SC-900 Practice Exam 56 — 20 Questions

Question 1

A healthcare organization stores sensitive patient records in a cloud database. The database is encrypted at rest using AES-256. If an attacker gains access to the physical storage media, they cannot read the data. Which security concept does this encryption primarily provide?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Confidentiality. Encryption at rest using AES-256 ensures that data stored on physical media is unreadable without the decryption key. If an attacker gains physical access to the storage media, the ciphertext cannot be deciphered, directly protecting the secrecy of the data. This aligns with the security goal of confidentiality, which prevents unauthorized disclosure of information.

Answer

Integrity

Answer

Availability

Answer

Authorization

Question 2

Your organization, Contoso, uses Microsoft Entra ID for identity management. The security team has recently identified that several users have had their credentials compromised. You need to implement a solution that automatically enforces a password change for high-risk users and blocks sign-ins from risky locations. Additionally, you want to allow users to self-remediate by changing their password when they are at medium risk. You have the following requirements:
- Users detected as high risk must be blocked from signing in until an administrator resets their password.
- Users detected as medium risk must be prompted to change their password via self-service password reset before they can access resources.
- All risk detections must be logged and reported to the security team.
- The solution must use built-in Microsoft Entra capabilities without third-party tools.

Which of the following actions should you take to meet the requirements?

Accepted Answer

Configure Microsoft Entra ID Protection user risk policies: set a policy to block access for high user risk and a policy to require password change for medium user risk. Enable risk reporting.. Microsoft Entra ID Protection provides built-in user risk policies that automatically block sign-ins for high-risk users and require a password change for medium-risk users, meeting the requirements for automated enforcement and self-remediation. Additionally, ID Protection includes risk reporting capabilities that log all risk detections for the security team, all without third-party tools.

Answer

Create conditional access policies that block sign-ins based on location and require MFA for all users.

Answer

Administratively assign users to administrative units and require administrators to review risk manually.

Answer

Use Microsoft Entra ID Governance to create an access package and require approval for access.

Question 3

A company uses Microsoft Purview to manage data lifecycle. They configure a retention label that marks content as a regulatory record and apply it to sensitive documents. A user with edit permissions attempts to modify a document that has this label applied. What will be the outcome?

Accepted Answer

The user cannot edit or delete the document.. When a retention label is configured as a regulatory record, it enforces the strictest retention and disposition controls. Regulatory records are immutable by design; once applied, no user—regardless of permissions—can edit or delete the content. This is because the label locks the document to prevent any modification or deletion until the retention period expires and a disposition review is completed.

Answer

The user can edit the document but cannot delete it.

Answer

The user can edit the document if they have edit permissions, and any changes are recorded in the audit log.

Answer

The user can edit the document only after obtaining a legal hold.

Question 4

Which THREE capabilities are provided by Microsoft Purview? (Choose three.)

Accepted Answer

Data classification and labeling. Microsoft Purview provides data classification and labeling (A) through sensitive information types, trainable classifiers, and sensitivity labels that tag and protect content across Microsoft 365 and other sources. It delivers data lifecycle management and retention (B) via retention labels, retention policies, and records management to keep or delete content per compliance requirements. It also includes data loss prevention (C), which detects and blocks risky sharing of sensitive data across Exchange, SharePoint, OneDrive, Teams, and endpoint devices. Identity protection and risk detection (D) belongs to Microsoft Entra ID Protection, not Purview, and threat and vulnerability management (E) is a Microsoft Defender for Endpoint capability, so neither is a Purview feature.

Answer

Identity protection and risk detection

Answer

Threat and vulnerability management

Question 5

A healthcare organization must comply with HIPAA regulations. They need to classify and protect medical records stored in Microsoft 365. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (D) is the correct solution because it enables organizations to classify, label, and protect sensitive data—such as medical records—using sensitivity labels and encryption. This directly supports HIPAA compliance by ensuring that protected health information (PHI) is consistently safeguarded across Microsoft 365 services, including Exchange, SharePoint, and OneDrive.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Priva

Answer

Microsoft Purview Data Lifecycle Management

Question 6

A SOC analyst in Microsoft Sentinel needs to create a custom detection rule that triggers an incident when more than 10 failed logins occur from a single IP address within 5 minutes. Which rule type should they use?

Accepted Answer

Scheduled query analytics rule. A scheduled query analytics rule is the correct choice because it allows the SOC analyst to define a custom KQL query that counts failed logins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type runs on a recurring schedule (e.g., every 5 minutes) and is designed for threshold-based detection scenarios like brute-force attacks.

Answer

Anomaly analytics rule

Answer

Near-real-time (NRT) analytics rule

Answer

Microsoft security analytics rule

Question 7

You are investigating an alert in Microsoft Defender XDR. Based on the exhibit, what is the primary detection source for this alert?

Accepted Answer

Microsoft Defender for Identity. The exhibit shows an alert from Microsoft Defender XDR with a detection source of 'Microsoft Defender for Identity'. Defender for Identity uses on-premises Active Directory signals and network traffic to detect identity-based threats like lateral movement, privilege escalation, and compromised credentials. The alert details indicate suspicious activity tied to an on-premises domain controller, which is the core focus of Defender for Identity.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 8

A company uses Microsoft Entra ID and a third-party SaaS application. They want to prevent users from downloading sensitive documents from the SaaS app when accessing from unmanaged personal devices, while still allowing read-only access. Which Conditional Access control should they apply to achieve this?

Accepted Answer

Use app control with Microsoft Defender for Cloud Apps session policy. Microsoft Defender for Cloud Apps (MDCA) session policies enable granular control over user actions within a SaaS app, such as blocking downloads while allowing read-only access. This is achieved through reverse proxy architecture that intercepts and enforces policies on HTTP/HTTPS traffic in real time, regardless of device compliance or identity provider status. Conditional Access with MDCA session control is the only option that provides app-level data protection without requiring device management or blocking access entirely.

Answer

Require multifactor authentication (MFA)

Answer

Require compliant device (Intune compliance policy)

Answer

Block access

Question 9

Your company uses Microsoft Defender XDR. You need to integrate threat intelligence from external sources to enrich alerts and automate response actions. Which feature should you use?

Accepted Answer

Threat intelligence integration. Microsoft Defender XDR's threat intelligence integration (option D) allows you to import custom threat indicators (IOCs) from external sources—such as STIX/TAXII feeds, APIs, or manual uploads—into the Microsoft 365 Defender platform. These indicators are then used to enrich alerts, trigger automated response actions via custom detection rules, and correlate with telemetry across endpoints, email, and identities. This directly meets the requirement to integrate external threat intelligence for enrichment and automation.

Answer

Automation rules

Answer

Threat analytics

Answer

Advanced hunting

Question 10

A company deploys a virtual machine on Azure IaaS. According to the Microsoft shared responsibility model, which of the following security responsibilities is primarily the customer's responsibility?

Accepted Answer

Patching the guest operating system and applications. In the Microsoft shared responsibility model, the customer is responsible for securing and patching the guest operating system and applications running on an Azure IaaS virtual machine. Microsoft manages the physical infrastructure, hypervisor, and network, while the customer controls the OS, applications, and data.

Answer

Physical security of the data centers

Answer

Ensuring the hypervisor is secured

Answer

Maintaining the network infrastructure

Question 11

A security architect is designing a defense strategy for the organization's network. The architect assumes that an attacker may already have breached the perimeter and is operating inside the network. Therefore, the design does not automatically trust any user or device, even if they are inside the corporate network, and requires continuous verification for every access request. Which security principle does this approach best represent?

Accepted Answer

Zero Trust. The Zero Trust security principle is based on the assumption that an attacker may already be inside the network, so no user or device is automatically trusted, regardless of location. This model requires continuous verification for every access request, enforcing strict identity verification and least-privilege access controls at each step. The scenario directly describes the core tenet of Zero Trust: 'never trust, always verify.'

Answer

Defense in depth

Answer

Shared responsibility

Answer

Least privilege

Question 12

Which THREE features are part of Microsoft Entra ID? (Select three.)

Accepted Answer

Privileged Identity Management. Privileged Identity Management (A) is a Microsoft Entra ID feature that provides just-in-time role activation, approval workflows, and access reviews for privileged directory roles, so it is correct. Conditional Access (C) is the Entra ID policy engine that evaluates signals such as user, device, location, and risk to grant or block access to resources, making it a core Entra ID capability. Identity Protection (D) is also part of Entra ID, using risk detections and machine learning to identify risky sign-ins and compromised users and to feed risk signals into Conditional Access. Microsoft Sentinel (B) is a separate cloud-native SIEM/SOAR service built on Azure Monitor/Log Analytics, and Microsoft Intune (E) is a separate cloud-based endpoint management (MDM/MAM) service, so neither is a feature of Microsoft Entra ID itself.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 13

A healthcare organization stores patient records in an encrypted database. Access to the database is restricted to authorized medical staff only. Which security principle is primarily being addressed by these measures?

Accepted Answer

Confidentiality. Confidentiality ensures that sensitive data, such as patient records, is accessible only to authorized individuals. Encryption renders the data unreadable to unauthorized parties, and access restrictions enforce that only authorized medical staff can decrypt and view the records. This directly aligns with the principle of confidentiality, which is a core pillar of the CIA triad.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 14

A company uses a third-party SaaS CRM application. The security team needs to monitor user sessions in real-time when sales representatives access the CRM from personal, unmanaged devices. The goal is to prevent the download of sensitive customer data to local drives. The solution should block download actions and show a warning to the user. Which Microsoft security solution should the team deploy to enforce these session controls?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) provides session-level controls via its Conditional Access App Control feature. This allows real-time monitoring and control of user sessions in third-party SaaS apps like CRM, enabling actions such as blocking downloads and displaying warnings based on device compliance (e.g., unmanaged devices). The solution integrates with Microsoft Entra Conditional Access to enforce these policies at the session layer without modifying the underlying SaaS application.

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 15

An organization wants to protect against password spray attacks by automatically blocking sign-ins from suspicious IP addresses. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection uses machine learning to detect and automatically block sign-ins from suspicious IP addresses, such as those associated with anonymous proxies or known malicious activity. It directly mitigates password spray attacks by applying risk-based conditional access policies that require additional verification or block the sign-in attempt.

Answer

Microsoft Entra Self-Service Password Reset

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Multifactor Authentication

Question 16

Your company uses Microsoft Purview Communication Compliance to detect and remediate inappropriate messages. You need to create a policy that monitors Microsoft Teams chats for potential harassment. Which type of policy should you create?

Accepted Answer

Communication Compliance policy. Microsoft Purview Communication Compliance is specifically designed to detect and remediate inappropriate messages, such as harassment, in Microsoft Teams chats and other communication channels. It uses customizable policies to scan for offensive language, sensitive information, or policy violations, enabling organizations to enforce internal compliance rules.

Answer

Data Loss Prevention (DLP) policy

Answer

Information Barriers policy

Answer

Retention policy

Question 17

Your organization wants to classify documents based on whether they contain confidential business information like trade secrets. You need to use a classifier that learns from example documents. What should you use?

Accepted Answer

Trainable classifier. A trainable classifier is the correct choice because it uses machine learning to analyze example documents and learn patterns that distinguish content containing confidential business information, such as trade secrets. Unlike predefined sensitive information types, trainable classifiers can be customized to identify unique or proprietary content by training on your specific sample documents. This aligns with the requirement to 'learn from example documents' rather than relying on fixed patterns or exact matches.

Answer

Exact data match

Answer

Data loss prevention policy

Answer

Sensitive information type

Question 18

Your organization wants to audit all activities related to accessing sensitive files in Microsoft SharePoint. Which Microsoft Purview solution should you use?

Accepted Answer

Audit (Premium). Audit (Premium) in Microsoft Purview provides detailed logging of user and admin activities, including granular events like file access, modification, and permission changes in SharePoint. This solution enables organizations to investigate and audit all activities related to sensitive files by capturing and retaining audit records with high-volume event support and custom alerting.

Answer

Data lifecycle management

Answer

Information barriers

Answer

Data loss prevention

Question 19

A healthcare organization uses Microsoft 365. They need to prevent employees from sharing emails or documents that contain patient medical record numbers (MRNs) with external recipients. If an attempt is made, the message should be blocked and the sender should receive a policy tip notification. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as patient medical record numbers (MRNs), with external recipients. DLP policies can be configured to scan emails and documents for patterns (e.g., regex for MRNs), block the transmission, and display a policy tip notification to the sender, meeting all requirements.

Answer

Data Lifecycle Management

Answer

Records Management

Answer

Information Protection

Question 20

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access. Conditional Access in Microsoft Entra ID is the correct feature because it allows you to enforce policies that require devices to be marked as compliant by Microsoft Intune before granting access to corporate email. By integrating with Intune, Conditional Access evaluates device compliance status in real time and blocks or allows access accordingly, ensuring only managed and compliant devices can reach email resources.

Answer

Privileged Identity Management

Answer

Self-Service Password Reset

Answer

Identity Protection