SC-900 Practice Exam 59 — 20 Questions

Question 1

A security architect is designing a system where user access rights are reviewed and certified on a regular basis by data owners. The goal is to ensure that users continue to have only the permissions necessary to perform their job functions and that no excessive permissions exist. Which security principle is primarily being implemented through these regular reviews?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Least privilege. Regular access reviews directly enforce the principle of least privilege by ensuring users retain only the permissions necessary for their current job functions. This process identifies and removes excessive permissions that may have accumulated over time, aligning with the core goal of minimizing the attack surface. In Microsoft 365, this is often implemented through Microsoft Entra ID access reviews, where data owners certify or revoke user access.

Answer

Defense in depth

Answer

Zero trust

Answer

Separation of duties

Question 2

A security administrator needs to block legacy authentication protocols across all applications in Microsoft Entra ID. Which conditional access policy setting should they configure?

Accepted Answer

Under 'Conditions', configure 'Client apps' to block legacy authentication. Legacy authentication protocols (such as POP3, IMAP4, SMTP, and older Office clients) do not support modern authentication methods like MFA or conditional access. By configuring the 'Client apps' condition in a Conditional Access policy to block legacy authentication, the administrator can prevent these insecure sign-in attempts across all applications in Microsoft Entra ID.

Answer

Under 'Grant', select 'Block access'

Answer

Under 'Conditions', configure 'Locations' to block all locations

Answer

Set 'Sign-in frequency' to 1 hour

Question 3

A company uses Microsoft Entra ID and Intune for device management. The security team wants to create a Conditional Access policy for a sensitive research application. They require that: 1) The user must use a device that is marked as compliant by Intune, and 2) The user must accept the company's terms of use before accessing the app. Which grant control combination should they configure in the policy?

Accepted Answer

Select 'Require device to be marked as compliant' and 'Require terms of use' and choose 'Require all the selected controls'. The policy requires both conditions—device compliance and terms of use—to be enforced simultaneously. In Microsoft Entra Conditional Access, when multiple grant controls are selected and set to 'Require all the selected controls', the user must satisfy every control to gain access. This matches the security team's requirement that the device must be compliant AND the terms of use must be accepted.

Answer

Select 'Require device to be marked as compliant' and 'Require terms of use' and choose 'Require one of the selected controls'

Answer

Select 'Require multi-factor authentication' and 'Require terms of use' and choose 'Require all the selected controls'

Answer

Select only 'Require terms of use' and configure device compliance as a condition

Question 4

A company wants to securely grant external business partners access to internal SharePoint sites and Teams channels. The partners use various identity providers, including Google and Microsoft personal accounts. The company needs to manage these external identities in their Microsoft Entra ID directory and enforce access policies. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is designed to securely share applications and resources with external guest users from any identity provider, including Google and Microsoft personal accounts. It allows the company to manage these external identities in their Entra ID directory and enforce conditional access policies, meeting the requirement to grant partners access to SharePoint and Teams.

Answer

Microsoft Entra B2C (Business-to-Consumer)

Answer

Microsoft Entra Connect

Answer

Microsoft Entra Identity Protection

Question 5

A security operations team needs to protect their organization's Windows 10 and Windows 11 devices from advanced persistent threats (APTs), ransomware, and fileless malware. They also require a centralized dashboard to view device security posture, investigate incidents, and perform proactive threat hunting using advanced queries. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities specifically designed to protect Windows 10 and Windows 11 devices against advanced persistent threats (APTs), ransomware, and fileless malware. It includes a centralized dashboard (Microsoft 365 Defender portal) for viewing device security posture, investigating incidents, and performing proactive threat hunting using advanced hunting queries based on Kusto Query Language (KQL).

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 6

A user authenticates with a smart card and is then granted access to a specific database based on their job role in the finance department. Which security concept describes the process of determining what the authenticated user is allowed to do?

Accepted Answer

Authorization. Authorization is the security concept that determines what an authenticated user is permitted to do. In this scenario, after the user authenticates with a smart card, the system checks their job role in the finance department against access control lists (ACLs) or role-based access control (RBAC) policies to grant access to the specific database. This is distinct from authentication, which only verifies identity.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 7

A security analyst is explaining the core principles of information security to a new team member. Which principle ensures that data is not modified by unauthorized parties?

Accepted Answer

Integrity. The principle of integrity ensures that data remains accurate and unaltered during storage, processing, or transmission, except by authorized entities. In the context of information security, integrity is specifically concerned with preventing unauthorized modification, deletion, or creation of data. This is often enforced through mechanisms such as hashing (e.g., SHA-256), digital signatures, and checksums (e.g., CRC32) that detect any tampering.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 8

An organization implements a policy where users must provide two forms of verification, such as a password and a text message code, to access the corporate network. Which security concept does this demonstrate?

Accepted Answer

Multifactor authentication. Multifactor authentication (MFA) requires two or more distinct factors (e.g., something you know like a password, and something you have like a text message code) to verify identity. This is correct because the policy explicitly demands two forms of verification, which is the defining characteristic of MFA, not just single-factor authentication.

Answer

Authorization

Answer

Authentication

Answer

Accounting

Question 9

An organization implements a security policy where users must authenticate using a smart card and PIN. After successful authentication, the system checks whether the user's device is managed by the organization and complies with security baselines. If the device is compliant, the user is granted access to the corporate network. If not, access is denied. This approach most directly reflects which security model?

Accepted Answer

Zero Trust. The scenario explicitly enforces 'never trust, always verify' by requiring authentication (smart card + PIN) and then validating device compliance before granting network access. This directly aligns with the Zero Trust model's core principle of conditional access based on identity and device health, rather than implicit trust from network location.

Answer

Defense in depth

Answer

CIA triad

Answer

Least privilege

Question 10

Your organization wants to enable passwordless authentication for users. Which Microsoft Entra ID feature should you use?

Accepted Answer

Passwordless authentication methods. Passwordless authentication methods is the correct feature because it is the specific Microsoft Entra ID capability that allows users to sign in without a password, using methods such as Windows Hello for Business, the Microsoft Authenticator app, FIDO2 security keys, or phone sign-in. This directly enables the organization's goal of passwordless authentication.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 11

A financial services organization needs to automatically classify and protect sensitive documents containing credit card information in SharePoint Online and OneDrive for Business. They want a purple-colored label to be applied automatically when the document is saved, and the document should be encrypted with a predefined template that restricts editing to internal users only. Which Microsoft Purview solution should they configure?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling in Microsoft Purview can automatically apply a purple-colored label to documents containing credit card information when saved in SharePoint Online or OneDrive for Business. This label can be configured with encryption using a predefined template that restricts editing to internal users only, meeting the organization's classification and protection requirements.

Answer

Data Loss Prevention (DLP) policies

Answer

Data Lifecycle Management (retention labels)

Answer

Audit (Unified Auditing)

Question 12

According to the Zero Trust security model, which principle assumes that a breach has already occurred and therefore requires segmenting access and monitoring for lateral movement?

Accepted Answer

Assume breach. The 'Assume breach' principle of the Zero Trust security model explicitly operates under the mindset that a breach has already occurred or is inevitable. This drives the need for segmenting access (e.g., micro-segmentation using network policies or Azure Virtual Network security groups) and continuous monitoring for lateral movement (e.g., using Microsoft Defender for Identity to detect pass-the-hash or Kerberos ticket attacks).

Answer

Verify explicitly

Answer

Use least privilege

Answer

Trust but verify

Question 13

Which TWO are capabilities of Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Entitlement Management. Entitlement Management and Access Reviews are capabilities of Entra ID Governance. Conditional Access is a separate feature, Identity Protection is security, and SSPR is user self-service.

Answer

Self-service password reset

Answer

Identity Protection

Answer

Conditional Access

Question 14

A company has deployed Microsoft Defender for Identity and wants to detect pass-the-hash attacks in real time. Which alert type should they monitor?

Accepted Answer

Suspected Pass-the-Hash attack. Microsoft Defender for Identity specifically detects pass-the-hash attacks by monitoring anomalous NTLM authentication patterns, such as the use of hashed credentials from one machine to authenticate to another. The 'Suspected Pass-the-Hash attack' alert is triggered when Defender for Identity identifies a hash being reused across multiple devices in a way that indicates lateral movement, which is the core behavior of a pass-the-hash attack.

Answer

Suspected Kerberoasting attack

Answer

Suspected Brute Force attack

Answer

Suspected Golden Ticket attack

Question 15

Which TWO are capabilities of Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Session control to monitor user activity in cloud apps. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides Cloud Discovery to identify shadow IT by analyzing traffic logs from firewalls and proxies, making option E correct. It also delivers Conditional Access App Control, which uses reverse-proxy session control to monitor and restrict user activity in cloud apps in real time, making option D correct. Option A is wrong because endpoint detection and response is provided by Microsoft Defender for Endpoint, not Defender for Cloud Apps. Option B is wrong because identity protection for user accounts is handled by Microsoft Entra ID Protection. Option C is wrong because data classification of on-premises files is performed by Microsoft Purview Information Protection, not by this CASB service.

Answer

Endpoint detection and response (EDR)

Answer

Identity protection for user accounts

Answer

Data classification of on-premises files

Question 16

Your company is implementing a hybrid identity solution with Microsoft Entra ID. You need to ensure that password changes on-premises are synchronized to the cloud within minutes. Which feature should you enable?

Accepted Answer

Password Hash Synchronization. Password Hash Synchronization (A) synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID in near real-time, ensuring that password changes made on-premises are reflected in the cloud within minutes. Password Writeback (D) performs the reverse: it writes password changes from the cloud back to on-premises, not from on-premises to the cloud. Pass-through Authentication (B) validates passwords against on-premises AD directly without syncing hashes, and Seamless SSO (C) provides automatic sign-in but does not handle password synchronization.

Answer

Pass-through Authentication

Answer

Seamless Single Sign-On

Answer

Password Writeback

Question 17

You are troubleshooting a Windows device that is reporting as non-compliant in Microsoft Intune. The exhibit shows the output of a PowerShell command run on the device. Based on the output, which component is likely misconfigured?

Accepted Answer

Microsoft Defender for Endpoint sensor onboarding. The PowerShell output shows the 'OnboardingState' value is 0, which indicates the device is not onboarded to Microsoft Defender for Endpoint. Intune uses the Defender for Endpoint sensor as a compliance signal; if the sensor is not properly onboarded, the device will report as non-compliant regardless of other security settings.

Answer

Antivirus protection

Answer

Antispyware protection

Answer

Microsoft Defender Antivirus real-time protection

Question 18

You are the identity architect for a global organization with 100,000 users across 50 countries. The company uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. Recently, the security team identified that several compromised user accounts were used to exfiltrate data from a cloud storage app. The CISO wants to implement a solution that detects anomalous behavior (e.g., impossible travel, mass download) and automatically blocks the user session when such behavior is detected. The solution must also provide the ability to investigate and remediate after the fact. Which Microsoft Entra feature should you use in conjunction with Defender for Cloud Apps to meet these requirements?

Accepted Answer

Microsoft Entra Conditional Access session controls with Defender for Cloud Apps integration. Microsoft Entra Conditional Access session controls integrate directly with Defender for Cloud Apps to enable real-time session monitoring and blocking. When anomalous behaviors like impossible travel or mass downloads are detected by Defender for Cloud Apps, the session control can automatically block the user session, while also providing full investigation and remediation capabilities through the Defender for Cloud Apps portal. This meets the CISO's requirement for both automated blocking and post-incident analysis.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra access reviews

Question 19

A company uses Microsoft Purview to map their data estate. They need to classify data stored in Azure SQL Database and Amazon S3. What should they use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct choice because it provides automated data discovery, classification, and lineage across hybrid and multi-cloud environments, including Azure SQL Database and Amazon S3. It uses built-in scanners and classifiers to scan structured and unstructured data sources, mapping sensitive data types such as PII or financial information. This directly fulfills the requirement to classify data across both Azure and AWS platforms.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 20

Your organization uses Microsoft Purview to manage data classification. You need to ensure that sensitive data containing social security numbers is automatically labeled when stored in SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy for sensitivity labels. D is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to files containing sensitive data, such as social security numbers, when stored in SharePoint Online. This uses pattern-based detection to classify and label content at rest without manual intervention.

Answer

Use the data classification dashboard in Microsoft Purview

Answer

Create a retention label policy

Answer

Configure a data loss prevention (DLP) policy