SC-900 Practice Exam 54 — 20 Questions

Question 1

An organization uses Microsoft Entra ID for identity management. They want to implement a risk-based conditional access policy that requires multi-factor authentication (MFA) when sign-in risk is medium or high. Which policy settings should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign 'Sign-in risk' condition to 'Medium and above' and grant 'Require MFA'. The scenario explicitly requires a risk-based conditional access policy that triggers MFA based on sign-in risk level. In Microsoft Entra ID, the 'Sign-in risk' condition evaluates the likelihood that the authentication attempt is not legitimate, using signals such as anonymous IP addresses, atypical travel, or malware-linked IPs. By setting this condition to 'Medium and above' and granting 'Require MFA', the policy enforces MFA only when the sign-in risk is assessed as medium or high, directly matching the requirement.

Answer

Assign 'User risk' condition to 'Medium and above' and grant 'Require MFA'

Answer

Assign 'Device compliance' condition to 'Compliant' and grant 'Require MFA'

Answer

Assign 'Location' condition to 'All trusted locations' and grant 'Require MFA'

Question 2

Your company uses Microsoft Intune for device management. You need to ensure that all company data on a user's personally owned device is removed when the user is offboarded, but the user's personal data should remain. Which wipe action should you use?

Accepted Answer

Selective wipe. Selective wipe removes only company data from Intune-managed apps, leaving personal data intact. Full wipe resets the device and deletes all data. Delete removes the device from Intune management but does not wipe data. Retire removes the device from management and removes company data; however, the action that specifically performs a selective wipe of company data is Selective wipe.

Answer

Delete

Answer

Full wipe

Answer

Retire

Question 3

A financial organization implements a security control that logs every access attempt to sensitive financial records, including who accessed the data, when it was accessed, and from which device. The logs are regularly reviewed by the security team. This control primarily addresses which security concept?

Accepted Answer

Accountability. Accountability ensures that actions affecting sensitive data can be traced uniquely to an individual. By logging who accessed the data, when, and from which device, the organization creates an audit trail that holds users responsible for their actions. This directly supports non-repudiation and forensic analysis, which are the core goals of accountability.

Answer

Confidentiality

Answer

Integrity

Answer

Availability

Question 4

A financial services company is required by the Payment Card Industry Data Security Standard (PCI-DSS) to retain all documents containing credit card numbers for at least seven years. The compliance team has created a custom sensitive information type (SIT) to detect credit card numbers in Microsoft 365. They want to automatically apply a retention label (e.g., "7-Year Retention") to any document in SharePoint or OneDrive that matches this SIT. Which Microsoft Purview solution should they configure to apply the label automatically based on content?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) in Microsoft Purview is the solution specifically designed for automatically applying retention labels based on conditions like sensitive information types (SITs). By creating a retention label policy with auto-labeling rules that reference the custom SIT for credit card numbers, DLM can automatically assign the '7-Year Retention' label to documents in SharePoint and OneDrive that contain PCI-DSS data, ensuring compliance with retention requirements.

Answer

Data Loss Prevention (DLP)

Answer

Insider Risk Management

Answer

Communication Compliance

Question 5

A company runs critical Windows virtual machines on Azure. To reduce the attack surface, the security team wants to block all inbound RDP (port 3389) traffic from the internet by default. When a security engineer needs to connect via RDP for troubleshooting, they must request access through a portal, and the RDP port will be opened for a limited time (e.g., 4 hours) only to their source IP address. Which Microsoft security solution should they use to implement this control?

Accepted Answer

Microsoft Defender for Cloud's Just-in-time (JIT) VM access. Microsoft Defender for Cloud's Just-in-time (JIT) VM access is the correct solution because it specifically provides time-limited, request-based opening of inbound ports (such as RDP port 3389) to approved source IP addresses, reducing the attack surface by keeping ports closed by default. This aligns directly with the requirement to block all inbound RDP from the internet by default and allow temporary access only through a portal request.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Azure Network Security Groups (NSGs) with application security groups

Question 6

A company uses Microsoft Purview Information Protection to classify and protect sensitive data. They want to automatically apply a sensitivity label to documents containing credit card numbers. Which should you configure?

Accepted Answer

Configure an auto-labeling policy with a sensitive info type for credit card numbers. Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents and emails that contain specific sensitive information types, such as credit card numbers. This enables automated classification and protection without requiring user intervention, directly meeting the requirement to automatically apply a label based on the presence of credit card data.

Answer

Use a manual labeling policy requiring users to apply labels

Answer

Create a trainable classifier for credit card patterns

Answer

Set up a data classification activity explorer to monitor credit card usage

Question 7

Your organization needs to retain all email communications with customers for 7 years due to regulatory requirements. Which Microsoft Purview solution should you use?

Accepted Answer

Retention policies. Retention policies in Microsoft Purview are designed to retain data for a specified period to meet regulatory or legal requirements. For email communications, a retention policy can be applied to Exchange mailboxes to ensure all messages are preserved for exactly 7 years, regardless of user deletion. This directly addresses the need to retain all customer emails for the mandated duration.

Answer

Sensitivity labels

Answer

eDiscovery (Standard)

Answer

Data Loss Prevention policies

Question 8

Your organization uses Microsoft Entra ID. You need to ensure that when a user is terminated, all access to SaaS applications is automatically revoked. What should you configure?

Accepted Answer

Configure Microsoft Entra lifecycle workflows to disable the user and remove group memberships upon termination.. Microsoft Entra lifecycle workflows automate the user offboarding process by disabling the user account and removing group memberships upon termination. This ensures that the user loses access to all SaaS applications that rely on Entra ID for authentication, as group membership removal revokes access tokens and disables sign-in.

Answer

Configure a conditional access policy to block access for disabled users.

Answer

Use Privileged Identity Management to remove role assignments.

Answer

Schedule an access review for quarterly review of access.

Question 9

A company manages Azure virtual machines and on-premises servers. The security team needs a single dashboard that provides a secure score and actionable recommendations to improve the security posture across both environments. Which Microsoft solution should be used?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a unified dashboard that displays a secure score and actionable recommendations for Azure virtual machines, on-premises servers, and other cloud workloads. It integrates with Azure Arc to extend security monitoring to on-premises resources, enabling a single view of security posture across hybrid environments.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 10

A company is implementing a Microsoft Entra ID tenant for a new subsidiary. They require that all users authenticate using passwordless methods, specifically the Microsoft Authenticator app. What is the minimum configuration required to enforce this?

Accepted Answer

Create a Conditional Access policy targeting all users that requires 'Require authentication strength' and select the 'Passwordless MFA' authentication strength. A Conditional Access policy with the 'Require authentication strength' setting allows you to select the 'Passwordless MFA' authentication strength, which enforces passwordless methods like the Microsoft Authenticator app. This is the minimum configuration that directly targets all users and mandates passwordless authentication, as opposed to broader or less specific settings.

Answer

Enable Microsoft Entra ID Protection and configure MFA registration policy

Answer

Turn on Security defaults

Answer

Configure Microsoft Entra Hybrid Join for all devices

Question 11

An organization needs to prevent users from sharing files containing trade secrets with external parties via email. The solution must allow internal sharing. Which Microsoft Purview capability should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention policies. Microsoft Purview Data Loss Prevention (DLP) policies are designed to detect and block the sharing of sensitive information—such as trade secrets—via email or other channels, while still allowing internal sharing. DLP can inspect email content and attachments for sensitive data types and apply actions like blocking external sends, making it the correct choice for this requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Sensitivity Labels with encryption

Question 12

A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team needs to discover which unsanctioned cloud apps employees are using (Shadow IT). They also want to get a risk score for each app and receive alerts when a high-risk app is used. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it is specifically designed for Cloud Access Security Broker (CASB) functions, including Shadow IT discovery, risk scoring of cloud apps, and policy-based alerts. It integrates with Microsoft 365 and third-party SaaS apps via API connectors and log collectors to identify unsanctioned app usage and assign a risk score based on factors like compliance, security controls, and industry standards.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Purview Compliance Manager

Question 13

A law firm uses Microsoft 365. They must retain all client communication records for 10 years due to regulatory requirements. After 10 years, the records must be permanently deleted. Additionally, they need to ensure that users cannot permanently delete these records before the retention period ends. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Records Management. Microsoft Purview Records Management is the correct solution because it allows the law firm to apply retention labels that mark content as a regulatory record, which prevents users from permanently deleting the records before the retention period ends. It also supports disposition review and permanent deletion after the specified 10-year retention period, meeting both the retention and deletion requirements.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 14

Refer to the exhibit. You have a Data Loss Prevention (DLP) policy in Microsoft Purview. What will happen when a user tries to share a document containing a credit card number via email?

Accepted Answer

The email is blocked and the user receives a notification. The DLP policy is configured to block the email and send a notification to the user when a credit card number is detected. Option A is incorrect because the policy applies to both internal and external recipients. Option B is incorrect because the email is blocked, not sent with a warning. Option C is incorrect because the user is notified when the email is blocked.

Answer

The email is blocked only if the recipient is external

Answer

The email is sent with a warning to the recipient

Answer

The email is sent but the user is not notified

Question 15

A company uses Microsoft Entra ID. They want to require users to perform multifactor authentication (MFA) every 30 days on devices that are marked as compliant, but require MFA for every sign-in attempt on non-compliant devices. Which Conditional Access control should they configure to meet this requirement?

Accepted Answer

Session control: Sign-in frequency. The requirement specifies different MFA frequency based on device compliance: every 30 days for compliant devices and every sign-in for non-compliant devices. This is achieved by configuring a Session control called 'Sign-in frequency' in a Conditional Access policy, which allows administrators to set the reauthentication interval (e.g., 30 days) and can be scoped to specific conditions like device state (compliant vs. non-compliant). Grant controls like 'Require MFA' enforce MFA but do not control the frequency of re-prompting.

Answer

Grant control: Require MFA

Answer

Conditions: Device state

Answer

Session control: Application restrictions

Question 16

A security architect is adopting a new security model that assumes breach and verifies every access request. The model eliminates implicit trust and requires continuous validation. Which security model is being implemented?

Accepted Answer

Zero Trust. Zero Trust is the correct model because it explicitly assumes breach, eliminates implicit trust, and requires continuous validation of every access request. This aligns with the core Zero Trust principle of 'never trust, always verify,' which mandates that no user, device, or network is trusted by default, even if they are inside the corporate perimeter.

Answer

Defense in Depth

Answer

Least Privilege

Answer

Shared Responsibility

Question 17

A company uses Microsoft Entra ID. The security team wants to automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel between geographically distant locations within an unrealistic time frame. They need a solution that can automatically trigger actions like forcing a password reset or blocking sign-in for users identified as high risk. Which Microsoft Entra ID capability should they configure?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct capability because it is specifically designed to detect and automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel. It uses machine learning to assign risk levels and can trigger automated actions like forcing a password reset or blocking sign-in for high-risk users, aligning directly with the security team's requirements.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Governance

Question 18

Your organization uses Microsoft Purview Information Protection to classify and protect documents. You have created a sensitivity label that applies encryption to documents marked as 'Confidential'. Users are able to apply the label manually. However, you need to ensure that all documents containing personally identifiable information (PII) are automatically labeled as 'Confidential' when they are saved to SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that scans for PII sensitive info types and applies the 'Confidential' label.. Auto-labeling policies in Microsoft Purview can scan documents for sensitive info types (such as PII) and automatically apply the 'Confidential' label when they are saved to SharePoint Online. Option B is incorrect because configuring a default label for SharePoint libraries would apply to all documents, not just those containing PII, and it would not scan for specific content. Option C is incorrect because a DLP policy blocks sharing or other actions but does not apply sensitivity labels. Option D is incorrect because manual labeling does not meet the requirement for automatic labeling.

Answer

Configure a default label for SharePoint libraries so that all documents are labeled 'Confidential'.

Answer

Create a Data Loss Prevention (DLP) policy that blocks sharing of PII.

Answer

Train users to apply the 'Confidential' label manually when they create documents with PII.

Question 19

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to ensure that when a user tries to share a document containing a credit card number externally via email, the user sees a policy tip and the email is blocked. Which DLP rule action should they configure?

Accepted Answer

Block the message and notify the user with a policy tip. The requirement is to both block the email and show a policy tip to the user. In Microsoft Purview DLP, the 'Block the message and notify the user with a policy tip' action enforces the block at the transport level while simultaneously displaying a customizable policy tip in Outlook or Outlook on the web, informing the user why the message was blocked. This meets the dual need of prevention and user notification.

Answer

Notify user with policy tip only

Answer

Block the message only

Answer

Redirect the message to the compliance admin

Question 20

You are a compliance administrator for Contoso, a multinational company that uses Microsoft 365. The company has the following requirements: 
1. Automatically retain all documents containing personally identifiable information (PII) for 7 years. 
2. Prevent users from sharing PII via email with external recipients unless they provide a business justification. 
3. Monitor and alert when users access sensitive data outside of business hours. 
4. Generate a compliance score for GDPR and ISO 27001. 
You need to configure the appropriate Microsoft Purview solutions. For each requirement, match the correct solution. Which combination of solutions should you use?

Accepted Answer

Data Lifecycle Management for retention; DLP for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring. Requirement 1 (retain PII for 7 years) is met by a retention label or policy from Data Lifecycle Management (not Information Protection, which is for classification). Requirement 2 (prevent sharing without justification) is met by a Data Loss Prevention (DLP) policy that can block sharing and require user override with business justification. Requirement 3 (monitor access outside business hours) is met by Insider Risk Management, which can detect anomalous access patterns. Requirement 4 (compliance score) is met by Compliance Manager. Option A is wrong because Information Protection labels are for classification, not retention; also monitoring access outside hours needs Insider Risk Management, not DLP. Option B is wrong because Communication Compliance is for monitoring communications, not for preventing sharing via email; DLP is needed for that. Option D is wrong because eDiscovery is for legal discovery, not for access monitoring.

Answer

Information Protection for retention; DLP for sharing; Data Lifecycle Management for monitoring; Compliance Manager for scoring

Answer

Data Lifecycle Management for retention; Communication Compliance for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

Answer

Information Protection for retention; eDiscovery for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring