SC-900 Practice Exam 54 — 20 Questions

Question 1

A security operations team investigates a multi-stage attack that began with a phishing email, then moved to credential compromise, and finally to lateral movement on endpoints. They need a single pane of glass to view the entire attack story, including the initial email, the compromised user's sign-in activities, and processes on affected devices. Which Microsoft security solution provides this unified investigation experience?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft 365 Defender. Microsoft 365 Defender (now Microsoft Defender XDR) provides a unified investigation experience by correlating signals across email, identity, and endpoint domains into a single incident view. This allows the security team to see the full attack story—from the initial phishing email in Defender for Office 365, to the compromised user's sign-in activities via Defender for Identity, and the lateral movement processes on endpoints through Defender for Endpoint—all within one console.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity

Question 2

A company has an on-premises Active Directory domain and uses Microsoft Entra ID (Azure AD) for cloud applications. They purchase new Windows 10 laptops that are not yet joined to any domain. The IT admin wants users to be able to sign in with their existing on-premises credentials and automatically have the laptops joined to both the on-premises AD domain and Microsoft Entra ID. Which device identity option should the admin configure?

Accepted Answer

Microsoft Entra hybrid joined. Microsoft Entra hybrid join allows devices to be joined to both an on-premises Active Directory domain and Microsoft Entra ID simultaneously. This enables users to sign in with their existing on-premises credentials and automatically have the laptops registered in both directories, meeting the requirement for a seamless single sign-on experience.

Answer

Microsoft Entra registered

Answer

Microsoft Entra joined

Answer

On-premises domain join only

Question 3

A security operations team uses Microsoft 365 Defender and wants to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, such as Pass-the-Hash (PtH) and Golden Ticket attacks. They also need to integrate these alerts into Microsoft Sentinel for central incident management. Which Microsoft security solution provides these capabilities?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct answer because it is specifically designed to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, including Pass-the-Hash (PtH) and Golden Ticket attacks. It uses behavioral analytics and machine learning to identify suspicious activities such as anomalous Kerberos ticket requests and NTLM authentication anomalies. MDI also natively integrates with Microsoft Sentinel, allowing alerts to be ingested for central incident management.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Question 4

A company uses Microsoft Entra ID and Intune for mobile device management. They want to enforce different access requirements for their finance application: when users access from an unmanaged personal device, they must perform multi-factor authentication (MFA). When they access from a corporate-managed device that is marked as compliant (e.g., joined to Azure AD, antivirus up-to-date, encryption enabled), MFA should not be required. Device compliance is reported by Intune. Which Microsoft Entra ID feature should they use to define these rules?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID allow administrators to define granular access rules based on signals such as user, device, location, and application. In this scenario, the policy can be configured to require MFA when the device is not marked as compliant (e.g., unmanaged personal device) and to allow access without MFA when the device is reported as compliant by Intune. This is the correct feature because it directly evaluates device compliance status from Intune and enforces the specified access requirements.

Answer

Identity Protection risk policies

Answer

Privileged Identity Management (PIM)

Answer

Intune device compliance policies

Question 5

Your organization uses Microsoft Purview to manage data governance. You need to ensure that sensitive financial data containing credit card numbers is automatically detected and labeled when stored in SharePoint Online. Which compliance solution should you configure?

Accepted Answer

Information Protection auto-labeling. Microsoft Purview Information Protection auto-labeling is the correct solution because it can automatically detect sensitive data types, such as credit card numbers, using built-in sensitive information types (e.g., Credit Card Number) and apply sensitivity labels to documents in SharePoint Online. This ensures that financial data is classified and protected at rest without manual intervention, aligning with the requirement for automatic detection and labeling.

Answer

eDiscovery (Premium)

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Question 6

A Microsoft 365 organization needs to classify and protect sensitive documents based on their content, such as passport numbers. They want the classification to be applied automatically without user intervention. Which Microsoft Purview solution should they use?

Accepted Answer

Auto-labeling with sensitivity labels. Auto-labeling in Microsoft Purview Information Protection uses policy rules to automatically apply sensitivity labels to documents containing sensitive info like passport numbers. Trainable classifiers are used for more complex patterns but require training. Data Loss Prevention (DLP) can detect and protect but does not label documents by default. Unified labeling is a client-side feature requiring user action.

Answer

Unified labeling client

Answer

Data Loss Prevention (DLP) policies

Answer

Trainable classifiers

Question 7

Your organization uses Microsoft Entra ID with P2 licenses. You need to delegate the ability to manage role assignments in Entra ID without granting global admin rights. Which feature should you use?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) in Microsoft Entra ID P2 enables just-in-time, time-bound, and approval-based role assignments, allowing you to delegate role management without granting permanent global admin rights. PIM provides role activation workflows and auditing, making it the correct feature for delegating role assignment management.

Answer

Entitlement Management

Answer

Conditional Access

Answer

Administrative Units

Question 8

A security analyst needs to investigate a potential data exfiltration incident involving sensitive files being sent via email. Which Microsoft Purview solution provides the necessary monitoring?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it provides real-time monitoring and policy-based enforcement to detect and block sensitive files (e.g., credit card numbers, PII) from being sent via email. DLP policies can inspect email content and attachments in transit, triggering alerts or blocking the message to prevent data exfiltration.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Audit

Question 9

A company is involved in a legal case and must preserve all emails and documents sent by a specific employee (custodian) that are related to a particular matter. The legal team needs to collect this data into a tamper-proof container for review, ensuring that no original items are modified or deleted. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). eDiscovery (Premium) is the correct solution because it provides advanced capabilities for legal investigations, including the ability to place a legal hold on specific custodians (the employee) and preserve all relevant emails and documents in a tamper-proof container. This ensures that no original items are modified or deleted during the review process, meeting the requirements of the legal case.

Answer

Retention labels

Answer

eDiscovery (Standard)

Answer

Data Lifecycle Management

Question 10

A user logs into a corporate laptop by inserting a smart card and entering a PIN. The user then attempts to open a confidential folder. The operating system checks the user's access rights and denies access. Which security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The scenario demonstrates authentication (verifying the user's identity via smart card + PIN) and authorization (the OS checking access rights and denying access to the folder). Authentication confirms who the user is, while authorization determines what resources they can access. Option B correctly pairs these two concepts.

Answer

Identification and authorization

Answer

Authentication and accounting

Answer

Identification and authentication

Question 11

A multinational company needs to enforce multi-factor authentication for all users but exclude a break-glass emergency account. Which approach should they take in Microsoft Entra ID?

Accepted Answer

Create a Conditional Access policy requiring MFA for all users, excluding the break-glass account. Conditional Access policies in Microsoft Entra ID allow granular control over authentication requirements, including the ability to exclude specific users or groups. By creating a policy that requires multi-factor authentication (MFA) for all users but explicitly excludes the break-glass account, the company ensures security while maintaining emergency access. This approach is more flexible and scalable than per-user MFA or security defaults, which lack the ability to selectively bypass MFA for critical accounts.

Answer

Use identity protection to require MFA only for high-risk users

Answer

Enable security defaults and add the break-glass account to a group that bypasses MFA

Answer

Enable per-user MFA for all users and turn off for the break-glass account

Question 12

A financial services company must comply with a regulation that requires all audit-related documents to be retained for 7 years and then permanently deleted. The compliance officer wants to ensure that even if a user modifies or deletes a file, the original content is preserved for the full 7 years, and at the end of the period the files are automatically destroyed without any manual approval. The company uses Microsoft 365 and stores these documents in SharePoint Online and Microsoft Teams. Which Microsoft Purview solution should the compliance officer configure?

Accepted Answer

Microsoft Purview Data Lifecycle Management using a retention policy configured to retain items for 7 years and then delete them automatically. Microsoft Purview Data Lifecycle Management allows you to create a retention policy that retains items for a fixed period (7 years) and then automatically deletes them without any manual intervention. This meets the regulatory requirement for automatic destruction at the end of the retention period, and the policy applies to both SharePoint Online and Microsoft Teams, preserving the original content even if a user modifies or deletes the file.

Answer

Microsoft Purview Retention Labels with a disposition review that requires manual approval at the end of the retention period

Answer

Microsoft Purview Retention Policy with a record label to mark items as regulatory records

Answer

Microsoft Purview eDiscovery with a hold policy to preserve the documents indefinitely

Question 13

Your company uses Microsoft Entra ID and wants to automatically assign licenses to new employees based on their department. Which feature should you use?

Accepted Answer

Dynamic groups and group-based licensing. Dynamic groups in Microsoft Entra ID allow you to automatically add or remove users based on attributes like department. Combined with group-based licensing, you can assign licenses (e.g., Microsoft 365 E5) to all members of that group, so when a new employee is added with the matching department attribute, they automatically receive the correct license without manual intervention.

Answer

Privileged Identity Management

Answer

Access reviews

Answer

Entitlement management

Question 14

A security manager wants to ensure that an employee who sends an email cannot later deny having sent it. Which security concept and associated technology is best suited to achieve this?

Accepted Answer

Non-repudiation, achieved through digital signatures. Non-repudiation ensures that a party cannot deny an action, such as sending an email. Digital signatures, which use asymmetric cryptography (e.g., RSA or ECDSA) and a hash of the message, provide cryptographic proof of the sender's identity and message integrity, making denial impossible.

Answer

Confidentiality, achieved through encryption

Answer

Integrity, achieved through hashing

Answer

Access control, achieved through permissions

Question 15

Which TWO of the following are components of the Microsoft Entra product family? (Choose two.)

Accepted Answer

Microsoft Entra Permissions Management. Microsoft Entra ID (option E) is the core component of the Microsoft Entra product family, formerly known as Azure Active Directory, providing cloud-based identity and access management, SSO, MFA, and Conditional Access. Microsoft Entra Permissions Management (option D) is also part of the Entra family, offering cloud infrastructure entitlement management (CIEM) to discover, remediate, and monitor permissions across multicloud environments like Azure, AWS, and GCP. By contrast, Microsoft Defender for Identity (option A) belongs to the Microsoft Defender XDR suite for threat protection, Microsoft Intune (option B) is part of the Microsoft Intune family for endpoint management, and Microsoft Purview (option C) is a separate compliance and data governance product family, so none of these three are Entra components.

Answer

Microsoft Defender for Identity

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 16

A company is implementing security controls to protect data during transmission between their on-premises database and a cloud storage service. They decide to use TLS encryption. Which security goal is primarily addressed by ensuring that data is not altered during transit?

Accepted Answer

Integrity. TLS encryption provides data integrity through message authentication codes (MACs) that detect any unauthorized modification during transit. The question specifically asks about ensuring data is not altered, which is the definition of integrity, not confidentiality or availability.

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 17

Which TWO Microsoft Purview solutions can be used to manage data retention and deletion?

Accepted Answer

Retention policies. Retention policies (A) are used to assign retention and deletion settings at the container level (e.g., entire SharePoint site, Exchange mailbox, or OneDrive account), automatically applying to all content within that scope. Retention labels (D) are used to assign retention and deletion settings at the item level (e.g., a specific document or email), allowing granular control and manual or auto-classification. Both are core Microsoft Purview solutions for managing data lifecycle, including retention and deletion.

Answer

eDiscovery

Answer

Sensitivity labels

Answer

Data Loss Prevention (DLP)

Question 18

A security analyst is explaining the concept of 'Least Privilege' to a new team member. Which statement best describes the principle of least privilege?

Accepted Answer

Users should have only the permissions necessary to perform their job functions.. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to complete their job functions. This reduces the attack surface and limits potential damage from accidental or malicious actions. In Microsoft 365, this is implemented through Role-Based Access Control (RBAC) and Microsoft Entra ID roles, where permissions are scoped to specific administrative units or tasks.

Answer

Users should have all permissions disabled by default.

Answer

Users should be given administrator rights to ensure they can perform any task.

Answer

Users should share one account with elevated privileges for their team.

Question 19

Your company is subject to GDPR and must be able to respond to data subject requests (DSRs) by finding all personal data of a specific user across Microsoft 365. Which Microsoft Purview solution should you use?

Accepted Answer

eDiscovery (Standard or Premium). eDiscovery (Standard or Premium) is the correct solution because it is specifically designed to search for and export content across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) to fulfill data subject requests (DSRs) under GDPR. It allows you to create a case, define a search query for a specific user's personal data, and export the results for review and action, directly supporting the right to access and erasure.

Answer

Communication Compliance

Answer

Privileged Access Management

Answer

Audit (Standard or Premium)

Question 20

Your company uses Microsoft Entra ID and wants to implement a passwordless authentication strategy for all users. You have a mix of Windows 10 devices, iOS devices, and Android devices. You need a solution that works across all platforms and does not require users to remember passwords. What should you implement?

Accepted Answer

Deploy Microsoft Authenticator with phone sign-in enabled for all users.. Microsoft Authenticator with phone sign-in enabled provides a cross-platform passwordless authentication solution that works on Windows 10, iOS, and Android devices. It uses a key-based authentication model where the user's phone generates a cryptographic key pair, eliminating the need for passwords while supporting all required device types.

Answer

Deploy FIDO2 security keys to all users and register them in Microsoft Entra ID.

Answer

Implement certificate-based authentication using smart cards.

Answer

Enable Windows Hello for Business on all Windows devices.