SC-900 Practice Exam 58 — 20 Questions

Question 1

Which TWO of the following are capabilities of Microsoft Entra ID? (Select two.)

Accepted Answer

Identity as a Service (IDaaS) for cloud applications. Microsoft Entra ID is a cloud-based identity and access management service, providing Identity as a Service (IDaaS) for cloud applications. It enables organizations to manage user identities and control access to resources, including thousands of pre-integrated SaaS applications through single sign-on (SSO). This makes option B correct because Entra ID's core function is identity management, not endpoint security or network infrastructure.

Answer

Antivirus and antimalware protection

Answer

Provide network firewall services

Answer

Manage mobile devices and applications

Question 2

Your company wants to allow employees to use their corporate Microsoft Entra ID credentials to sign in to third-party SaaS applications like Salesforce and ServiceNow. Which Microsoft Entra feature should you configure?

Accepted Answer

Enterprise applications with pre-integrated gallery apps.. Configuring a third-party SaaS application like Salesforce or ServiceNow as an Enterprise Application in Microsoft Entra ID allows you to set up federation using SAML 2.0 or OpenID Connect, enabling users to sign in with their corporate Entra ID credentials. The pre-integrated gallery apps provide pre-configured templates that simplify the setup of single sign-on (SSO) and user provisioning, making it the appropriate feature for this requirement.

Answer

Conditional Access policies.

Answer

Microsoft Entra B2B collaboration.

Answer

Microsoft Entra Identity Protection.

Question 3

A multinational company uses Microsoft 365 and has a retention policy that automatically applies a 7-year retention label to any document containing a credit card number. The retention label must be automatically applied at the time the document is created or modified. Which Microsoft Purview solution should the administrator use to configure this automatic labeling rule?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Records Management) is the correct solution because it provides the ability to create and apply retention labels automatically based on sensitive information types, such as credit card numbers, using auto-labeling policies. This ensures that the retention label is applied at the time of document creation or modification, meeting the requirement for automatic application without user intervention.

Answer

Microsoft Purview Retention Policy

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview eDiscovery

Question 4

A healthcare organization must comply with HIPAA regulations. They store patient health information (PHI) in SharePoint Online documents. The compliance team needs to automatically detect PHI (e.g., medical record numbers) in documents, apply a sensitivity label that encrypts the document, and prevent users from removing that label. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (option B) is correct because it provides the ability to automatically detect sensitive data types (such as PHI) using trainable classifiers or sensitive information types, apply a sensitivity label that enforces encryption, and configure label protection settings to prevent users from removing the label. This directly meets the HIPAA compliance requirement for automated detection, encryption, and label persistence on SharePoint Online documents.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Question 5

A company uses Microsoft Purview to classify and label data. The compliance team needs to automatically apply a 'Highly Confidential' sensitivity label to any document containing a passport number that is stored in SharePoint Online. The label should also encrypt the document. What should the compliance team configure?

Accepted Answer

Create an auto-labeling policy for sensitivity labels. Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents based on conditions such as the presence of sensitive information types (e.g., passport numbers). When configured, the policy can also enforce encryption as part of the label's protection settings, ensuring that any document stored in SharePoint Online containing a passport number is automatically labeled 'Highly Confidential' and encrypted.

Answer

Create a retention label with a retention rule

Answer

Create a data loss prevention (DLP) policy

Answer

Create a manual sensitivity label and train users

Question 6

The exhibit shows that a user was added to the Global Administrator role. Which Microsoft Entra feature should be used to provide just-in-time access to this role?

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) is the Microsoft Entra feature specifically designed to provide just-in-time (JIT) privileged access to roles like Global Administrator. PIM enables time-bound activation, approval workflows, and audit logging, ensuring users have elevated permissions only when needed and for a limited duration.

Answer

Conditional Access

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 7

A company runs workloads in Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). The security team needs a single, unified dashboard to continuously assess the security posture of all cloud resources, identify misconfigurations, and receive prioritized recommendations for remediation. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct solution because it provides a unified cloud security posture management (CSPM) dashboard that continuously assesses resources across Azure, AWS, and GCP. It identifies misconfigurations against industry benchmarks (e.g., CIS, NIST) and delivers prioritized, actionable recommendations to remediate risks, directly meeting the requirement for a single dashboard across multi-cloud environments.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 8

A company issues laptops to all employees with BitLocker full-disk encryption enabled. If a laptop is stolen, the data on the hard drive cannot be read without the recovery key. Which security principle does this measure primarily protect?

Accepted Answer

Confidentiality. BitLocker full-disk encryption ensures that data on a stolen laptop's hard drive is unreadable without the recovery key, directly protecting against unauthorized access. This aligns with the confidentiality principle, which safeguards sensitive information from disclosure to unauthorized parties.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 9

A law firm uses Microsoft 365. They must retain all client communication records for 10 years due to regulatory requirements. After 10 years, the records must be permanently deleted. Additionally, they need to ensure that users cannot permanently delete these records before the retention period ends. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Records Management. Microsoft Purview Records Management is the correct solution because it allows the law firm to apply retention labels that mark content as a regulatory record, which prevents users from permanently deleting the records before the retention period ends. It also supports disposition review and permanent deletion after the specified 10-year retention period, meeting both the retention and deletion requirements.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 10

A company deploys Microsoft Defender for Cloud Apps. They want to detect when a user downloads more than 100 files from SharePoint in 10 minutes. Which policy type should they create?

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Microsoft Defender for Cloud Apps are designed to identify unusual user activities that deviate from normal behavior, such as mass file downloads. They use machine learning to establish a baseline and trigger alerts when thresholds like 'more than 100 files in 10 minutes' are exceeded. This is the correct policy type for detecting such behavioral anomalies.

Answer

File policy

Answer

App permission policy

Answer

Session policy

Question 11

Which THREE components are part of Microsoft Defender XDR? (Choose three.)

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR is Microsoft's extended detection and response suite that unifies several Defender workloads under a single portal. Option B, Microsoft Defender for Office 365, is correct because it is one of the core Defender XDR pillars, providing protection for email, collaboration tools, and phishing/URL detonation signals. Option D, Microsoft Defender for Identity, is correct because it monitors on-premises Active Directory and identity signals (via domain controller sensors) and feeds those detections into Defender XDR. Option E, Microsoft Defender for Endpoint, is correct because it is the endpoint pillar of Defender XDR, delivering device-level detection, investigation, and response. Option A, Microsoft Purview, is not part of Defender XDR; it is a separate compliance and data-governance suite. Option C, Microsoft Sentinel, is also not a Defender XDR component; it is a standalone cloud-native SIEM/SOAR solution that can integrate with Defender XDR but is not one of its constituent workloads.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 12

A company requires that all users accessing a financial application from outside the corporate network must complete multi-factor authentication (MFA). The IT team is configuring a Microsoft Entra ID Conditional Access policy to enforce this requirement. Which component of the policy should be configured to apply the MFA requirement?

Accepted Answer

Grant controls. Grant controls are the component of a Conditional Access policy that enforce the actual access requirements, such as requiring multi-factor authentication (MFA). By configuring the 'Require multi-factor authentication' checkbox under Grant controls, the policy ensures that users must complete MFA before accessing the financial application. This is the correct setting to apply the MFA requirement.

Answer

Conditions

Answer

Assignments

Answer

Session controls

Question 13

You need to provide external partners with access to your organization's SharePoint site. The partners must use their own credentials. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is the correct feature because it enables external users (partners) to access your organization's resources using their own identities (e.g., work, social, or other Microsoft Entra ID accounts). It leverages the existing Microsoft Entra ID tenant to issue guest user objects and supports SAML/WS-Federation or OIDC for authentication, allowing partners to authenticate with their own credentials without requiring a separate account or password in your tenant.

Answer

Microsoft Entra Identity Governance

Answer

Privileged Identity Management

Answer

Microsoft Entra ID Protection

Question 14

A security architect is implementing a Zero Trust strategy. They state that all access requests must be verified continuously, regardless of where the request originates (corporate network or remote). They also emphasize that access is granted based on a policy that evaluates user identity, device health, location, and risk in real-time. Which Zero Trust guiding principle does this scenario primarily illustrate?

Accepted Answer

Verify explicitly. The scenario explicitly describes continuous verification of all access requests based on real-time signals (user identity, device health, location, risk). This directly maps to the 'Verify explicitly' Zero Trust principle, which mandates that every access attempt must be authenticated and authorized using all available data points before granting access, regardless of network location.

Answer

Use least privilege access

Answer

Assume breach

Answer

Enforce session controls

Question 15

A company uses Microsoft Entra ID. The security team needs to grant temporary elevated access to the Global Administrator role for a specific task, such as configuring a new security policy. They want the user to request activation, which is then approved by a manager, and the privileges automatically expire after 4 hours. Which Microsoft Entra feature should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time (JIT) privileged access, allowing users to request activation of roles like Global Administrator. The activation can require approval from a manager and is automatically deactivated after a configurable maximum duration (e.g., 4 hours), directly meeting the security team's requirements.

Answer

Conditional Access

Answer

Identity Protection

Answer

Self-Service Password Reset (SSPR)

Question 16

A company uses Microsoft 365 and wants to deploy a security solution that can automatically detect and remediate advanced attacks on endpoints (workstations and servers), such as ransomware and fileless attacks. They also want to provide incident response teams with detailed forensic data and the ability to isolate an infected machine from the network. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities, including automatic detection and remediation of advanced attacks like ransomware and fileless attacks. It also offers detailed forensic data for incident response and the ability to isolate an infected machine from the network, meeting all the specified requirements.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 17

Your company uses Microsoft Entra ID to manage user identities. You need to ensure that users can sign in using their existing social media accounts. Which Microsoft Entra feature should you configure?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD B2C) is the correct feature because it is specifically designed to enable external identities, including social identity providers like Google, Facebook, and Microsoft accounts, for customer-facing applications. It supports standards such as OAuth 2.0 and OpenID Connect to allow users to sign in with their existing social media accounts without needing a separate Microsoft Entra ID account.

Answer

Microsoft Entra B2B collaboration

Answer

Conditional Access policies

Answer

Privileged Identity Management

Question 18

A company wants to ensure that data is not altered during transmission between a client and a server. They use TLS encryption. Which security goal does this primarily address?

Accepted Answer

Integrity. TLS (Transport Layer Security) uses message authentication codes (MACs) and cryptographic hashing to ensure that data is not tampered with during transit. While TLS also provides confidentiality through encryption, the specific goal of preventing alteration during transmission is integrity. Therefore, option B is correct because integrity guarantees that the data received is exactly what was sent, unchanged by any intermediary.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 19

Your organization requires that all external guest users must sign in using Microsoft Authenticator for MFA. What should you configure?

Accepted Answer

Conditional Access policy. A Conditional Access policy is the correct choice because it allows you to enforce MFA requirements for specific users, including external guest users, based on conditions such as sign-in risk, location, or device state. By targeting the 'Guest or external users' directory role in a Conditional Access policy, you can require Microsoft Authenticator as the MFA method, overriding default settings. This provides granular control over authentication behavior for B2B collaboration guests.

Answer

Microsoft Entra B2B collaboration settings

Answer

Access reviews

Answer

ID Protection policies

Question 20

Your organization uses Microsoft 365 and needs to identify internal users who are sending confidential data to external domains repeatedly. Which Microsoft Purview solution should you use?

Accepted Answer

Insider Risk Management. Insider Risk Management (IRM) is the correct solution because it is specifically designed to detect, investigate, and act on risky user activities that violate organizational policies, such as repeatedly sending confidential data to external domains. IRM uses predefined or custom policies to correlate signals from Microsoft 365 logs (e.g., email, SharePoint, Teams) and user behavior analytics to identify patterns of data exfiltration by internal users. Unlike other solutions, IRM focuses on user-centric risk scenarios and can trigger automated responses like escalation or case creation.

Answer

Data Loss Prevention

Answer

Audit (Premium)

Answer

Communication Compliance