SC-900 Practice Exam 55 — 20 Questions

Question 1

A security administrator is explaining the Zero Trust model to a new colleague. The administrator states that trust should never be granted based solely on network location, and every access request must be fully authenticated and authorized using all available signals. Which Zero Trust principle does this statement describe?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify explicitly. The statement that trust should never be granted based solely on network location and that every access request must be fully authenticated and authorized using all available signals directly describes the 'Verify explicitly' principle of the Zero Trust model. This principle mandates that authentication and authorization are performed for every access attempt, regardless of the source (e.g., internal network, VPN, cloud), using all available data points such as user identity, device health, and location.

Answer

Assume breach

Answer

Use least privilege

Answer

Segment access

Question 2

A company uses Microsoft 365 and wants to automatically apply a 3-year retention label to any document that contains a patent number in the format PAT-XXXXXX. The label should be applied at the time the document is created or modified. Which Microsoft Purview solution should the administrator configure?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Retention) allows administrators to create auto-apply retention labels based on sensitive information types, such as a custom regex for patent numbers. When configured with a 'created or modified' condition, the label is automatically applied at the time the document is saved or edited, ensuring compliance with the 3-year retention requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit (Premium)

Question 3

Refer to the exhibit. The JSON shows a conditional access policy. What is the effect of this policy?

Accepted Answer

Requires MFA for Office 365 from trusted locations.. The policy assigns the 'Require multifactor authentication' grant to Office 365 cloud apps, and the condition restricts it to 'trusted locations' (typically corporate networks or compliant IP ranges). This means users accessing Office 365 from those trusted locations must complete MFA, while access from untrusted locations is not affected by this policy (it may be handled by other policies). Option A correctly describes this effect.

Answer

Applies only to external guest users.

Answer

Blocks all access to Office 365 from trusted locations.

Answer

Requires a compliant device for Office 365.

Question 4

Arrange the steps to configure Azure AD Privileged Identity Management (PIM) for a role in the correct order.

Accepted Answer

Access Azure AD Privileged Identity Management, then select the role to manage, then configure role settings, then add eligible assignments, then manage approvals.. PIM setup involves first accessing PIM, then selecting a role, configuring settings, assigning eligible users, and managing approvals.

Answer

Add eligible assignments, then configure role settings, then select the role, then access Azure AD PIM, then manage approvals.

Answer

Access Azure AD PIM, then configure role settings, then select the role, then add eligible assignments, then manage approvals.

Answer

Access Azure AD PIM, then select the role, then add eligible assignments, then configure role settings, then manage approvals.

Question 5

An organization uses Microsoft 365 Defender. The security team receives an alert about a potential malware outbreak on multiple endpoints, and they need an integrated view that correlates signals from various Microsoft security solutions. Which Microsoft 365 Defender portal component provides this unified view?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com). The Microsoft 365 Defender portal (security.microsoft.com) is the correct answer because it provides a unified view of alerts and incidents across Microsoft 365 Defender components, including Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This integrated correlation enables security teams to see the full scope of a potential malware outbreak across multiple endpoints by combining signals from these solutions into a single incident timeline.

Answer

Microsoft Defender for Cloud

Answer

Azure Sentinel

Answer

Microsoft Defender for Identity

Question 6

Your organization wants to prevent users from installing unapproved apps on company-managed Windows devices. Which Microsoft Intune feature should you use?

Accepted Answer

App control policies. App control policies in Microsoft Intune allow administrators to create and enforce rules that control which applications users can run on managed Windows devices. By configuring a baseline policy (e.g., using Windows Defender Application Control), you can block unapproved apps while allowing only trusted or explicitly permitted software, directly preventing users from installing unauthorized applications.

Answer

Device configuration profiles

Answer

Conditional Access

Answer

Device compliance policies

Question 7

Match each Microsoft identity service to its description.

Accepted Answer

Azure AD: Cloud-based identity and access management service. Microsoft identity services include Microsoft Entra ID (cloud IAM), Microsoft Entra Domain Services (managed domain services), and Azure AD B2C (customer IAM). Common confusions involve swapping descriptions of Microsoft Entra ID with on-premises AD and Microsoft Entra Domain Services with Microsoft Entra B2B.

Answer

Azure AD B2B: Managed domain services such as domain join and LDAP

Answer

Active Directory (on-premises): Cloud-based identity and access management

Answer

Azure AD: On-premises directory service for Windows networks

Question 8

Which TWO Microsoft Purview solutions can be used to automatically classify sensitive data at rest?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) automatically classifies sensitive data at rest by applying retention labels based on sensitive content detection, such as credit card numbers or social security numbers, using trainable classifiers or exact data match. Information Protection (IP) extends this by enabling automatic labeling of documents and emails based on sensitive information types, ensuring data is classified and protected while stored in SharePoint, OneDrive, or Exchange Online.

Answer

Communication Compliance

Answer

eDiscovery

Answer

Auditing

Question 9

Your organization is using Microsoft Entra ID with P2 licenses. You need to enforce a policy that requires administrators to request approval before activating their privileged roles, and approvals must expire after 8 hours. Additionally, you need to ensure that all privileged role activations are logged for auditing. Which combination of Microsoft Entra capabilities should you use?

Accepted Answer

Configure Privileged Identity Management (PIM) for role activation with approval and expiration, and use PIM audit logs.. Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time role activation with configurable approval workflows and expiration durations, meeting the requirement for administrators to request approval and for approvals to expire after 8 hours. PIM audit logs capture all activation events, including who approved, when, and for which role, fulfilling the auditing requirement. This combination directly addresses the policy needs without relying on unrelated capabilities like user risk policies or access reviews.

Answer

Implement Identity Protection user risk policy to block high-risk admins, and use sign-in logs.

Answer

Create a Conditional Access policy requiring multi-factor authentication for admins, and use activity logs.

Answer

Set up Azure AD Access Reviews to require monthly review of privileged roles, and enable diagnostic settings.

Question 10

Which TWO features are part of Microsoft Entra ID P2 licensing? (Choose two.)

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra ID P2 licensing includes advanced security features such as Microsoft Entra Identity Protection and Microsoft Entra Privileged Identity Management (PIM). Identity Protection uses machine learning to detect and remediate identity-based risks like leaked credentials and anomalous sign-in patterns, while PIM provides just-in-time privileged access and approval workflows. These capabilities are exclusive to P2 and are not available in P1 or free tiers.

Answer

Conditional Access

Answer

Basic Mobility and Security

Answer

Microsoft Entra Self-Service Password Reset

Question 11

A company runs a mix of on-premises servers and Azure virtual machines. They deploy Microsoft Defender for Endpoint on all servers. The security team wants to create custom queries to hunt for a specific attack pattern that involves a sequence of events across multiple machines, such as a PowerShell script being downloaded and then executed on several servers. They need to write their own detection rules based on advanced hunting data. Which Microsoft 365 Defender capability should they use?

Accepted Answer

Advanced hunting in Microsoft 365 Defender. Advanced hunting in Microsoft 365 Defender provides a Kusto Query Language (KQL)-based query interface that allows security teams to create custom detection rules by searching raw data across endpoints, email, and identities. This capability directly supports the scenario of writing custom queries to hunt for multi-machine attack patterns, such as a PowerShell script download followed by execution, by correlating events like DeviceProcessEvents and DeviceFileEvents across multiple devices.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 12

Order the steps to deploy Microsoft Intune for mobile device management.

Accepted Answer

1. Set up Intune (configuration of MDM authority, licenses, and basic settings), 2. Create enrollment policies, 3. Create compliance policies, 4. Assign apps, 5. Enroll devices.. Intune deployment includes setup, enrollment policies, compliance policies, app assignment, and enrollment.

Answer

1. Enroll devices, 2. Set up Intune, 3. Create compliance policies, 4. Create enrollment policies, 5. Assign apps.

Answer

1. Set up Intune, 2. Create compliance policies, 3. Create enrollment policies, 4. Assign apps, 5. Enroll devices.

Answer

1. Enroll devices, 2. Assign apps, 3. Create compliance policies, 4. Create enrollment policies, 5. Set up Intune.

Question 13

Match each identity term to its correct meaning.

Accepted Answer

Identity: An entity that can be authenticated (e.g., user, device, service).. Identity is the entity (user, device, service) being authenticated. Authentication verifies who you are (e.g., passwords, MFA). Authorization determines what you can access (e.g., permissions). Directory stores identity information (e.g., Microsoft Entra ID). Common confusion: mixing authentication and authorization definitions.

Answer

Identity: The process of verifying credentials.

Answer

Authentication: The process of granting access rights.

Question 14

A company wants to monitor employee communications in Microsoft Teams and Exchange Online for potential policy violations such as harassment or inappropriate sharing of confidential information. They need a solution that allows them to define policies, review flagged messages, and manage investigations. Which Microsoft Purview solution should they use?

Accepted Answer

Communication Compliance. Communication Compliance is the correct Microsoft Purview solution because it is specifically designed to monitor communications (e.g., emails in Exchange Online and messages in Microsoft Teams) for policy violations such as harassment or inappropriate sharing of confidential information. It allows administrators to define customizable policies, automatically flag messages that match sensitive information types or offensive language, and manage investigations through a built-in review workflow.

Answer

Insider Risk Management

Answer

Information Barriers

Answer

Audit (Standard or Premium)

Question 15

A company uses Microsoft 365 and needs to protect endpoints from ransomware attacks that encrypt files. The security team wants automated investigation and response capabilities for malware incidents on Windows devices. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (D) is the correct answer because it provides endpoint detection and response (EDR) capabilities, including automated investigation and remediation for malware incidents on Windows devices. It uses behavioral sensors, cloud analytics, and threat intelligence to detect ransomware encryption behavior and automatically contain or remediate affected endpoints, aligning with the requirement for automated response.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 16

Your organization wants to use Microsoft Defender for Cloud to secure Azure virtual machines. Which feature should they enable to get vulnerability assessment without additional agents?

Accepted Answer

Vulnerability assessment. Microsoft Defender for Cloud includes a built-in vulnerability assessment solution for Azure virtual machines that does not require any additional agents. When enabled, it uses the Qualys scanner integrated directly into the platform to continuously scan for vulnerabilities, providing findings without the need to deploy or manage separate agents on the VMs.

Answer

File integrity monitoring

Answer

Just-in-time VM access

Answer

Adaptive application controls

Question 17

Your company is implementing a zero-trust security model. Which principle requires verifying every access request as though it originates from an untrusted network, even if the request comes from within the corporate network?

Accepted Answer

Explicit verification. Explicit verification is one of the three core Zero Trust principles (alongside least privilege and assume breach) and specifically requires authenticating and authorizing every access request based on all available data points — identity, location, device health, service, and workload — regardless of whether the request originates inside or outside the corporate network. It rejects the traditional 'trusted internal network' assumption.

Answer

Least privilege

Answer

Trust but verify

Answer

Assume breach

Question 18

A financial services company uses Microsoft Purview and must comply with a regulation that requires communication surveillance for market abuse. They need to capture all electronic communications (email, Teams chats) of traders and scan for specific keywords and trading patterns. Which Microsoft Purview solution is specifically designed for this?

Accepted Answer

Communication Compliance. Communication Compliance is the Microsoft Purview solution specifically designed to capture and analyze electronic communications (email, Teams chats) for regulatory compliance, such as detecting market abuse. It allows organizations to define policies that scan for specific keywords and trading patterns, automatically flagging messages that violate compliance rules. This directly addresses the requirement for communication surveillance in financial services under regulations like MiFID II or Dodd-Frank.

Answer

Data Lifecycle Management

Answer

eDiscovery (Standard)

Answer

Insider Risk Management

Question 19

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to identify resources that are missing system updates. Which feature should they use?

Accepted Answer

Secure Score recommendations. Secure Score recommendations in Microsoft Defender for Cloud include a specific recommendation for 'System updates should be installed on your machines' (or similar naming). This recommendation identifies Azure resources, particularly VMs, that are missing critical or security system updates by integrating with the Update Management solution or Microsoft Defender for Cloud's built-in vulnerability assessment. Selecting this recommendation allows the security team to view and remediate missing updates, directly addressing the requirement to assess security posture regarding system updates.

Answer

Just-in-time VM access

Answer

Vulnerability assessment solutions

Answer

Adaptive application controls

Question 20

A company uses Microsoft Entra ID. The security team wants to grant temporary, time-limited administrative access to Azure subscriptions only when needed, with an approval workflow. Which Microsoft Entra capability should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Microsoft Entra ID and Azure resources, including Azure subscriptions. PIM supports time-bound role activation with an approval workflow, allowing the security team to grant temporary administrative access only when needed, which directly matches the requirement.

Answer

Conditional Access

Answer

Identity Protection

Answer

Entra ID Governance