SC-900 Practice Exam 60 — 20 Questions

Question 1

A security analyst is explaining the concept of 'Least Privilege' to a new team member. Which statement best describes the principle of least privilege?

Accepted Answer

Users should have only the permissions necessary to perform their job functions.. The principle of least privilege dictates that users should be granted only the minimum permissions necessary to complete their job functions. This reduces the attack surface and limits potential damage from accidental or malicious actions. In Microsoft 365, this is implemented through Role-Based Access Control (RBAC) and Azure AD roles, where permissions are scoped to specific administrative units or tasks.

Answer

Users should have all permissions disabled by default.

Answer

Users should be given administrator rights to ensure they can perform any task.

Answer

Users should share one account with elevated privileges for their team.

Question 2

Your company is subject to GDPR and must be able to respond to data subject requests (DSRs) by finding all personal data of a specific user across Microsoft 365. Which Microsoft Purview solution should you use?

Accepted Answer

eDiscovery (Standard or Premium). eDiscovery (Standard or Premium) is the correct solution because it is specifically designed to search for and export content across Microsoft 365 workloads (Exchange, SharePoint, OneDrive, Teams) to fulfill data subject requests (DSRs) under GDPR. It allows you to create a case, define a search query for a specific user's personal data, and export the results for review and action, directly supporting the right to access and erasure.

Answer

Communication Compliance

Answer

Privileged Access Management

Answer

Audit (Standard or Premium)

Question 3

Which TWO of the following are capabilities of Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Cloud Workload Protection (CWP). Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) to continuously assess your cloud resources against security baselines and regulatory standards, and Cloud Workload Protection (CWP) to deliver integrated threat detection and advanced defenses for workloads across Azure, on-premises, and other clouds. These two capabilities are core pillars of Defender for Cloud, enabling both proactive posture improvement and runtime workload protection.

Answer

Email security

Answer

Identity protection

Answer

Endpoint detection and response (EDR)

Question 4

Your company uses Microsoft Entra ID and wants to implement a passwordless authentication strategy for all users. You have a mix of Windows 10 devices, iOS devices, and Android devices. You need a solution that works across all platforms and does not require users to remember passwords. What should you implement?

Accepted Answer

Deploy Microsoft Authenticator with phone sign-in enabled for all users.. Microsoft Authenticator with phone sign-in enabled provides a cross-platform passwordless authentication solution that works on Windows 10, iOS, and Android devices. It uses a key-based authentication model where the user's phone generates a cryptographic key pair, eliminating the need for passwords while supporting all required device types.

Answer

Deploy FIDO2 security keys to all users and register them in Microsoft Entra ID.

Answer

Implement certificate-based authentication using smart cards.

Answer

Enable Windows Hello for Business on all Windows devices.

Question 5

You are configuring Microsoft Entra ID for a new user. The user will need to access resources in multiple Microsoft cloud services (Office 365, Azure, Dynamics 365). Which Microsoft Entra edition is minimally required to provide single sign-on (SSO) across these services?

Accepted Answer

Microsoft Entra ID Free (included with Office 365). Microsoft Entra ID Free, included with Office 365, provides SSO across Microsoft cloud services such as Office 365, Azure, and Dynamics 365. Since the question asks for the minimally required edition and Free supports SSO in this scenario, option A is correct. No premium edition like P1 or P2 is required.

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID Free (Azure only)

Answer

Microsoft Entra ID P1

Question 6

A security administrator is explaining the Zero Trust model to a new colleague. The administrator states that trust should never be granted based solely on network location, and every access request must be fully authenticated and authorized using all available signals. Which Zero Trust principle does this statement describe?

Accepted Answer

Verify explicitly. The statement that trust should never be granted based solely on network location and that every access request must be fully authenticated and authorized using all available signals directly describes the 'Verify explicitly' principle of the Zero Trust model. This principle mandates that authentication and authorization are performed for every access attempt, regardless of the source (e.g., internal network, VPN, cloud), using all available data points such as user identity, device health, and location.

Answer

Assume breach

Answer

Use least privilege

Answer

Segment access

Question 7

A company uses Microsoft 365 and wants to automatically apply a 3-year retention label to any document that contains a patent number in the format PAT-XXXXXX. The label should be applied at the time the document is created or modified. Which Microsoft Purview solution should the administrator configure?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Retention) allows administrators to create auto-apply retention labels based on sensitive information types, such as a custom regex for patent numbers. When configured with a 'created or modified' condition, the label is automatically applied at the time the document is saved or edited, ensuring compliance with the 3-year retention requirement.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit (Premium)

Question 8

Refer to the exhibit. The JSON shows a conditional access policy. What is the effect of this policy?

Accepted Answer

Requires MFA for Office 365 from trusted locations.. The policy assigns the 'Require multifactor authentication' grant to Office 365 cloud apps, and the condition restricts it to 'trusted locations' (typically corporate networks or compliant IP ranges). This means users accessing Office 365 from those trusted locations must complete MFA, while access from untrusted locations is not affected by this policy (it may be handled by other policies). Option A correctly describes this effect.

Answer

Applies only to external guest users.

Answer

Blocks all access to Office 365 from trusted locations.

Answer

Requires a compliant device for Office 365.

Question 9

Arrange the steps to configure Azure AD Privileged Identity Management (PIM) for a role in the correct order.

Accepted Answer

Access Azure AD Privileged Identity Management, then select the role to manage, then configure role settings, then add eligible assignments, then manage approvals.. PIM setup involves first accessing PIM, then selecting a role, configuring settings, assigning eligible users, and managing approvals.

Answer

Add eligible assignments, then configure role settings, then select the role, then access Azure AD PIM, then manage approvals.

Answer

Access Azure AD PIM, then configure role settings, then select the role, then add eligible assignments, then manage approvals.

Answer

Access Azure AD PIM, then select the role, then add eligible assignments, then configure role settings, then manage approvals.

Question 10

An organization uses Microsoft 365 Defender. The security team receives an alert about a potential malware outbreak on multiple endpoints, and they need an integrated view that correlates signals from various Microsoft security solutions. Which Microsoft 365 Defender portal component provides this unified view?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com). The Microsoft 365 Defender portal (security.microsoft.com) is the correct answer because it provides a unified view of alerts and incidents across Microsoft 365 Defender components, including Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This integrated correlation enables security teams to see the full scope of a potential malware outbreak across multiple endpoints by combining signals from these solutions into a single incident timeline.

Answer

Microsoft Defender for Cloud

Answer

Azure Sentinel

Answer

Microsoft Defender for Identity

Question 11

Your organization wants to prevent users from installing unapproved apps on company-managed Windows devices. Which Microsoft Intune feature should you use?

Accepted Answer

App control policies. App control policies in Microsoft Intune allow administrators to create and enforce rules that control which applications users can run on managed Windows devices. By configuring a baseline policy (e.g., using Windows Defender Application Control), you can block unapproved apps while allowing only trusted or explicitly permitted software, directly preventing users from installing unauthorized applications.

Answer

Device configuration profiles

Answer

Conditional Access

Answer

Device compliance policies

Question 12

Match each Microsoft identity service to its description.

Accepted Answer

Azure AD: Cloud-based identity and access management service. Microsoft identity services include Azure AD (cloud IAM), Azure AD DS (managed domain services), and Azure AD B2C (customer IAM). Common confusions involve swapping descriptions of Azure AD with on-premises AD and Azure AD DS with Azure AD B2B.

Answer

Azure AD B2B: Managed domain services such as domain join and LDAP

Answer

Active Directory (on-premises): Cloud-based identity and access management

Answer

Azure AD: On-premises directory service for Windows networks

Question 13

Which TWO Microsoft Purview solutions can be used to automatically classify sensitive data at rest?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (DLM) automatically classifies sensitive data at rest by applying retention labels based on sensitive content detection, such as credit card numbers or social security numbers, using trainable classifiers or exact data match. Information Protection (IP) extends this by enabling automatic labeling of documents and emails based on sensitive information types, ensuring data is classified and protected while stored in SharePoint, OneDrive, or Exchange Online.

Answer

Communication Compliance

Answer

eDiscovery

Answer

Auditing

Question 14

Your organization is using Microsoft Entra ID with P2 licenses. You need to enforce a policy that requires administrators to request approval before activating their privileged roles, and approvals must expire after 8 hours. Additionally, you need to ensure that all privileged role activations are logged for auditing. Which combination of Microsoft Entra capabilities should you use?

Accepted Answer

Configure Privileged Identity Management (PIM) for role activation with approval and expiration, and use PIM audit logs.. Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time role activation with configurable approval workflows and expiration durations, meeting the requirement for administrators to request approval and for approvals to expire after 8 hours. PIM audit logs capture all activation events, including who approved, when, and for which role, fulfilling the auditing requirement. This combination directly addresses the policy needs without relying on unrelated capabilities like user risk policies or access reviews.

Answer

Implement Identity Protection user risk policy to block high-risk admins, and use sign-in logs.

Answer

Create a Conditional Access policy requiring multi-factor authentication for admins, and use activity logs.

Answer

Set up Azure AD Access Reviews to require monthly review of privileged roles, and enable diagnostic settings.

Question 15

Which TWO features are part of Microsoft Entra ID P2 licensing? (Choose two.)

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra ID P2 licensing includes advanced security features such as Microsoft Entra Identity Protection and Microsoft Entra Privileged Identity Management (PIM). Identity Protection uses machine learning to detect and remediate identity-based risks like leaked credentials and anomalous sign-in patterns, while PIM provides just-in-time privileged access and approval workflows. These capabilities are exclusive to P2 and are not available in P1 or free tiers.

Answer

Conditional Access

Answer

Basic Mobility and Security

Answer

Microsoft Entra Self-Service Password Reset

Question 16

A company runs a mix of on-premises servers and Azure virtual machines. They deploy Microsoft Defender for Endpoint on all servers. The security team wants to create custom queries to hunt for a specific attack pattern that involves a sequence of events across multiple machines, such as a PowerShell script being downloaded and then executed on several servers. They need to write their own detection rules based on advanced hunting data. Which Microsoft 365 Defender capability should they use?

Accepted Answer

Advanced hunting in Microsoft 365 Defender. Advanced hunting in Microsoft 365 Defender provides a Kusto Query Language (KQL)-based query interface that allows security teams to create custom detection rules by searching raw data across endpoints, email, and identities. This capability directly supports the scenario of writing custom queries to hunt for multi-machine attack patterns, such as a PowerShell script download followed by execution, by correlating events like DeviceProcessEvents and DeviceFileEvents across multiple devices.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 17

Order the steps to deploy Microsoft Intune for mobile device management.

Accepted Answer

1. Set up Intune (configuration of MDM authority, licenses, and basic settings), 2. Create enrollment policies, 3. Create compliance policies, 4. Assign apps, 5. Enroll devices.. Intune deployment includes setup, enrollment policies, compliance policies, app assignment, and enrollment.

Answer

1. Enroll devices, 2. Set up Intune, 3. Create compliance policies, 4. Create enrollment policies, 5. Assign apps.

Answer

1. Set up Intune, 2. Create compliance policies, 3. Create enrollment policies, 4. Assign apps, 5. Enroll devices.

Answer

1. Enroll devices, 2. Assign apps, 3. Create compliance policies, 4. Create enrollment policies, 5. Set up Intune.

Question 18

Match each identity term to its correct meaning.

Accepted Answer

Identity: An entity that can be authenticated (e.g., user, device, service).. Identity is the entity (user, device, service) being authenticated. Authentication verifies who you are (e.g., passwords, MFA). Authorization determines what you can access (e.g., permissions). Directory stores identity information (e.g., Azure AD). Common confusion: mixing authentication and authorization definitions.

Answer

Identity: The process of verifying credentials.

Answer

Authentication: The process of granting access rights.

Question 19

Your organization uses Microsoft Purview eDiscovery to manage legal holds. A legal hold has been placed on a user’s mailbox, but the user has left the company and their mailbox has been converted to a shared mailbox. You need to ensure that the legal hold remains effective. What should you do?

Accepted Answer

Verify that the legal hold is still listed in the eDiscovery case for the mailbox.. When a mailbox is converted to a shared mailbox, the legal hold applied via eDiscovery remains in effect and does not need to be recreated. It is important to verify that the hold is still listed in the eDiscovery case. Option A is incorrect because converting back is unnecessary and may lose shared mailbox features. Option B is incorrect because the hold is still active; creating a new hold is redundant. Option D is incorrect because removing and reapplying the hold is not required.

Answer

Convert the shared mailbox back to a user mailbox to keep the hold.

Answer

Create a new legal hold for the shared mailbox.

Answer

Remove the legal hold and reapply it to the shared mailbox.

Question 20

You are a security administrator for Contoso Ltd., which uses Microsoft 365 E5. The company has 10,000 users and uses Microsoft Entra ID for identity. The security team has noticed an increase in sign-in attempts from anonymous IP addresses and from locations outside the company's home country. They want to implement a solution that automatically blocks sign-ins from anonymous IP addresses and requires MFA for sign-ins from outside the home country. They also want to ensure that if a user's risk level is high, they are forced to change their password. The solution must use Microsoft Entra ID Protection and Conditional Access. You have already configured a Conditional Access policy to require MFA for all users. Which of the following is the most efficient way to meet all requirements with minimal administrative overhead?

Accepted Answer

Configure Identity Protection sign-in risk policy to block anonymous IP addresses, user risk policy to require password change for high-risk users, and create a Conditional Access policy to require MFA for sign-ins from outside the home country.. A is correct. Identity Protection sign-in risk policies can detect and block sign-ins from anonymous IP addresses. User risk policies can require a password change for high-risk users. Conditional Access policies can enforce MFA based on location (e.g., outside home country). Option B is incorrect because a single Conditional Access policy cannot directly detect anonymous IP addresses (this is only available through Identity Protection). Option C is incorrect because it blocks sign-ins from outside the home country instead of requiring MFA. Option D is incorrect because it uses Conditional Access to require MFA for all users, which is already done by the existing policy, and it does not specifically enforce MFA for outside home country; also, requiring MFA for all users adds unnecessary friction. The most efficient method to meet all requirements with minimal administrative overhead is to combine Identity Protection risk policies for anonymous IP and high risk, and create a separate Conditional Access policy for location-based MFA, as in option A.

Answer

Create a single Conditional Access policy that blocks anonymous IP addresses, requires MFA based on location, and forces password change for high-risk users.

Answer

Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to block sign-ins from outside the home country.

Answer

Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to require MFA for all users.