SC-900 Practice Test 6 — 10 Questions

Question 1

A company uses Microsoft Entra ID and has multiple departments with separate organizational units (OUs) in its on-premises Active Directory. The help desk team needs to be able to reset passwords for users only in the Finance department. What feature should be used to delegate this administrative scope?

Accepted Answer

Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions over a subset of users, groups, or devices without granting broader tenant-wide access. By creating an AU for the Finance department and assigning the Helpdesk Administrator role scoped to that AU, the help desk team can reset passwords only for Finance users, matching the on-premises OU structure.

Answer

Dynamic groups

Answer

Conditional Access policies

Answer

Privileged Identity Management (PIM)

Question 2

A company uses Microsoft 365 and wants to automatically apply a 3-year retention label to any document that contains a patent number in the format PAT-XXXXXX. The label should be applied at the time the document is created or modified. Which Microsoft Purview solution should the administrator configure?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Option A is correct because Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Retention) allows administrators to create auto-apply retention labels based on sensitive information types, such as a custom regex for patent numbers. When configured with a 'created or modified' condition, the label is automatically applied at the time the document is saved or edited, ensuring compliance with the 3-year retention requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit (Premium)

Question 3

A financial services company must comply with a regulation that requires all audit-related documents to be retained for 7 years and then permanently deleted. The compliance officer wants to ensure that even if a user modifies or deletes a file, the original content is preserved for the full 7 years, and at the end of the period the files are automatically destroyed without any manual approval. The company uses Microsoft 365 and stores these documents in SharePoint Online and Microsoft Teams. Which Microsoft Purview solution should the compliance officer configure?

Accepted Answer

Microsoft Purview Data Lifecycle Management using a retention policy configured to retain items for 7 years and then delete them automatically. Option C is correct because Microsoft Purview Data Lifecycle Management allows you to create a retention policy that retains items for a fixed period (7 years) and then automatically deletes them without any manual intervention. This meets the regulatory requirement for automatic destruction at the end of the retention period, and the policy applies to both SharePoint Online and Microsoft Teams, preserving the original content even if a user modifies or deletes the file.

Answer

Microsoft Purview Retention Labels with a disposition review that requires manual approval at the end of the retention period

Answer

Microsoft Purview Retention Policy with a record label to mark items as regulatory records

Answer

Microsoft Purview eDiscovery with a hold policy to preserve the documents indefinitely

Question 4

A financial organization implements a security control that logs every access attempt to sensitive financial records, including who accessed the data, when it was accessed, and from which device. The logs are regularly reviewed by the security team. This control primarily addresses which security concept?

Accepted Answer

Accountability. Accountability ensures that actions affecting sensitive data can be traced uniquely to an individual. By logging who accessed the data, when, and from which device, the organization creates an audit trail that holds users responsible for their actions. This directly supports non-repudiation and forensic analysis, which are the core goals of accountability.

Answer

Confidentiality

Answer

Integrity

Answer

Availability

Question 5

A company manages Azure virtual machines and on-premises servers. The security team needs a single dashboard that provides a secure score and actionable recommendations to improve the security posture across both environments. Which Microsoft solution should be used?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a unified dashboard that displays a secure score and actionable recommendations for Azure virtual machines, on-premises servers, and other cloud workloads. It integrates with Azure Arc to extend security monitoring to on-premises resources, enabling a single view of security posture across hybrid environments.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 6

A company uses Microsoft 365 E5. An employee's corporate laptop is infected with keylogging malware that captures the employee's credentials. The attacker uses these credentials to sign in to Exchange Online and forward sensitive emails to an external account. Under the shared responsibility model, who is primarily responsible for the security incident?

Accepted Answer

The customer is responsible because they control user devices, accounts, and access policies.. Under the shared responsibility model, the customer is responsible for securing user devices, managing user accounts, and configuring access policies. In this scenario, the keylogging malware on the employee's corporate laptop is a customer-side endpoint security issue, and the attacker used stolen credentials to access Exchange Online. Microsoft is responsible for the security of the cloud infrastructure (e.g., physical data centers, network, and hypervisor), but not for threats originating from compromised customer-managed devices or user accounts.

Answer

Microsoft is responsible because they provide the cloud service and must protect against all threats.

Answer

Both Microsoft and the customer share equal responsibility for all layers of the service.

Answer

Neither party is responsible because the employee bypassed security controls.

Question 7

A company uses a third-party SaaS CRM application. The security team needs to monitor user sessions in real-time when sales representatives access the CRM from personal, unmanaged devices. The goal is to prevent the download of sensitive customer data to local drives. The solution should block download actions and show a warning to the user. Which Microsoft security solution should the team deploy to enforce these session controls?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) provides session-level controls via its Conditional Access App Control feature. This allows real-time monitoring and control of user sessions in third-party SaaS apps like CRM, enabling actions such as blocking downloads and displaying warnings based on device compliance (e.g., unmanaged devices). The solution integrates with Azure AD Conditional Access to enforce these policies at the session layer without modifying the underlying SaaS application.

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 8

Match each Microsoft identity service to its description.

Question 9

Match each Microsoft 365 compliance feature to its function.

Question 10

Match each compliance framework to its primary focus.