SC-900 Practice Exam 56 — 20 Questions

Question 1

An organization is deploying Microsoft Intune for mobile device management. They need to ensure that all iOS devices must have a passcode of at least 6 characters and the device must be encrypted. What should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A device compliance policy. Device compliance policies in Intune define the rules that devices must meet to be considered compliant, such as requiring a passcode of at least 6 characters and device encryption. Option A is incorrect because Conditional Access policies use compliance status to enforce access controls, but do not define the compliance rules themselves. Option B is incorrect because device configuration profiles push settings to devices but do not enforce compliance; they are used for configuring device settings. Option C is incorrect because app protection policies manage how apps access and handle data, not device-level requirements like passcode and encryption.

Answer

A Conditional Access policy

Answer

A device configuration profile

Answer

An app protection policy

Question 2

A company uses Microsoft Intune to manage its devices. The security team wants to enforce that all devices running Windows 11 must have BitLocker enabled and a minimum operating system build version. Which Intune policy type should they use?

Accepted Answer

Compliance policy. Compliance policies in Microsoft Intune define the rules and settings that devices must meet to be considered compliant, such as requiring BitLocker encryption and a minimum OS build version. When a device fails to meet these conditions, Intune can mark it as non-compliant and trigger conditional access policies to block access to corporate resources. This makes compliance policy the correct choice for enforcing security baselines like BitLocker and OS version requirements.

Answer

Configuration profile

Answer

Enrollment restriction

Answer

App protection policy

Question 3

A security team wants to discover which cloud applications are being used by employees, including unsanctioned file-sharing and collaboration apps. They plan to upload network traffic logs from their firewall to analyze app usage and risk levels. Which feature of Microsoft Defender for Cloud Apps should they enable?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes network traffic logs (uploaded from firewalls or proxies) to identify which cloud applications are in use, including unsanctioned file-sharing and collaboration apps. It provides a risk score for each discovered app, enabling the security team to assess usage and enforce governance policies.

Answer

App Governance

Answer

Conditional Access App Control

Answer

Information Protection

Question 4

A company uses Microsoft Defender for Cloud Apps. The security team discovers that a user has granted a third-party OAuth app with 'read all mail' and 'send mail as user' permissions. They want to automatically revoke the authorization for this risky app and block similar apps in the future. Which Defender for Cloud Apps feature should they use?

Accepted Answer

OAuth app policies. OAuth app policies in Microsoft Defender for Cloud Apps allow security teams to automatically revoke permissions for risky third-party OAuth apps and block future similar apps. This feature specifically governs OAuth consent grants, such as 'read all mail' and 'send mail as user', by enabling automated governance actions like revoking permissions and blocking the app based on risk level.

Answer

App Discovery

Answer

Conditional Access App Control

Answer

Cloud Discovery

Question 5

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender XDR. The security team needs to determine if the file 'invoice.docm' is known malware and if other devices in the organization have this file. What should they do next?

Accepted Answer

Search in Advanced Hunting for the file's SHA256 hash across all devices. Searching for the file's SHA256 hash in Advanced Hunting allows the security team to query across all devices in the organization to determine if the file is known malware (by cross-referencing with threat intelligence) and to identify which other devices have the same file. Advanced Hunting in Microsoft Defender XDR supports Kusto Query Language (KQL) queries against the DeviceFileEvents table, enabling hash-based file discovery and reputation checks.

Answer

Isolate the device DESKTOP-01 immediately

Answer

Trigger the automated investigation for this alert

Answer

Review the user jdoe's recent activities

Question 6

Which THREE capabilities are provided by Microsoft Purview? (Choose three.)

Accepted Answer

Data classification and labeling. Microsoft Purview provides data classification and labeling capabilities, enabling organizations to identify, categorize, and protect sensitive data across their digital estate. This includes automatic and manual labeling of documents and emails based on content inspection and machine learning classifiers, which is a core function of the Microsoft Purview Information Protection solution.

Answer

Identity protection and risk detection

Answer

Threat and vulnerability management

Question 7

A company uses Microsoft Entra ID. The security manager wants to provide temporary, time-bound elevated access to the Global Administrator role only when needed, and require approval from a designated approver. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by allowing users to activate the Global Administrator role for a limited, time-bound duration only when needed, and it enforces approval workflows from designated approvers. This directly matches the security manager's requirement for temporary, approval-based elevation.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Identity Governance (Access Reviews)

Question 8

A user reports that they cannot access the corporate portal after a password reset. The user can access other cloud apps. You verify that the user account is enabled and not locked. What should you check next?

Accepted Answer

Verify the user's registered authentication methods. The user can access other cloud apps, which rules out a global authentication or network issue. Since the account is enabled and not locked, the most likely cause is that the user's registered authentication methods (e.g., phone, authenticator app, or email) are missing, outdated, or not configured for the password reset flow. Microsoft Entra ID requires verified authentication methods to complete a password reset and subsequent sign-in, especially when the user is prompted for multifactor authentication or self-service password reset (SSPR) verification.

Answer

Disable and re-enable the user account

Answer

Reinstall the corporate portal application

Answer

Check if the user is assigned a Microsoft Entra ID P2 license

Question 9

A company uses Microsoft Entra ID. The security team wants to configure a policy so that when a user signs in from an unfamiliar location (not on the company's trusted IP ranges) or from an unfamiliar device, they are prompted for additional verification (e.g., MFA). However, if the sign-in is from a trusted location (e.g., office IP range) and a known device, no additional verification is required. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it allows administrators to define policies that evaluate sign-in context—such as user location (via named locations with trusted IP ranges) and device state (compliant or hybrid Azure AD joined)—and then enforce actions like requiring MFA only when conditions are not met. This directly matches the requirement to prompt for additional verification from unfamiliar locations or devices while skipping it for trusted ones.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Access Reviews

Question 10

A security architect is designing a Zero Trust strategy. Which principle ensures that network location alone does not grant trust, and all access requests must be verified?

Accepted Answer

Verify explicitly. The 'Verify explicitly' principle is the core of Zero Trust, stating that every access request must be authenticated and authorized based on all available data points—including user identity, device health, location, and data sensitivity—regardless of network location. This ensures that being on a corporate network does not automatically grant trust, as all requests are verified in real time.

Answer

Least privilege

Answer

Assume breach

Answer

Segregation of duties

Question 11

Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID capability helps verify the identity of users before granting access to resources?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (D) is the correct answer because it directly addresses the Zero Trust principle of 'verify explicitly' by using real-time risk detection and conditional access policies to verify user identity before granting access. It evaluates sign-in risk, user risk, and enforces policies like multi-factor authentication (MFA) or blocking access when suspicious activity is detected, ensuring that only legitimate users can access resources.

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Governance

Question 12

A company uses Salesforce and Box as cloud apps. The security team discovers that a third-party OAuth app with excessive permissions was granted access to Salesforce data by a user. They want a solution that can detect such risky OAuth apps and automatically revoke their permissions based on policy. Which Microsoft security solution provides this capability?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is a Cloud Access Security Broker (CASB) that provides visibility into third-party OAuth apps connected to cloud services like Salesforce and Box. It can detect OAuth apps with excessive permissions and automatically revoke them based on conditional access or app governance policies, making it the correct solution for this scenario.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 13

A user receives a sensitivity label that automatically marks the email as 'Confidential' and prevents forwarding. The label was applied without user intervention. Which mechanism most likely applied the label?

Accepted Answer

Auto-classification via DLP policy. Auto-classification via DLP policy can automatically apply sensitivity labels based on sensitive content, such as credit card numbers, enabling the label to be applied without user intervention. Option A is incorrect because the Azure Information Protection file policy applies to files in Windows File Explorer, not emails. Option C is incorrect because a default label applies to all unlabeled emails but does not use content detection. Option D is incorrect because manual labeling requires the user to select the label.

Answer

Azure Information Protection file policy

Answer

Default label configured in Microsoft 365

Answer

Manual labeling by the user

Question 14

Your organization plans to migrate from on-premises Active Directory to Microsoft Entra ID. You need to design the identity synchronization strategy to support password hash synchronization and password writeback. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct tool because it supports both password hash synchronization and password writeback, which are required for the migration scenario. Password hash sync synchronizes a hash of the on-premises AD password to Entra ID, while password writeback enables password changes in the cloud to be written back to on-premises AD. Entra Connect is the primary hybrid identity tool that integrates on-premises directories with Microsoft Entra ID, offering these features natively.

Answer

Microsoft Identity Manager

Answer

Active Directory Federation Services

Answer

Microsoft Entra Cloud Sync

Question 15

A company uses a hashing algorithm to verify that a downloaded software file has not been tampered with during transmission. This practice primarily protects which security principle?

Accepted Answer

Integrity. Hashing algorithms, such as SHA-256, produce a fixed-size hash value that acts as a digital fingerprint of the file. By comparing the hash of the downloaded file with the hash provided by the publisher, any change to the file—even a single bit—results in a completely different hash, immediately detecting tampering. This directly protects the integrity of the data by ensuring it has not been altered during transmission.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 16

Match each compliance framework to its primary focus.

Accepted Answer

GDPR: Focuses on data privacy and protection for individuals in the EU. Correct matches: GDPR = data privacy, ISO 27001 = information security management, SOC 2 = trust service criteria. Common confusions include mixing GDPR with financial controls (SOX) or privacy with broader security.

Answer

GDPR: Focuses on financial reporting controls

Answer

ISO 27001: Focuses on data privacy for EU citizens

Answer

SOC 2: Focuses on international trade regulations

Question 17

A company wants to prevent users from setting weak passwords that are commonly found in leaked databases. They use Microsoft Entra ID (Microsoft Entra ID). Which feature should they enable?

Accepted Answer

Microsoft Entra ID Password Protection. Microsoft Entra ID Password Protection is the correct feature because it specifically blocks weak passwords by comparing them against a global list of commonly compromised passwords (e.g., from leaked databases) and an optional custom banned password list. This feature enforces password strength at the time of creation or reset, preventing users from setting passwords that appear in known breaches.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Microsoft Entra ID Conditional Access

Question 18

A legal team is preparing for litigation and needs to collect relevant data from Microsoft Teams chats, email, and SharePoint documents. They need to place a hold on the data to prevent deletion, review it, and then use advanced analytics such as relevance ranking and email threading to reduce the review set. Which Microsoft Purview solution should they use to perform these tasks?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) is the correct solution because it provides the full lifecycle of legal hold, collection, review, and advanced analytics such as relevance ranking, email threading, and predictive coding. These capabilities are specifically designed for complex litigation scenarios, whereas the Standard edition lacks the advanced analytics features needed to reduce the review set.

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Copilot

Answer

Microsoft Purview Compliance Manager

Question 19

A company wants to protect against malware and phishing attacks in email and collaboration tools like Microsoft Teams. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (formerly Office 365 ATP) is the correct solution because it is specifically designed to protect email and collaboration tools like Microsoft Teams from malware, phishing, and other threats. It includes features such as Safe Links, Safe Attachments, and anti-phishing policies that scan URLs and attachments in real-time, and it integrates directly with Exchange Online and Teams to block malicious content before it reaches users.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Question 20

A company wants to ensure that emails containing credit card numbers are blocked from being sent externally. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and protect sensitive data, such as credit card numbers, by scanning email content and attachments. When a DLP policy is configured to block external sharing of this sensitive information, it can automatically prevent the email from being sent, ensuring compliance with data protection regulations.

Answer

Sensitivity labels

Answer

Communication compliance

Answer

Information barriers