SC-900 Practice Exam 55 — 20 Questions

Question 1

An organization wants to automatically retain emails for 7 years and then delete them. They also need to place a legal hold on specific users' mailboxes to preserve all emails during litigation. Which combination of Microsoft Purview features should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Retention policies and Litigation Hold. For automatic retention and deletion, Retention policies in Microsoft Purview are ideal as they apply to entire mailboxes. To preserve emails for litigation, Litigation Hold can be enabled on specific user mailboxes, ensuring that no emails are deleted or altered. The combination of these two features meets both requirements.

Answer

Retention labels and eDiscovery

Answer

Data Lifecycle Management and Audit

Answer

Records Management and Data Loss Prevention

Question 2

Your organization uses Microsoft Purview Communication Compliance to detect potential policy violations in Microsoft Teams chats. Which action can the policy automatically take when a violation is detected?

Accepted Answer

Notify the user and their manager via email. Microsoft Purview Communication Compliance is designed to detect and remediate policy violations, but it does not enforce access controls or modify message content directly. Instead, it can automatically notify the user and their manager via email as a configurable remediation action, allowing for human review and follow-up without disrupting communication flow.

Answer

Revoke the user's access to Microsoft Teams

Answer

Block the user from sending messages

Answer

Automatically delete the violating message

Question 3

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

A conditional access policy. Conditional Access policies in Azure AD evaluate signals (like device compliance status reported by Intune) to enforce access controls. By configuring a Conditional Access policy that requires device compliance for the Exchange Online or corporate email app, only devices marked as compliant by Intune will be granted access. This is the correct mechanism to gate access based on compliance.

Answer

A device compliance policy

Answer

A device configuration policy

Answer

An app protection policy

Question 4

A company uses Microsoft Entra ID. They want to ensure that when users access the HR portal from an unmanaged personal device, they are prompted to sign a terms of use agreement and also required to perform multifactor authentication (MFA). Which Conditional Access control should they configure to enforce both requirements?

Accepted Answer

Grant - Require MFA and Require terms of use. The Grant control in Conditional Access allows you to require multiple conditions to be satisfied before granting access. By selecting both 'Require MFA' and 'Require terms of use' under Grant, the policy enforces that the user must complete both MFA and accept the terms of use when accessing the HR portal from an unmanaged device. This directly meets the requirement for both authentication and consent.

Answer

Session control - Use app enforced restrictions

Answer

Grant - Require approved client app

Answer

Session control - Sign-in frequency

Question 5

A company needs to grant IT administrators temporary and time-limited access to privileged roles in Microsoft Entra ID (Azure AD). The access must require approval from a manager and be automatically revoked after the task is completed. Which Microsoft Entra ID feature should be used?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access by allowing administrators to activate eligible role assignments for a limited duration. It supports approval workflows (e.g., manager approval) and automatically deactivates the role when the activation time expires or the task is completed, meeting the requirement for temporary, time-limited, approved, and auto-revoked access.

Answer

Conditional Access

Answer

Identity Protection

Answer

Entitlement Management

Question 6

Your company uses Microsoft Intune to manage devices. You need to ensure that only devices that are compliant with your security policies can access corporate email via Microsoft Outlook. What should you implement?

Accepted Answer

Conditional Access policies. Conditional Access policies (D) are the correct choice because they evaluate device compliance status—determined by Intune compliance policies—as a condition for granting access. By configuring a Conditional Access policy that requires compliant devices, only devices meeting your security policies can authenticate to Microsoft Outlook and access corporate email. This is the Azure AD/Entra ID mechanism that enforces access control based on compliance state.

Answer

Windows Information Protection

Answer

Device compliance policies

Answer

App protection policies

Question 7

Your organization uses Microsoft Sentinel for security operations. You need to ensure that when a high-severity incident is created, a Microsoft Teams message is sent to the SOC team automatically. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook.. Automation rules in Microsoft Sentinel allow you to define triggers (e.g., incident creation) and run a playbook as an action. A playbook can contain steps to send a Teams message. So you create an automation rule that triggers on incident creation and runs a playbook. Option B is incorrect because attaching a playbook to an analytics rule is not the standard method; analytics rules create incidents, but automation rules handle the automated response. Option C is incorrect because analytics rules do not have a direct 'automated response' for sending notifications. Option D is incorrect because workbooks are used for data visualization and dashboards, not for automation.

Answer

Create a playbook and attach it to an analytics rule.

Answer

Modify the analytics rule to include an automated response.

Answer

Configure a workbook to send email alerts.

Question 8

Your organization uses Microsoft Purview Data Lifecycle Management to retain data for regulatory compliance. You need to ensure that all documents in a SharePoint site are retained for 7 years after they are last modified. What should you create?

Accepted Answer

An adaptive scope based on last modified date. To retain documents in a SharePoint site for 7 years after they are last modified, you need a retention policy with an adaptive scope that uses a query to target items based on the 'Last Modified' date. Adaptive scopes allow dynamic, attribute-based scoping (e.g., last modified date), which is required for this time-based retention trigger. A static scope would apply to all content in the site without the ability to filter by modification date.

Answer

An auto-labeling policy

Answer

A data loss prevention policy

Answer

A static scope for the SharePoint site

Question 9

Refer to the exhibit. An analyst runs a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

To retrieve the most recent 10 malware alerts.. The KQL query uses the `take` operator to return the first 10 rows of the result set after filtering for `Malware` alerts. Since the query does not include any `order by` or `sort` clause, the `take` operator returns an unspecified set of 10 records, and therefore does not guarantee the 'most recent' alerts. While the query's primary intent is to retrieve a limited number (10) of malware alerts, the 'most recent' qualifier in option A makes it an inaccurate description of the query's guaranteed outcome. Therefore, option A is not entirely correct, and no other option accurately describes the query's purpose.

Answer

To find the single highest severity alert.

Answer

To count the total number of malware alerts in the last 24 hours.

Answer

To list all computers with malware alerts.

Question 10

An organization uses Microsoft Purview Audit to meet compliance requirements. Which TWO types of audit logs can be accessed?

Accepted Answer

Purview advanced audit logs. Microsoft Purview Audit provides two primary audit log access methods: the Microsoft 365 unified audit log, which aggregates audit records from various Microsoft 365 services, and Purview advanced audit logs, which offer extended retention (up to 10 years) and high-value events like investigation of privileged access. These two options directly correspond to the core audit capabilities within Purview for compliance requirements.

Answer

Windows Security event logs

Answer

Azure Active Directory audit logs

Answer

Azure SQL Database audit logs

Question 11

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. The security team wants to automatically block the use of a newly discovered high-risk cloud app across all users. What is the most efficient approach?

Accepted Answer

Create an app discovery policy with governance action to unsanction the app.. An app discovery policy with the governance action to unsanction the app automatically blocks the app across all users via the Defender for Cloud Apps API. Option A is incorrect because Conditional Access policies are identity-based and not designed to block specific cloud apps directly during discovery. Option B is incorrect because manually adding the app to the blocked list is not automatic and requires ongoing manual effort. Option D is incorrect because session controls monitor and control app usage in real time but do not permanently block the app.

Answer

Create a Conditional Access policy to block the app for all users.

Answer

Manually add the app to the blocked list in the cloud discovery settings.

Answer

Configure session controls to monitor app usage.

Question 12

Your company is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive data like credit card numbers via email with external recipients, but allow internal sharing. What should you configure?

Accepted Answer

A DLP policy for Exchange Online with a condition 'content contains sensitive information type' and 'shared with people outside my organization'. To prevent sharing of sensitive data with external recipients via email, you need to configure a DLP policy that applies to Exchange Online and includes a condition for the sensitive information type (e.g., credit card numbers) and an action to block sharing when the content is shared with people outside the organization. Option B correctly describes this configuration. Option A is incorrect because sensitivity labels with encryption classify and protect data at rest and in transit but do not by themselves enforce sharing restrictions based on recipients. Option C is incorrect because retention policies are used to retain or delete data, not to block sharing. Option D is incorrect because Conditional Access policies control access to applications based on conditions like user location or device state, not data sharing actions.

Answer

Sensitivity labels with encryption

Answer

Retention labels and policies

Answer

Conditional Access policies with session controls

Question 13

Which TWO Microsoft Purview solutions can help detect and prevent data exfiltration?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management (A) is correct because it uses behavioral analytics and machine learning to identify risky user activities that may indicate data exfiltration, such as copying files to unauthorized cloud services or external devices. Microsoft Purview Data Loss Prevention (DLP) (C) is correct because it enforces policies that inspect content in transit and at rest, blocking or alerting on sensitive data being shared outside the organization via email, endpoints, or cloud apps.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview eDiscovery

Question 14

Your organization recently deployed Microsoft Defender for Cloud Apps. You need to identify which users are using a personal Dropbox account to access corporate files. Which feature should you use?

Accepted Answer

Cloud Discovery. B is correct because Cloud Discovery in Microsoft Defender for Cloud Apps analyzes traffic logs from your network to identify shadow IT usage, including users accessing personal Dropbox accounts from corporate devices. It uses anonymized data from Microsoft Intelligent Security Graph to detect unsanctioned cloud apps and map user activity, enabling you to pinpoint which users are bypassing corporate storage policies.

Answer

Activity policies

Answer

File policies

Answer

App permissions

Question 15

A company uses Microsoft Sentinel for security operations. They want to automatically create an incident and assign it to a senior analyst when a high-severity alert is generated. Which feature should they use?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to automatically trigger incident creation, assignment, and other actions when an alert is generated. By configuring an automation rule with a condition for high-severity alerts, you can set it to create an incident and assign it to a specific senior analyst, streamlining the response process.

Answer

Analytics rule

Answer

Workbook

Answer

Playbook

Question 16

You are the identity administrator for a large enterprise using Microsoft Entra ID. The company has 50,000 users and recently acquired a smaller company with 2,000 users that uses a third-party identity provider (IdP) based on SAML 2.0. The acquisition must be fully integrated within 30 days. The CISO mandates that all users must use MFA for any access to cloud applications. The acquired company's users currently do not use MFA. You need to choose an approach that minimizes changes to the acquired company's current authentication infrastructure while meeting the MFA requirement. The solution must also allow the acquired company's users to access resources in the parent tenant using their existing credentials. What should you do?

Accepted Answer

Configure B2B collaboration with the acquired company's IdP and enable MFA trust. In the parent tenant, create a Conditional Access policy that requires MFA for guest users.. B2B collaboration allows the acquired company's users to authenticate against their existing SAML 2.0 IdP using their current credentials, minimizing infrastructure changes. By enabling MFA trust, the parent tenant can rely on the MFA claims already issued by the third-party IdP if it supports MFA, but since it does not, you can enforce MFA in the parent tenant via a Conditional Access policy that requires MFA for guest users. This approach meets the CISO's mandate without requiring the acquired company to deploy MFA on their own IdP or migrate users.

Answer

Set up password hash synchronization from the acquired company's IdP to the parent tenant and enable MFA for all sync'ed users.

Answer

Create new user accounts in the parent tenant for the acquired company's users and assign them Microsoft Entra ID P2 licenses to enable MFA via Conditional Access.

Answer

Migrate all acquired company users to the parent tenant's on-premises Active Directory and sync them to Microsoft Entra ID. Enable MFA via Conditional Access.

Question 17

Refer to the exhibit. A security analyst in your SOC runs the provided KQL query in Microsoft Sentinel to identify users with repeated MFA or suspicious sign-in alerts. The query returns no results even though alerts exist. What is the most likely issue?

Accepted Answer

The alert names do not contain the strings 'MFA' or 'Suspicious sign-in'.. The query filters alert names using the 'has' operator on the strings 'MFA' and 'Suspicious sign-in'. Since 'has' is case-insensitive, option D is incorrect. Option A is incorrect because even if the 'Entities' array is empty, the 'extend' operator would simply set the 'alert' field to an empty array, not prevent results. Option C is incorrect because a 7-day time range is reasonable and likely includes relevant alerts. Therefore, the most likely issue is that the actual alert names do not contain the exact substrings 'MFA' or 'Suspicious sign-in', as stated in option B.

Answer

The 'extend' operator fails because 'Entities' array is empty.

Answer

The TimeGenerated filter is too restrictive; alerts older than 7 days are excluded.

Answer

The 'has' operator is case-sensitive and the alert names are in uppercase.

Question 18

A security analyst in your organization receives an alert from Microsoft Defender XDR indicating that a user's device may be infected with ransomware. The analyst needs to immediately isolate the device from the network to prevent further spread. What should the analyst do?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation. Microsoft Defender for Endpoint includes a built-in device isolation capability that can be triggered directly from the Microsoft Defender XDR portal. This action immediately disconnects the device from all network communications (except the Defender service) to contain a confirmed ransomware infection, preventing lateral movement while allowing forensic analysis.

Answer

Revoke the user's session in Microsoft Entra ID

Answer

Open Microsoft Sentinel and run a playbook

Answer

Use Microsoft Intune to wipe the device

Question 19

Your company uses Microsoft Entra ID with P2 licenses. You want to require approval for users to activate the Global Administrator role. Which feature should you configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time privileged access, including the ability to require approval for role activation. By configuring PIM for the Global Administrator role, you can enforce that users must request activation and receive approval before gaining the role's permissions, ensuring least-privilege and auditability.

Answer

Identity Protection

Answer

Conditional Access

Answer

Access reviews

Question 20

A security team needs to detect and investigate suspicious activities in their on-premises Active Directory environment, such as pass-the-hash attacks, Kerberoasting, and unusual service account behavior. They also want to integrate these alerts with Microsoft Defender for Cloud for a unified view across hybrid workloads. Which Microsoft security solution should they deploy on-premises?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to detect and investigate advanced threats in on-premises Active Directory environments, including pass-the-hash attacks, Kerberoasting, and anomalous service account behavior. It uses behavioral analytics and integrates directly with Microsoft Defender for Cloud to provide a unified view across hybrid workloads, enabling security teams to correlate on-premises AD signals with cloud alerts.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint