SC-900 Practice Exam 58 — 20 Questions

Question 1

You are a compliance officer at a healthcare organization that uses Microsoft 365. The organization must comply with HIPAA regulations. You have Microsoft Purview, Microsoft Defender for Cloud Apps, and Microsoft Intune. You need to ensure that all devices accessing patient health information (PHI) are compliant with the organization's security policies, which require device encryption, a minimum OS version, and the use of a compliant mobile device management (MDM) provider. Currently, some devices are not managed by Intune. You need to enforce that only compliant devices can access PHI stored in SharePoint Online. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a conditional access policy in Microsoft Entra ID to require compliant devices. A conditional access policy in Microsoft Entra ID can be configured to require that devices accessing SharePoint Online be marked as compliant. Device compliance is determined by Intune compliance policies (covering encryption, OS version, MDM enrollment) but the enforcement is done via conditional access. Option A is wrong because creating a compliance policy alone does not enforce the requirement; you need a conditional access policy to block non-compliant devices. Option B is wrong because app protection policies manage data access at the app level but do not enforce device compliance (e.g., OS version or device encryption). Option D is wrong because DLP policies focus on preventing data leakage, not on device compliance.

Answer

Create a device compliance policy in Microsoft Intune and assign it to all users

Answer

Deploy an app protection policy in Microsoft Intune to restrict data access

Answer

Create a DLP policy in Microsoft Purview to block access from non-compliant devices

Question 2

A company uses Microsoft 365 and needs to identify and protect sensitive data, such as credit card numbers, stored in SharePoint Online and OneDrive for Business. They also want to prevent users from sharing this data externally. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) in Microsoft Purview is the correct solution because it is specifically designed to identify, monitor, and automatically protect sensitive data like credit card numbers (using built-in sensitive information types such as Credit Card Number) across Microsoft 365 services, including SharePoint Online and OneDrive for Business. DLP policies can enforce rules to block or restrict external sharing of such data, directly meeting the requirement to prevent users from sharing sensitive data externally.

Answer

Data Lifecycle Management (DLM)

Answer

Information Protection (sensitivity labels)

Answer

Audit (Standard)

Question 3

Refer to the exhibit. You are a security administrator for a company using Azure Virtual Network Manager. You have deployed the security admin configuration shown. What is the impact of this rule?

Accepted Answer

It blocks inbound SMB traffic from the internet to the subnet.. This security admin configuration in Azure Virtual Network Manager creates a rule that denies inbound traffic on port 445 (SMB) from the 'Internet' service tag to the target subnet. Since the rule has a priority of 100 (lowest number = highest priority) and the action is 'Deny', it overrides any lower-priority or default allow rules, effectively blocking inbound SMB traffic from the internet to the subnet. The rule does not affect outbound traffic or other protocols like RDP unless they are explicitly specified.

Answer

It blocks outbound traffic from the subnet to the internet.

Answer

It denies all traffic from the internet to the subnet.

Answer

It blocks inbound RDP traffic from the internet.

Question 4

Refer to the exhibit. You run the PowerShell command to search the unified audit log for file deletions. The command returns no results, but you know a file was deleted last week. What is the most likely reason?

Accepted Answer

Audit logging is not enabled for the organization. The most likely reason is that audit logging is not enabled for the organization. In Microsoft 365, unified audit log search requires that audit logging be explicitly turned on (by default, it is enabled for most tenants, but it can be disabled). If audit logging is disabled, no audit records are generated, so any search—including for 'FileDeleted' operations—will return no results, even if files were actually deleted.

Answer

The operation name 'FileDeleted' is incorrect

Answer

Audit logs are only retained for 90 days

Answer

The StartDate and EndDate are incorrect

Question 5

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows external partners to access resources using their own identity provider. Which Microsoft Entra feature should you use?

Accepted Answer

External ID. Microsoft Entra External ID (formerly Azure AD B2B) allows external partners to access your organization's resources using their own identity providers, enabling secure collaboration without managing external identities. Option A is incorrect because Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) solution for multi-cloud permissions. Option B is incorrect because Microsoft Entra Verified ID is a verifiable credentials solution for decentralized identity verification. Option C is incorrect because Entra ID Governance focuses on identity lifecycle management, access reviews, and entitlement management.

Answer

Microsoft Entra Permissions Management

Answer

Microsoft Entra Verified ID

Answer

Entra ID Governance

Question 6

A company runs a web application in Azure that is publicly accessible. They want to protect it against large-scale distributed denial-of-service (DDoS) attacks from multiple sources. Which Azure service is specifically designed for this purpose?

Accepted Answer

Azure DDoS Protection. Azure DDoS Protection is specifically designed to safeguard Azure resources against large-scale distributed denial-of-service (DDoS) attacks. It leverages the global scale of Microsoft's network to absorb and mitigate multi-gigabit attacks, providing always-on traffic monitoring and adaptive tuning. This service is the only option among the choices that is purpose-built for DDoS mitigation at the network and transport layers (L3/L4), and it also offers application-layer (L7) protection when combined with Application Gateway WAF.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Question 7

Sequence the steps to set up Microsoft Sentinel for a new workspace.

Accepted Answer

Create Log Analytics workspace → Enable Microsoft Sentinel → Connect data sources → Create analytics rules → Set up automation. Setting up Sentinel requires a Log Analytics workspace, enabling Sentinel, connecting sources, creating rules, and automating responses.

Answer

Create Log Analytics workspace → Connect data sources → Enable Microsoft Sentinel → Create analytics rules → Set up automation

Answer

Create Log Analytics workspace → Enable Microsoft Sentinel → Create analytics rules → Connect data sources → Set up automation

Answer

Create Log Analytics workspace → Enable Microsoft Sentinel → Connect data sources → Set up automation → Create analytics rules

Question 8

A company operates an e-commerce website that must remain accessible during high-traffic holiday seasons. The IT team deploys additional web servers and implements automatic failover to a secondary data center if the primary site goes down. Which security principle is the company primarily addressing?

Accepted Answer

Availability. The company is ensuring that the e-commerce website remains operational even during high-traffic periods or after a primary site failure. Deploying additional web servers and implementing automatic failover to a secondary data center directly supports the availability principle, which ensures that systems and data are accessible when needed. This is a core tenet of the CIA triad, and in this scenario, the focus is on uptime and resilience, not on protecting data from unauthorized access or modification.

Answer

Confidentiality

Answer

Integrity

Answer

Authorization

Question 9

A company wants to proactively detect and investigate potential insider security risks, such as a departing employee copying large amounts of data to a personal USB drive or sharing confidential files with unauthorized individuals. Which Microsoft Purview solution should they use?

Accepted Answer

Insider Risk Management. Insider Risk Management in Microsoft Purview is specifically designed to detect, investigate, and act on risky user activities that may lead to data security incidents, such as unauthorized data exfiltration by departing employees. It uses predefined and customizable policies to correlate signals from Microsoft 365 logs (e.g., copying files to USB, sharing with external users) and applies risk-scoring to prioritize alerts. This makes it the correct solution for proactively identifying potential insider threats like bulk data copying or unauthorized file sharing.

Answer

Data Lifecycle Management

Answer

Communication Compliance

Answer

eDiscovery (Standard)

Question 10

Which TWO Microsoft Purview features allow you to monitor and manage data across hybrid environments (on-premises and cloud)?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is correct because it provides a unified map of data assets across on-premises, multi-cloud, and SaaS sources, enabling automated scanning and classification of sensitive data. Microsoft Purview Data Estate Insights is correct because it offers monitoring and governance dashboards that track data movement, usage, and compliance posture across hybrid environments, giving administrators visibility into both on-premises and cloud data estates.

Answer

eDiscovery

Answer

Information Protection

Answer

Communication Compliance

Question 11

A multinational corporation needs to enforce data residency requirements by storing data in specific geographic locations. They are using Microsoft Purview for data governance. Which capability should they leverage to meet this requirement?

Accepted Answer

Microsoft Purview Multi-Geo. Microsoft Purview Multi-Geo is the correct capability because it enables organizations to store data at rest in specific geographic locations to meet data residency requirements. This feature works by provisioning data in chosen regions while maintaining a single Microsoft 365 tenant, allowing the multinational corporation to comply with local regulations without needing separate tenants.

Answer

Data loss prevention policies

Answer

Sensitivity labels with encryption

Answer

Azure Information Protection unified labeling

Question 12

A company stores application secrets and encryption keys in Azure Key Vault. They want to move from the older vault access policy model to a more scalable and granular permission model that integrates with Azure's role-based access control (RBAC). They also need to audit permissions using Azure Policy. Which access configuration should they choose for Azure Key Vault?

Accepted Answer

Enable the Azure RBAC permission model for Key Vault. Enabling the Azure RBAC permission model for Key Vault replaces the older vault access policy model with Azure's native role-based access control, providing granular, scalable permissions that integrate directly with Azure Policy for auditing. This model allows you to assign roles like Key Vault Secrets User or Key Vault Crypto Officer at the management plane, enabling centralized permission management across multiple vaults and supporting Azure Policy compliance checks.

Answer

Use a single vault access policy with the Contributor role

Answer

Assign a managed identity to the Key Vault

Answer

Use a service principal and configure vault access policies per application

Question 13

A company uses Microsoft Defender for Endpoint. An alert indicates that a device is communicating with a known malicious IP address. The security team wants to automatically block the IP address on all devices. Which action should they configure?

Accepted Answer

Indicator of compromise (IoC). An Indicator of compromise (IoC) in Microsoft Defender for Endpoint can be configured to automatically block a known malicious IP address across all devices. Option A (Custom detection rule) is wrong because custom detection rules are used for custom query-based detection, not for blocking. Option B (Automated investigation) is wrong because automated investigation can investigate and resolve alerts but does not directly block IP addresses. Option D (Threat analytics report) is wrong because it provides threat intelligence reports but does not take blocking actions.

Answer

Custom detection rule

Answer

Automated investigation

Answer

Threat analytics report

Question 14

A company is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities shifts from the customer to Microsoft during this migration?

Accepted Answer

Physical security of the data center infrastructure. When migrating on-premises applications to Azure IaaS, the shared responsibility model shifts physical security responsibilities—such as data center access controls, environmental controls, and hardware security—from the customer to Microsoft. Microsoft is responsible for the physical security of all Azure data centers, including perimeter security, surveillance, and facility access management, which were previously the customer's responsibility in their own on-premises environment.

Answer

Configuring network security groups (NSGs)

Answer

Patching the operating system on virtual machines

Answer

Managing user identities and access to the application

Question 15

Refer to the exhibit. You are evaluating a custom Azure Policy definition. The policy is intended to audit whether users assigned to a management role have MFA enabled. However, the policy is not triggering alerts for non-compliant users. What is the most likely cause?

Accepted Answer

The 'mfaEnabledPrincipals' parameter is not populated with the list of MFA-enabled users.. The policy definition includes a parameter named 'mfaEnabledPrincipals' that must be populated with the list of user object IDs who have MFA enabled. If this parameter is empty or not provided, the 'auditIfNotExists' effect cannot evaluate any users against the expected MFA status, resulting in no non-compliant alerts being triggered. Azure Policy relies on explicit parameter values to define the baseline for compliance evaluation.

Answer

The policy mode is set to 'All' instead of 'Indexed'.

Answer

The policy only evaluates role assignments of type 'Microsoft.Authorization/roleAssignments' but not users.

Answer

The effect 'auditIfNotExists' should be 'deny' to trigger alerts.

Question 16

A company uses an on-premises Active Directory (AD) and wants to enable single sign-on (SSO) for users to access Microsoft 365 and a third-party SaaS application. They plan to use an external identity provider (IdP) that supports Security Assertion Markup Language (SAML) 2.0. Which identity concept does this implementation primarily rely on?

Accepted Answer

Federation. Federation is the correct answer because it establishes a trust relationship between the on-premises Active Directory and the external identity provider (IdP) using SAML 2.0, enabling users to authenticate once and gain access to both Microsoft 365 and the third-party SaaS application without re-entering credentials. This relies on the IdP issuing SAML assertions that are trusted by the relying parties (Microsoft 365 and the SaaS app), which is the core mechanism of federated identity.

Answer

Provisioning

Answer

Synchronization

Answer

Directory extension

Question 17

A user accidentally shared a confidential document with an external vendor. You need to revoke access immediately for all copies, even if the file has been downloaded. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) allows you to classify, label, and protect documents and emails. When a confidential document is shared accidentally, you can use the 'Revoke Access' action on the protected file via the Microsoft Purview compliance portal or PowerShell. This revokes access for all copies, even if the file has been downloaded, because the protection travels with the file through persistent rights management.

Answer

Retention policy

Answer

Data loss prevention (DLP) policy

Answer

Audit log search

Question 18

Your company uses Microsoft Defender for Endpoint. A report shows that several devices are missing critical security updates. What feature should you use to deploy the missing updates?

Accepted Answer

Microsoft Intune update rings for Windows. Microsoft Intune update rings for Windows allow you to configure and deploy Windows quality and feature updates to managed devices. Since the question specifies deploying missing security updates, update rings provide the policy-based mechanism to schedule and enforce installation of those updates across devices enrolled in Intune.

Answer

Microsoft Defender for Endpoint's threat and vulnerability management (TVM)

Answer

Microsoft Configuration Manager

Answer

Microsoft Update

Question 19

A company uses Microsoft 365 and wants to protect users from malicious attachments in email. The security team wants a solution that detonates attachments in a sandbox environment before delivery, and only allows the email through if the attachment is deemed safe. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Attachments, a feature that detonates email attachments in a virtual sandbox environment before delivery. It analyzes the attachment's behavior for malicious activity and only releases the email to the recipient's mailbox if the attachment is deemed safe, directly meeting the requirement for pre-delivery sandboxing.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Azure Firewall

Question 20

Your organization is implementing Microsoft Purview Information Protection and needs to ensure that files shared externally cannot be forwarded or printed. Which protection mechanism should be applied?

Accepted Answer

Azure Information Protection with rights management. Azure Information Protection with rights management (now part of Microsoft Purview Information Protection) allows you to apply persistent protection that restricts actions like forwarding and printing on files shared externally. This is achieved through Azure Rights Management (Azure RMS) encryption and usage rights, which travel with the file regardless of where it is stored or sent.

Answer

Microsoft Purview Data Lifecycle Management retention policy

Answer

Sensitivity label with user-defined permissions

Answer

DLP policy with block action