Accepted Answer

It blocks inbound SMB traffic from the internet to the subnet.. This security admin configuration in Azure Virtual Network Manager creates a rule that denies inbound traffic on port 445 (SMB) from the 'Internet' service tag to the target subnet. Since the rule has a priority of 100 (lowest number = highest priority) and the action is 'Deny', it overrides any lower-priority or default allow rules, effectively blocking inbound SMB traffic from the internet to the subnet. The rule does not affect outbound traffic or other protocols like RDP unless they are explicitly specified.

Answer

It blocks outbound traffic from the subnet to the internet.

Answer

It denies all traffic from the internet to the subnet.

Answer

It blocks inbound RDP traffic from the internet.

Question 3

Refer to the exhibit. You run the PowerShell command to search the unified audit log for file deletions. The command returns no results, but you know a file was deleted last week. What is the most likely reason?

Accepted Answer

Audit logging is not enabled for the organization. The most likely reason is that audit logging is not enabled for the organization. In Microsoft 365, unified audit log search requires that audit logging be explicitly turned on (by default, it is enabled for most tenants, but it can be disabled). If audit logging is disabled, no audit records are generated, so any search—including for 'FileDeleted' operations—will return no results, even if files were actually deleted.

Answer

The operation name 'FileDeleted' is incorrect

Answer

Audit logs are only retained for 90 days

Answer

The StartDate and EndDate are incorrect

Question 4

A company runs a web application in Azure that is publicly accessible. They want to protect it against large-scale distributed denial-of-service (DDoS) attacks from multiple sources. Which Azure service is specifically designed for this purpose?

Accepted Answer

Azure DDoS Protection. Azure DDoS Protection is specifically designed to safeguard Azure resources against large-scale distributed denial-of-service (DDoS) attacks. It leverages the global scale of Microsoft's network to absorb and mitigate multi-gigabit attacks, providing always-on traffic monitoring and adaptive tuning. This service is the only option among the choices that is purpose-built for DDoS mitigation at the network and transport layers (L3/L4), and it also offers application-layer (L7) protection when combined with Application Gateway WAF.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Question 5

Sequence the steps to set up Microsoft Sentinel for a new workspace.

Accepted Answer

Create Log Analytics workspace → Enable Microsoft Sentinel → Connect data sources → Create analytics rules → Set up automation. Setting up Sentinel requires a Log Analytics workspace, enabling Sentinel, connecting sources, creating rules, and automating responses.

Answer

Create Log Analytics workspace → Connect data sources → Enable Microsoft Sentinel → Create analytics rules → Set up automation

Answer

Create Log Analytics workspace → Enable Microsoft Sentinel → Create analytics rules → Connect data sources → Set up automation

Answer

Create Log Analytics workspace → Enable Microsoft Sentinel → Connect data sources → Set up automation → Create analytics rules

Question 6

A company operates an e-commerce website that must remain accessible during high-traffic holiday seasons. The IT team deploys additional web servers and implements automatic failover to a secondary data center if the primary site goes down. Which security principle is the company primarily addressing?

Accepted Answer

Availability. The company is ensuring that the e-commerce website remains operational even during high-traffic periods or after a primary site failure. Deploying additional web servers and implementing automatic failover to a secondary data center directly supports the availability principle, which ensures that systems and data are accessible when needed. This is a core tenet of the CIA triad, and in this scenario, the focus is on uptime and resilience, not on protecting data from unauthorized access or modification.

Answer

Confidentiality

Answer

Integrity

Answer

Authorization

Question 7

A company wants to proactively detect and investigate potential insider security risks, such as a departing employee copying large amounts of data to a personal USB drive or sharing confidential files with unauthorized individuals. Which Microsoft Purview solution should they use?

Accepted Answer

Insider Risk Management. Insider Risk Management in Microsoft Purview is specifically designed to detect, investigate, and act on risky user activities that may lead to data security incidents, such as unauthorized data exfiltration by departing employees. It uses predefined and customizable policies to correlate signals from Microsoft 365 logs (e.g., copying files to USB, sharing with external users) and applies risk-scoring to prioritize alerts. This makes it the correct solution for proactively identifying potential insider threats like bulk data copying or unauthorized file sharing.

Answer

Data Lifecycle Management

Answer

Communication Compliance

Answer

eDiscovery (Standard)

Question 8

Which TWO Microsoft Purview features allow you to monitor and manage data across hybrid environments (on-premises and cloud)?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is correct because it provides a unified map of data assets across on-premises, multi-cloud, and SaaS sources, enabling automated scanning and classification of sensitive data. Microsoft Purview Data Estate Insights is correct because it offers monitoring and governance dashboards that track data movement, usage, and compliance posture across hybrid environments, giving administrators visibility into both on-premises and cloud data estates.

Answer

eDiscovery

Answer

Information Protection

Answer

Communication Compliance

Question 9

A multinational corporation needs to enforce data residency requirements by storing data in specific geographic locations. They are using Microsoft Purview for data governance. Which capability should they leverage to meet this requirement?

Accepted Answer

Microsoft Purview Multi-Geo. Microsoft Purview Multi-Geo is the correct capability because it enables organizations to store data at rest in specific geographic locations to meet data residency requirements. This feature works by provisioning data in chosen regions while maintaining a single Microsoft 365 tenant, allowing the multinational corporation to comply with local regulations without needing separate tenants.

Answer

Data loss prevention policies

Answer

Sensitivity labels with encryption

Answer

Azure Information Protection unified labeling

Question 10

A company stores application secrets and encryption keys in Azure Key Vault. They want to move from the older vault access policy model to a more scalable and granular permission model that integrates with Azure's role-based access control (RBAC). They also need to audit permissions using Azure Policy. Which access configuration should they choose for Azure Key Vault?

Accepted Answer

Enable the Azure RBAC permission model for Key Vault. Enabling the Azure RBAC permission model for Key Vault replaces the older vault access policy model with Azure's native role-based access control, providing granular, scalable permissions that integrate directly with Azure Policy for auditing. This model allows you to assign roles like Key Vault Secrets User or Key Vault Crypto Officer at the management plane, enabling centralized permission management across multiple vaults and supporting Azure Policy compliance checks.

Answer

Use a single vault access policy with the Contributor role

Answer

Assign a managed identity to the Key Vault

Answer

Use a service principal and configure vault access policies per application

Question 11

A company is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities shifts from the customer to Microsoft during this migration?

Accepted Answer

Physical security of the data center infrastructure. When migrating on-premises applications to Azure IaaS, the shared responsibility model shifts physical security responsibilities—such as data center access controls, environmental controls, and hardware security—from the customer to Microsoft. Microsoft is responsible for the physical security of all Azure data centers, including perimeter security, surveillance, and facility access management, which were previously the customer's responsibility in their own on-premises environment.

Answer

Configuring network security groups (NSGs)

Answer

Patching the operating system on virtual machines

Answer

Managing user identities and access to the application

Question 12

Refer to the exhibit. You are evaluating a custom Azure Policy definition. The policy is intended to audit whether users assigned to a management role have MFA enabled. However, the policy is not triggering alerts for non-compliant users. What is the most likely cause?

Accepted Answer

The 'mfaEnabledPrincipals' parameter is not populated with the list of MFA-enabled users.. The policy definition includes a parameter named 'mfaEnabledPrincipals' that must be populated with the list of user object IDs who have MFA enabled. If this parameter is empty or not provided, the 'auditIfNotExists' effect cannot evaluate any users against the expected MFA status, resulting in no non-compliant alerts being triggered. Azure Policy relies on explicit parameter values to define the baseline for compliance evaluation.

Answer

The policy mode is set to 'All' instead of 'Indexed'.

Answer

The policy only evaluates role assignments of type 'Microsoft.Authorization/roleAssignments' but not users.

Answer

The effect 'auditIfNotExists' should be 'deny' to trigger alerts.

Question 13

A company uses an on-premises Active Directory (AD) and wants to enable single sign-on (SSO) for users to access Microsoft 365 and a third-party SaaS application. They plan to use an external identity provider (IdP) that supports Security Assertion Markup Language (SAML) 2.0. Which identity concept does this implementation primarily rely on?

Accepted Answer

Federation. Federation is the correct answer because it establishes a trust relationship between the on-premises Active Directory and the external identity provider (IdP) using SAML 2.0, enabling users to authenticate once and gain access to both Microsoft 365 and the third-party SaaS application without re-entering credentials. This relies on the IdP issuing SAML assertions that are trusted by the relying parties (Microsoft 365 and the SaaS app), which is the core mechanism of federated identity.

Answer

Provisioning

Answer

Synchronization

Answer

Directory extension

Question 14

A user accidentally shared a confidential document with an external vendor. You need to revoke access immediately for all copies, even if the file has been downloaded. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) allows you to classify, label, and protect documents and emails. When a confidential document is shared accidentally, you can use the 'Revoke Access' action on the protected file via the Microsoft Purview compliance portal or PowerShell. This revokes access for all copies, even if the file has been downloaded, because the protection travels with the file through persistent rights management.

Answer

Retention policy

Answer

Data loss prevention (DLP) policy

Answer

Audit log search

Question 15

Your company uses Microsoft Defender for Endpoint. A report shows that several devices are missing critical security updates. What feature should you use to deploy the missing updates?

Accepted Answer

Microsoft Intune update rings for Windows. Microsoft Intune update rings for Windows allow you to configure and deploy Windows quality and feature updates to managed devices. Since the question specifies deploying missing security updates, update rings provide the policy-based mechanism to schedule and enforce installation of those updates across devices enrolled in Intune.

Answer

Microsoft Defender for Endpoint's threat and vulnerability management (TVM)

Answer

Microsoft Configuration Manager

Answer

Microsoft Update

Question 16

A company uses Microsoft 365 and wants to protect users from malicious attachments in email. The security team wants a solution that detonates attachments in a sandbox environment before delivery, and only allows the email through if the attachment is deemed safe. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Attachments, a feature that detonates email attachments in a virtual sandbox environment before delivery. It analyzes the attachment's behavior for malicious activity and only releases the email to the recipient's mailbox if the attachment is deemed safe, directly meeting the requirement for pre-delivery sandboxing.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Azure Firewall

Question 17

Your organization uses Microsoft Defender for Cloud Apps. You need to discover shadow IT usage. Which feature should you enable?

Accepted Answer

Cloud Discovery. Cloud Discovery in Microsoft Defender for Cloud Apps analyzes traffic logs from firewalls, proxies, and endpoints to identify which cloud apps are being used, including unsanctioned shadow IT. It builds a cloud app catalog with risk scores so security teams can sanction or block apps, directly addressing shadow IT discovery.

Answer

File policies

Answer

Conditional Access App Control

Answer

App catalog

Question 18

Your organization is implementing Microsoft Purview Information Protection and needs to ensure that files shared externally cannot be forwarded or printed. Which protection mechanism should be applied?

Accepted Answer

Azure Information Protection with rights management. Azure Information Protection with rights management (now part of Microsoft Purview Information Protection) allows you to apply persistent protection that restricts actions like forwarding and printing on files shared externally. This is achieved through Azure Rights Management (Azure RMS) encryption and usage rights, which travel with the file regardless of where it is stored or sent.

Answer

Microsoft Purview Data Lifecycle Management retention policy

Answer

Sensitivity label with user-defined permissions

Answer

DLP policy with block action

Question 19

A company stores financial reports in SharePoint Online that contain credit card numbers. The compliance team needs to automatically apply a sensitivity label that encrypts the documents when they detect credit card data. Which Microsoft Purview solution should they configure?

Accepted Answer

Information Protection. Microsoft Purview Information Protection (A) is the correct solution because it enables the creation of auto-labeling policies that can automatically apply a sensitivity label with encryption when credit card numbers are detected in SharePoint Online documents. This directly addresses the requirement to classify and protect sensitive data at rest based on content inspection.

Answer

Data Loss Prevention

Answer

Data Lifecycle Management

Answer

Records Management

Question 20

An organization is implementing a Zero Trust security model. Which principle requires that every access request must be fully authenticated, authorized, and verified based on all available signals, regardless of the user's network location?

Accepted Answer

Verify explicitly. The 'Verify explicitly' principle of Zero Trust mandates that every access request must be fully authenticated, authorized, and encrypted based on all available data points—including user identity, device health, location, and behavioral signals—regardless of whether the request originates from inside or outside the corporate network. This contrasts with traditional perimeter-based models that implicitly trust internal traffic.

Answer

Least privilege

Answer

Assume breach

Answer

Defense in depth