SC-900 Practice Exam 53 — 20 Questions

Question 1

Which THREE of the following are capabilities of Microsoft Purview Compliance Manager? (Choose three.)

Accepted Answer

Automated testing of controls. Correct answers are A, C, and E: Compliance Manager provides a compliance score, automated testing of controls, and improvement actions. Option B is incorrect because managing user identities is a capability of Microsoft Entra ID, not Compliance Manager. Option D is incorrect because creating data loss prevention policies is a feature of Microsoft Purview Data Loss Prevention, not Compliance Manager.

Answer

Manage user identities

Answer

Create data loss prevention policies

Question 2

Your organization uses Microsoft Defender for Cloud Apps. You need to discover shadow IT usage. Which feature should you enable?

Accepted Answer

Cloud Discovery. Cloud Discovery analyzes traffic logs to identify shadow IT. Option A is incorrect because file policies are used for data protection and monitoring, not for discovering shadow IT. Option B is incorrect because Conditional Access App Control enforces policies on sanctioned apps, not for discovery. Option D is incorrect because the app catalog lists known cloud apps, not for discovering unknown usage.

Answer

File policies

Answer

Conditional Access App Control

Answer

App catalog

Question 3

You run the following PowerShell command in your Microsoft Entra ID environment:

Get-AzureADPolicy -Type TokenLifetimePolicy

What is the command retrieving?

Accepted Answer

Token lifetime policies. The command retrieves all policies of type 'TokenLifetimePolicy', which are used to define token lifetimes. Option A is wrong because conditional access policies use a different type. Option B is wrong because named locations are not policies. Option C is wrong because role assignments are not policies.

Answer

Conditional access policies

Answer

Named locations

Answer

Role assignments

Question 4

Which TWO are principles of the Zero Trust security model?

Accepted Answer

Verify explicitly. Options A and C are correct. Zero Trust principles include 'verify explicitly' and 'assume breach'. Option B contradicts Zero Trust as it trusts everything inside the network. Option D describes a traditional VPN-based approach, which is not a Zero Trust principle. Option E is a principle of defense in depth, not Zero Trust.

Answer

Trust everything inside the network

Answer

Use a VPN for remote access

Answer

Layer defenses

Question 5

An organization wants to classify and label data automatically based on sensitive content patterns such as credit card numbers. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) can automatically classify and label data based on sensitive content patterns such as credit card numbers. Option A (eDiscovery) is for legal discovery, Option C (Compliance Manager) is for compliance assessments, and Option D (Audit) is for logging activities.

Answer

eDiscovery

Answer

Compliance Manager

Answer

Audit

Question 6

Which THREE are capabilities of Microsoft Defender XDR?

Accepted Answer

Automated investigation and remediation. Options B, C, and D are correct. Microsoft Defender XDR provides automated investigation and remediation (B), incident management across email, endpoints, and identities (C), and cross-domain threat hunting (D). Option A (Device compliance policy management) is a capability of Microsoft Intune, not Defender XDR. Option E (Data classification and labeling) is a capability of Microsoft Purview, not Defender XDR.

Answer

Device compliance policy management

Answer

Data classification and labeling

Question 7

A user reports that they cannot access a sensitive document in SharePoint Online. The administrator checks the document's permissions and sees that the user is not listed directly, but a group they belong to has been granted access. Which identity concept describes this scenario?

Accepted Answer

Group-based access control. Group-based access control allows permissions to be assigned to groups rather than individuals, simplifying management. Option A is wrong because role-based access control is a specific type of group-based access using roles. Option B is wrong because privilege escalation refers to gaining higher permissions, not normal access via groups. Option D is wrong because attribute-based access control uses user attributes, not group membership.

Answer

Role-based access control (RBAC)

Answer

Privilege escalation

Answer

Attribute-based access control (ABAC)

Question 8

Refer to the exhibit. An administrator runs the PowerShell cmdlet shown. What is the purpose of this command?

Accepted Answer

To display the display name and user principal name of members of the Sales group.. The PowerShell cmdlet `Get-AzureADGroupMember -ObjectId <SalesGroupObjectId>` retrieves the members of a specific Azure AD group. By default, it returns the members' display names and user principal names (UPNs), which are the primary identifiers for users in Microsoft Entra ID. Option D correctly identifies this purpose.

Answer

To show the dynamic membership rules of the Sales group.

Answer

To list all groups in the Sales department.

Answer

To list Azure AD roles assigned to the Sales group.

Question 9

Refer to the exhibit. You are reviewing a sensitivity label configuration in Microsoft Purview. Based on the exhibit, what is the result when a user applies this label to a document?

Accepted Answer

The document is encrypted and a header/footer is added. The exhibit shows a sensitivity label configured with both encryption (via Azure Information Protection) and content marking (header/footer). When a user applies this label, the document is automatically encrypted to protect sensitive data, and the specified header and footer are added to the document as visual markings. This is a common configuration in Microsoft Purview Information Protection to enforce protection and awareness simultaneously.

Answer

The label is automatically removed after one year

Answer

The document is automatically deleted after 30 days

Answer

The document can be printed but not edited

Question 10

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user fails to sign in more than five times within an hour. Which rule type should you use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that counts sign-in failures per user over a specified time window (e.g., 1 hour) and triggers an incident when the count exceeds a threshold (e.g., 5). This rule type runs on a schedule you define, making it ideal for detecting patterns like brute-force attempts that require aggregation over time.

Answer

Fusion rule

Answer

Near-real-time (NRT) analytics rule

Answer

Machine learning (ML) behavioral analytics rule

Question 11

A company configures its access control system so that each user can only access the data and perform actions that are strictly necessary for their job role. This configuration is a direct implementation of which security principle?

Accepted Answer

Least privilege. The configuration described—granting each user only the access and actions strictly necessary for their job role—is the direct definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required permissions via Azure RBAC roles (e.g., Reader instead of Contributor) or using Azure AD Privileged Identity Management (PIM) for just-in-time access. This minimizes the attack surface by ensuring users cannot exceed their authorized scope.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero Trust

Question 12

A financial services firm is required by regulatory bodies to monitor employee communications (email, Teams chats) for potential insider trading or market manipulation. They need a solution that allows them to define policies to detect messages containing specific keywords or phrases (e.g., 'confidential', 'insider info'), and then assign flagged messages to designated reviewers for investigation. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is the correct solution because it is specifically designed to detect policy violations in employee communications, such as email and Teams chats, by scanning for sensitive keywords or phrases like 'confidential' or 'insider info'. It then automatically flags and routes these messages to designated reviewers for investigation, directly meeting the regulatory requirement for monitoring potential insider trading or market manipulation.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview eDiscovery (Standard or Premium)

Answer

Microsoft Purview Audit (Standard or Premium)

Question 13

A security team needs to detect and automatically respond to ransomware attacks on Windows servers and desktops. They require the solution to automatically isolate affected devices from the network and, if necessary, roll back files that have been modified by ransomware using a built-in recovery feature. Which Microsoft security solution provides these specific capabilities?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) provides automated investigation and remediation capabilities that include network containment (isolating a device from the network) and rollback of files modified by ransomware using its built-in recovery feature. This is achieved through MDE's endpoint detection and response (EDR) and automated investigation capabilities, which can trigger device isolation and file restoration from Volume Shadow Copy or MDE's own rollback mechanism.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Question 14

A company uses Microsoft Entra ID and has multiple departments with separate organizational units (OUs) in its on-premises Active Directory. The help desk team needs to be able to reset passwords for users only in the Finance department. What feature should be used to delegate this administrative scope?

Accepted Answer

Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions over a subset of users, groups, or devices without granting broader tenant-wide access. By creating an AU for the Finance department and assigning the Helpdesk Administrator role scoped to that AU, the help desk team can reset passwords only for Finance users, matching the on-premises OU structure.

Answer

Dynamic groups

Answer

Conditional Access policies

Answer

Privileged Identity Management (PIM)

Question 15

A company uses Microsoft Entra ID. They want to enforce multifactor authentication (MFA) for all access to a sensitive HR application. However, they only want to require MFA when the sign-in risk is assessed as medium or high, and block access if the risk is high. Which Conditional Access components must the administrator configure to meet these requirements? (Choose the best answer)

Accepted Answer

Conditions (Sign-in risk) and Grant controls (Require multifactor authentication, Block access). The scenario requires evaluating sign-in risk as a condition, which is configured under Conditions (Sign-in risk) in Conditional Access. The Grant controls then enforce 'Require multifactor authentication' for medium/high risk and 'Block access' for high risk, directly matching the requirements.

Answer

Assignments (Users and cloud apps) and Session controls (Sign-in frequency)

Answer

Conditions (Device platforms) and Grant controls (Require approved client app)

Answer

Grant controls (Require multifactor authentication) and Session controls (Application enforce restrictions)

Question 16

A company uses Microsoft Entra ID and wants to enforce multi-factor authentication (MFA) only for external guest users, while allowing internal employees to sign in without MFA. Which Conditional Access setting should be configured?

Accepted Answer

Target the 'Guest or external users' identity type. Conditional Access allows targeting the 'Guest or external users' identity type, which enables MFA enforcement exclusively for external guest users without affecting internal employees. This setting leverages the user type attribute in Microsoft Entra ID to differentiate between internal and external identities, providing granular control over authentication requirements.

Answer

Require MFA for all users

Answer

Exclude internal users by group

Answer

Use Identity Protection's user risk policy

Question 17

A financial company needs to prevent any communication between their mergers and acquisitions (M&A) team and the trading desk across all Microsoft 365 channels, including email, Microsoft Teams, and SharePoint. They must ensure that no user in one group can send emails to or chat with users in the other group. Which Microsoft Purview solution should they implement?

Accepted Answer

Information Barriers. Information Barriers (IB) is the correct solution because it is specifically designed to prevent communication and collaboration between two user groups across Microsoft 365 services, including email, Teams, and SharePoint. By defining policies that block segments (e.g., M&A team and trading desk), IB enforces restrictions at the transport, chat, and document level, ensuring no email, chat, or file sharing occurs between the groups. This directly addresses the requirement to isolate the M&A team from the trading desk across all channels.

Answer

Communication Compliance

Answer

Data Lifecycle Management

Answer

Data Loss Prevention (DLP)

Question 18

You are the identity administrator for Contoso Ltd., a global company with over 10,000 employees. The company uses Microsoft Entra ID P2 and Microsoft Intune. Employees use both company-owned and personal devices. The security team requires that all access to corporate applications be protected with multifactor authentication (MFA). However, to minimize user friction, they want to exempt MFA for users who are on the corporate network and using compliant devices. Additionally, for users with privileged roles (e.g., Global Administrator), MFA must always be required regardless of location or device. You need to configure a Conditional Access policy to meet these requirements. Which of the following approaches should you take?

Accepted Answer

Create two Conditional Access policies: Policy 1 targets all users except privileged roles, requires MFA, and excludes trusted locations and compliant devices. Policy 2 targets privileged roles and requires MFA with no exclusions.. It uses two separate Conditional Access policies to handle the two distinct user groups. Policy 1 targets all users except privileged roles, requires MFA, and excludes trusted locations and compliant devices, which satisfies the requirement to minimize friction for users on the corporate network with compliant devices. Policy 2 targets privileged roles and requires MFA with no exclusions, ensuring that Global Administrators and other privileged role members always must perform MFA regardless of location or device compliance.

Answer

Create one Conditional Access policy that targets all users and requires MFA. Create a second policy that targets privileged roles and excludes trusted locations.

Answer

Create one Conditional Access policy that targets all users, requires MFA, and excludes trusted locations and compliant devices. Do not create any additional policies.

Answer

Create one Conditional Access policy that targets all users and requires MFA. Use Microsoft Intune compliance policies to exempt compliant devices from MFA.

Question 19

A multinational company uses Microsoft Entra ID. They want to ensure that users from a specific country only access a sensitive application from compliant devices. Additionally, they want to block access if the sign-in risk is medium or high. Which combination of policies should they create?

Accepted Answer

A Conditional Access policy with conditions for location, device compliance, and sign-in risk. A single Conditional Access policy can combine multiple conditions—such as location (country), device compliance (via integration with Intune), and sign-in risk—to enforce granular access controls. This allows the company to require compliant devices and block access when sign-in risk is medium or high, all within one policy.

Answer

A Conditional Access session policy to enforce sign-in frequency

Answer

A device compliance policy in Microsoft Intune

Answer

A Conditional Access policy requiring MFA from that country

Question 20

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers in emails to external recipients. Which DLP rule action should you configure?

Accepted Answer

Block the message from being sent. Microsoft Purview DLP allows you to configure rule actions that enforce protective measures. When you need to prevent users from sharing credit card numbers in emails to external recipients, the 'Block the message from being sent' action stops the email from being delivered, ensuring the sensitive data is not leaked. This action can be combined with a notification or override option, but the core enforcement is blocking the message.

Answer

Audit the activity only

Answer

Allow the message but notify the user

Answer

Allow the message with a policy tip