SC-900 Practice Exam 60 — 20 Questions

Question 1

A financial services company uses Microsoft 365 and must prevent employees from emailing credit card numbers in plain text. The compliance team wants to automatically detect credit card numbers in outgoing emails and block them before delivery. They also want to allow users to override the block with a business justification. Which Microsoft Purview solution should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data, such as credit card numbers, in transit (e.g., email) and enforce actions like blocking the message. DLP policies can be configured with user override options that require a business justification, meeting the compliance team's requirement for automatic detection and conditional blocking.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Insider Risk Management

Question 2

A compliance officer wants a central dashboard to assess the organization's compliance posture against regulatory standards such as GDPR and ISO 27001. They need actionable recommendations to improve their compliance score and track progress over time. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a central dashboard that assesses an organization's compliance posture against regulatory standards like GDPR and ISO 27001, offers actionable recommendations to improve the compliance score, and tracks progress over time through continuous assessments and improvement actions.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit

Question 3

A global enterprise has a hybrid environment that includes on-premises Active Directory, Azure resources, Amazon Web Services (AWS), and Google Cloud Platform (GCP). The security team needs a single solution to collect security logs from all these sources, detect threats using advanced analytics and threat intelligence, and automate incident response via playbooks. They already have Microsoft Defender for Cloud protecting their Azure workloads. Which Microsoft security solution should they add to meet these requirements?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR solution, designed to ingest security logs from multi-cloud and on-premises sources (including AWS, GCP, and on-prem AD), apply advanced analytics and threat intelligence, and automate response with playbooks. Since the requirement is a single solution for collection, detection, and automated response across hybrid/multi-cloud, Sentinel is the correct addition.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity

Answer

Microsoft Cloud App Security

Question 4

A compliance administrator creates the DLP policy shown in the exhibit. When a user shares a document containing a credit card number with an external partner, what is the expected outcome?

Accepted Answer

The document is blocked from being shared externally, and the user receives a notification.. The DLP policy is configured with an action to block external sharing and notify the user when a credit card number is detected. When the user shares the document externally, the policy triggers this action, preventing the share and sending a notification to the user. This matches option A exactly.

Answer

The document is automatically deleted.

Answer

A sensitivity label is automatically applied.

Answer

The document is blocked from being shared both internally and externally.

Question 5

Which TWO features are included in Microsoft Entra ID Identity Protection? (Choose two.)

Accepted Answer

Sign-in risk detection. Microsoft Entra ID Identity Protection is built around two risk signal types: sign-in risk detection (Option B) and user risk detection (Option E). Sign-in risk detection evaluates each authentication attempt in real time using signals such as anonymous IP address, atypical travel, malware-linked IP address, and unfamiliar sign-in properties, and it can trigger Conditional Access policies requiring MFA or blocking access. User risk detection identifies accounts whose credentials are likely compromised, for example through leaked credentials found on the dark web or by detecting anomalous user activity, and it drives remediation such as forced password reset. Option A (just-in-time privileged access) belongs to Microsoft Entra Privileged Identity Management, not Identity Protection. Option C (Cloud app discovery) is a Microsoft Defender for Cloud Apps capability used to discover and assess shadow IT SaaS usage. Option D (multi-factor authentication registration campaign) is an authentication methods policy setting in Microsoft Entra ID that nudges users to register for MFA; it is not one of the risk detections provided by Identity Protection.

Answer

Just-in-time privileged access

Answer

Cloud app discovery

Answer

Multi-factor authentication registration campaign

Question 6

A user reports that they cannot sign in to Microsoft Entra ID because they forgot their password. Which Microsoft Entra ID feature allows them to reset their password without contacting IT support?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own forgotten passwords without needing to contact IT support. It works by verifying the user's identity through pre-configured authentication methods (e.g., phone, email, security questions) before permitting the password change. This directly addresses the user's inability to sign in due to a forgotten password.

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra ID Domain Services

Question 7

Your company uses Microsoft Defender for Cloud to assess security posture. A recommendation states that virtual machines should have just-in-time (JIT) network access enabled. What is the primary security benefit of enabling JIT?

Accepted Answer

It reduces the attack surface by opening ports only when necessary. JIT VM access in Microsoft Defender for Cloud works by keeping management ports (RDP 3389, SSH 22) closed by default and only opening them on demand when an authorized user requests access, for a limited time and from a specific source IP. This dramatically reduces the attack surface exposed to internet-based brute-force and scanning attacks, since the ports are not persistently listening. Once the approved time window expires, Defender for Cloud automatically closes the port via NSG rules.

Answer

It replaces the need for network security groups

Answer

It encrypts all network traffic between the VM and clients

Answer

It permanently blocks all inbound traffic to the VM

Question 8

A security team wants to receive a unified security posture assessment for their hybrid workloads including Azure VMs, on-premises SQL servers, and AWS EC2 instances. They need to get actionable recommendations to harden configurations and improve their overall security score. Which Microsoft security solution provides this capability?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a unified security posture assessment across hybrid and multi-cloud workloads, including Azure VMs, on-premises SQL servers, and AWS EC2 instances. It continuously assesses configurations against security baselines (e.g., Azure Security Benchmark, CIS controls) and generates a secure score with actionable recommendations to harden resources. This aligns directly with the requirement for a single dashboard covering all listed workload types.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 9

A company uses Microsoft Entra ID (Microsoft Entra ID) and wants to configure self-service password reset (SSPR) for all users. The security team requires that users must verify their identity with at least two methods before resetting a password. Which SSPR setting should be configured?

Accepted Answer

Number of methods required to reset: 2. The 'Number of methods required to reset' setting in Microsoft Entra ID SSPR controls how many authentication methods a user must successfully verify before being allowed to reset their password. Setting it to 2 enforces the security team's requirement that users verify identity with at least two methods. This is configured under Authentication methods in the Entra ID password reset blade.

Answer

Require re-registration on every authentication

Answer

Enable combined registration for SSPR and MFA

Answer

Set password expiration to 0 days

Question 10

A security analyst needs to detect and investigate compromised identities in on-premises Active Directory. They want to monitor for lateral movement, reconnaissance, and credential theft using behavioral analytics. Which Microsoft security solution is designed specifically for this purpose?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats like lateral movement, reconnaissance, and credential theft. It uses behavioral analytics and machine learning to profile user and entity behavior, alerting on suspicious activities such as Pass-the-Hash, DCSync, and Kerberoasting without requiring agents on domain controllers.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 11

A security team needs to detect and investigate advanced attacks targeting on-premises Active Directory accounts, such as Pass-the-Hash (PtH) and Golden Ticket attacks. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is specifically designed to detect advanced attacks targeting on-premises Active Directory, such as Pass-the-Hash (PtH) and Golden Ticket attacks. It uses behavioral analytics and machine learning to monitor AD traffic, Kerberos authentication, and NTLM protocol anomalies, identifying lateral movement and privilege escalation attempts that characterize these attacks.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Question 12

Refer to the exhibit. An administrator created a retention label with the settings shown. What is the behavior of this label when applied to content?

Accepted Answer

It retains content for 7 years and then automatically deletes it.. The retention label is configured with a retention period of 7 years and an action of 'Delete items automatically when the retention period ends.' Since no disposition review is enabled, the content will be automatically deleted after 7 years. This matches option C exactly.

Answer

It retains content for 5 years and then applies a disposition review.

Answer

It marks content as a regulatory record and prevents deletion.

Answer

It retains content indefinitely with no deletion.

Question 13

A company wants to enforce conditional access policies that require multifactor authentication (MFA) for all users accessing financial apps from outside the corporate network. Which Microsoft Entra ID license is minimally required to create conditional access policies?

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 (formerly Azure AD Premium P1) is the minimum license required to create and enforce conditional access policies. Conditional access is a premium feature that is not available in Free or Microsoft 365 Business Basic tiers, and while P2 includes additional capabilities like Identity Protection, it is not necessary for basic MFA enforcement based on location.

Answer

Microsoft 365 Business Basic

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID Free

Question 14

A company uses Microsoft Entra ID. They want to enforce that users accessing the payroll application from outside the corporate network must use multifactor authentication and must access the app only from devices that are marked as compliant by Intune. Which Conditional Access component should they use to combine these requirements?

Accepted Answer

Grant controls. B is correct because Grant controls in a Conditional Access policy allow administrators to specify the access requirements that must be satisfied before a user can access a resource. In this scenario, the requirement to enforce both multifactor authentication and device compliance (from Intune) is achieved by configuring the Grant control to 'Require multifactor authentication' and 'Require device to be marked as compliant', combined with the 'Require all the selected controls' option. This ensures that both conditions must be met simultaneously for access to the payroll application from outside the corporate network.

Answer

Conditions

Answer

Sign-in risk policy

Answer

Session controls

Question 15

A security administrator is explaining authentication and authorization to new IT staff. Which statement correctly describes the difference between these two processes?

Accepted Answer

Authentication verifies who the user is; authorization verifies what the user can do.. Authentication is the process of verifying the identity of a user, device, or other entity, typically through credentials like a password, biometric, or certificate. Authorization determines what an authenticated entity is permitted to do, such as accessing specific resources or performing certain actions, often enforced via access control lists (ACLs) or role-based access control (RBAC). In Microsoft Entra ID, authentication occurs first (e.g., via OAuth 2.0 or SAML), and then authorization is evaluated using claims or directory roles.

Answer

Authentication verifies what a user can do; authorization verifies who the user is.

Answer

Both authentication and authorization verify the user's identity.

Answer

Authorization is always performed before authentication.

Question 16

Your organization is implementing Microsoft 365 and needs to prevent sensitive data from being copied to USB drives. Which Microsoft Purview solution should you configure?

Accepted Answer

Endpoint data loss prevention (Endpoint DLP). Endpoint DLP (Data Loss Prevention) monitors and controls actions users take on devices, such as copying sensitive data to USB drives. It enforces policies directly on Windows, macOS, and other endpoints to block unauthorized transfers, making it the correct solution for preventing data exfiltration via removable media.

Answer

Audit logs

Answer

Communication Compliance

Answer

Sensitivity labels

Question 17

Which of the following is a primary purpose of Microsoft Entra ID Identity Protection?

Accepted Answer

Detect and remediate identity risks. Microsoft Entra ID Identity Protection is designed to detect, investigate, and remediate identity-based risks. It uses signals like leaked credentials, atypical sign-in behavior, and risky users to generate risk detections and risk levels, which can be used in Conditional Access policies to block or require remediation.

Answer

Manage privileged roles

Answer

Classify and protect sensitive data

Answer

Manage device compliance policies

Question 18

A company stores sensitive financial data on on-premises Windows Server file shares. The compliance team needs to automatically discover files containing credit card numbers, classify them by applying a sensitivity label, and optionally enforce protection actions like encryption. They want this solution to run on the on-premises file servers without needing to manually scan. Which Microsoft Purview solution should the compliance team deploy?

Accepted Answer

Microsoft Purview Information Protection scanner. The Microsoft Purview Information Protection scanner is designed to run on on-premises Windows Server file shares to automatically discover, classify, and protect sensitive data. It uses content inspection to identify patterns like credit card numbers, applies sensitivity labels, and can enforce encryption without requiring manual scanning.

Answer

Microsoft Purview Data Loss Prevention (DLP) for on-premises

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Question 19

A multinational company uses a hybrid infrastructure with on-premises Active Directory and Azure resources. They have deployed Microsoft Defender for Cloud to protect their Azure workloads. They now want to extend threat detection to their on-premises Active Directory by collecting security events from domain controllers to detect attacks like Golden Ticket, DCSync, and malicious Kerberos activity. The solution should integrate with Microsoft Sentinel for automated response. Which security solution should they deploy on the on-premises domain controllers?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory signals, including security events from domain controllers, to detect advanced identity-based attacks such as Golden Ticket, DCSync, and malicious Kerberos activity. MDI integrates natively with Microsoft Sentinel to enable automated response workflows, fulfilling the requirement for extending threat detection to on-premises AD.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Question 20

Your organization uses Microsoft Entra ID. You need to grant external partners limited access to a SharePoint site for 30 days. After 30 days, access should automatically expire. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra entitlement management. Microsoft Entra entitlement management allows you to create access packages that grant external users time-limited access to resources like SharePoint sites. By configuring an access package with a 30-day expiration policy, access is automatically revoked when the policy expires, meeting the requirement exactly.

Answer

Microsoft Entra access reviews

Answer

Microsoft Entra B2B guest user accounts

Answer

Microsoft Entra Conditional Access