SC-900 Practice Exam 61 — 20 Questions

Question 1

Your organization, Fabrikam Inc., uses Microsoft 365 and has Microsoft Purview licensed. You need to implement a compliance solution to monitor and prevent the sharing of confidential financial data via email. Specifically, you want to: (1) Detect when users send emails containing financial account numbers (e.g., credit card numbers) to external recipients. (2) Automatically block such emails with a policy tip notifying the sender. (3) Allow the sender to override the block if they provide a business justification. (4) Create a report of all blocked emails for compliance review. Which Microsoft Purview feature should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information in emails and apply actions such as block with policy tip and allow override with justification. DLP also provides incident reports. Option A (Communication Compliance) is for communication monitoring, not data protection. Option B (Message Encryption) is for email encryption, not blocking. Option D (Data Lifecycle Management) is for retention, not real-time blocking.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Message Encryption

Answer

Microsoft Purview Data Lifecycle Management

Question 2

Your organization uses Microsoft Purview to manage compliance. You need to ensure that financial documents are automatically labeled as 'Financial' and retained for 7 years. Additionally, if a user tries to share a financial document externally, they must see a policy tip warning them and be blocked if they proceed. You also need to audit all access to financial documents. Which configuration should you implement?

Accepted Answer

Create an auto-labeling policy to apply a sensitivity label 'Financial' with encryption; create a retention policy to retain all labeled content for 7 years; create a DLP policy to block external sharing of 'Financial' labeled content with a policy tip; enable audit logging. It combines auto-labeling to automatically apply the 'Financial' sensitivity label with encryption, a retention policy to retain labeled content for 7 years, a DLP policy to block external sharing with a policy tip, and audit logging (enabled by default) to track access. Option A lacks labeling and retention. Option B uses manual labeling, which is not automatic, and the DLP only warns, not blocks. Option C uses a retention label instead of a sensitivity label, so it does not provide encryption or protection, and the DLP policy does not include a policy tip.

Answer

Create a DLP policy to detect financial data and block external sharing; use default audit logging

Answer

Create a manual labeling policy for users to apply 'Financial' label; create a retention label for 7 years; create a DLP policy to warn on external sharing

Answer

Create a retention label 'Financial' with auto-apply based on sensitive info type; create a DLP policy to block external sharing

Question 3

A company wants to monitor employee communications in Microsoft Teams and Exchange Online for potential policy violations such as harassment or inappropriate sharing of confidential information. They need a solution that allows them to define policies, review flagged messages, and manage investigations. Which Microsoft Purview solution should they use?

Accepted Answer

Communication Compliance. Communication Compliance is the correct Microsoft Purview solution because it is specifically designed to monitor communications (e.g., emails in Exchange Online and messages in Microsoft Teams) for policy violations such as harassment or inappropriate sharing of confidential information. It allows administrators to define customizable policies, automatically flag messages that match sensitive information types or offensive language, and manage investigations through a built-in review workflow.

Answer

Insider Risk Management

Answer

Information Barriers

Answer

Audit (Standard or Premium)

Question 4

A company uses Microsoft 365 and needs to protect endpoints from ransomware attacks that encrypt files. The security team wants automated investigation and response capabilities for malware incidents on Windows devices. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (D) is the correct answer because it provides endpoint detection and response (EDR) capabilities, including automated investigation and remediation for malware incidents on Windows devices. It uses behavioral sensors, cloud analytics, and threat intelligence to detect ransomware encryption behavior and automatically contain or remediate affected endpoints, aligning with the requirement for automated response.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 5

Your organization wants to use Microsoft Defender for Cloud to secure Azure virtual machines. Which feature should they enable to get vulnerability assessment without additional agents?

Accepted Answer

Vulnerability assessment. Microsoft Defender for Cloud includes a built-in vulnerability assessment solution for Azure virtual machines that does not require any additional agents. When enabled, it uses the Qualys scanner integrated directly into the platform to continuously scan for vulnerabilities, providing findings without the need to deploy or manage separate agents on the VMs.

Answer

File integrity monitoring

Answer

Just-in-time VM access

Answer

Adaptive application controls

Question 6

A financial services company uses Microsoft Purview and must comply with a regulation that requires communication surveillance for market abuse. They need to capture all electronic communications (email, Teams chats) of traders and scan for specific keywords and trading patterns. Which Microsoft Purview solution is specifically designed for this?

Accepted Answer

Communication Compliance. Communication Compliance is the Microsoft Purview solution specifically designed to capture and analyze electronic communications (email, Teams chats) for regulatory compliance, such as detecting market abuse. It allows organizations to define policies that scan for specific keywords and trading patterns, automatically flagging messages that violate compliance rules. This directly addresses the requirement for communication surveillance in financial services under regulations like MiFID II or Dodd-Frank.

Answer

Data Lifecycle Management

Answer

eDiscovery (Standard)

Answer

Insider Risk Management

Question 7

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to identify resources that are missing system updates. Which feature should they use?

Accepted Answer

Secure Score recommendations. Secure Score recommendations in Microsoft Defender for Cloud include a specific recommendation for 'System updates should be installed on your machines' (or similar naming). This recommendation identifies Azure resources, particularly VMs, that are missing critical or security system updates by integrating with the Update Management solution or Microsoft Defender for Cloud's built-in vulnerability assessment. Selecting this recommendation allows the security team to view and remediate missing updates, directly addressing the requirement to assess security posture regarding system updates.

Answer

Just-in-time VM access

Answer

Vulnerability assessment solutions

Answer

Adaptive application controls

Question 8

A company uses Microsoft Entra ID. The security team wants to grant temporary, time-limited administrative access to Azure subscriptions only when needed, with an approval workflow. Which Microsoft Entra capability should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure AD and Azure resources, including Azure subscriptions. PIM supports time-bound role activation with an approval workflow, allowing the security team to grant temporary administrative access only when needed, which directly matches the requirement.

Answer

Conditional Access

Answer

Identity Protection

Answer

Entra ID Governance

Question 9

A healthcare organization stores sensitive patient records in a cloud database. The database is encrypted at rest using AES-256. If an attacker gains access to the physical storage media, they cannot read the data. Which security concept does this encryption primarily provide?

Accepted Answer

Confidentiality. Encryption at rest using AES-256 ensures that data stored on physical media is unreadable without the decryption key. If an attacker gains physical access to the storage media, the ciphertext cannot be deciphered, directly protecting the secrecy of the data. This aligns with the security goal of confidentiality, which prevents unauthorized disclosure of information.

Answer

Integrity

Answer

Availability

Answer

Authorization

Question 10

Your organization, Contoso, uses Microsoft Entra ID for identity management. The security team has recently identified that several users have had their credentials compromised. You need to implement a solution that automatically enforces a password change for high-risk users and blocks sign-ins from risky locations. Additionally, you want to allow users to self-remediate by changing their password when they are at medium risk. You have the following requirements:
- Users detected as high risk must be blocked from signing in until an administrator resets their password.
- Users detected as medium risk must be prompted to change their password via self-service password reset before they can access resources.
- All risk detections must be logged and reported to the security team.
- The solution must use built-in Microsoft Entra capabilities without third-party tools.

Which of the following actions should you take to meet the requirements?

Accepted Answer

Configure Microsoft Entra ID Protection user risk policies: set a policy to block access for high user risk and a policy to require password change for medium user risk. Enable risk reporting.. Microsoft Entra ID Protection provides built-in user risk policies that automatically block sign-ins for high-risk users and require a password change for medium-risk users, meeting the requirements for automated enforcement and self-remediation. Additionally, ID Protection includes risk reporting capabilities that log all risk detections for the security team, all without third-party tools.

Answer

Create conditional access policies that block sign-ins based on location and require MFA for all users.

Answer

Administratively assign users to administrative units and require administrators to review risk manually.

Answer

Use Microsoft Entra ID Governance to create an access package and require approval for access.

Question 11

A company uses Microsoft Purview to manage data lifecycle. They configure a retention label that marks content as a regulatory record and apply it to sensitive documents. A user with edit permissions attempts to modify a document that has this label applied. What will be the outcome?

Accepted Answer

The user cannot edit or delete the document.. When a retention label is configured as a regulatory record, it enforces the strictest retention and disposition controls. Regulatory records are immutable by design; once applied, no user—regardless of permissions—can edit or delete the content. This is because the label locks the document to prevent any modification or deletion until the retention period expires and a disposition review is completed.

Answer

The user can edit the document but cannot delete it.

Answer

The user can edit the document if they have edit permissions, and any changes are recorded in the audit log.

Answer

The user can edit the document only after obtaining a legal hold.

Question 12

Refer to the exhibit. You are evaluating a Microsoft Purview retention policy. The policy is applied to Exchange Online, SharePoint Online, and OneDrive for Business. What is the behavior of this policy?

Accepted Answer

Items are automatically deleted 365 days after creation. The retention policy shown in the exhibit specifies 'Delete items automatically after 365 days from creation date.' This means that once an item reaches 365 days from its creation date (not last modification), it will be permanently deleted from Exchange Online, SharePoint Online, and OneDrive for Business. The policy does not include a retention period to preserve items; it only deletes them after the specified age.

Answer

Items are retained indefinitely and cannot be deleted

Answer

Items are deleted 365 days after last modification

Answer

Items are preserved with a lock and cannot be deleted by users

Question 13

A healthcare organization must comply with HIPAA regulations. They need to classify and protect medical records stored in Microsoft 365. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (D) is the correct solution because it enables organizations to classify, label, and protect sensitive data—such as medical records—using sensitivity labels and encryption. This directly supports HIPAA compliance by ensuring that protected health information (PHI) is consistently safeguarded across Microsoft 365 services, including Exchange, SharePoint, and OneDrive.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Priva

Answer

Microsoft Purview Data Lifecycle Management

Question 14

A SOC analyst in Microsoft Sentinel needs to create a custom detection rule that triggers an incident when more than 10 failed logins occur from a single IP address within 5 minutes. Which rule type should they use?

Accepted Answer

Scheduled query analytics rule. A scheduled query analytics rule is the correct choice because it allows the SOC analyst to define a custom KQL query that counts failed logins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type runs on a recurring schedule (e.g., every 5 minutes) and is designed for threshold-based detection scenarios like brute-force attacks.

Answer

Anomaly analytics rule

Answer

Near-real-time (NRT) analytics rule

Answer

Microsoft security analytics rule

Question 15

You are investigating an alert in Microsoft Defender XDR. Based on the exhibit, what is the primary detection source for this alert?

Accepted Answer

Microsoft Defender for Identity. The exhibit shows an alert from Microsoft Defender XDR with a detection source of 'Microsoft Defender for Identity'. Defender for Identity uses on-premises Active Directory signals and network traffic to detect identity-based threats like lateral movement, privilege escalation, and compromised credentials. The alert details indicate suspicious activity tied to an on-premises domain controller, which is the core focus of Defender for Identity.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 16

A company uses Microsoft Entra ID and a third-party SaaS application. They want to prevent users from downloading sensitive documents from the SaaS app when accessing from unmanaged personal devices, while still allowing read-only access. Which Conditional Access control should they apply to achieve this?

Accepted Answer

Use app control with Microsoft Defender for Cloud Apps session policy. Microsoft Defender for Cloud Apps (MDCA) session policies enable granular control over user actions within a SaaS app, such as blocking downloads while allowing read-only access. This is achieved through reverse proxy architecture that intercepts and enforces policies on HTTP/HTTPS traffic in real time, regardless of device compliance or identity provider status. Conditional Access with MDCA session control is the only option that provides app-level data protection without requiring device management or blocking access entirely.

Answer

Require multifactor authentication (MFA)

Answer

Require compliant device (Intune compliance policy)

Answer

Block access

Question 17

Your company uses Microsoft Defender XDR. You need to integrate threat intelligence from external sources to enrich alerts and automate response actions. Which feature should you use?

Accepted Answer

Threat intelligence integration. Microsoft Defender XDR's threat intelligence integration (option D) allows you to import custom threat indicators (IOCs) from external sources—such as STIX/TAXII feeds, APIs, or manual uploads—into the Microsoft 365 Defender platform. These indicators are then used to enrich alerts, trigger automated response actions via custom detection rules, and correlate with telemetry across endpoints, email, and identities. This directly meets the requirement to integrate external threat intelligence for enrichment and automation.

Answer

Automation rules

Answer

Threat analytics

Answer

Advanced hunting

Question 18

A company deploys a virtual machine on Azure IaaS. According to the Microsoft shared responsibility model, which of the following security responsibilities is primarily the customer's responsibility?

Accepted Answer

Patching the guest operating system and applications. In the Microsoft shared responsibility model, the customer is responsible for securing and patching the guest operating system and applications running on an Azure IaaS virtual machine. Microsoft manages the physical infrastructure, hypervisor, and network, while the customer controls the OS, applications, and data.

Answer

Physical security of the data centers

Answer

Ensuring the hypervisor is secured

Answer

Maintaining the network infrastructure

Question 19

A security architect is designing a defense strategy for the organization's network. The architect assumes that an attacker may already have breached the perimeter and is operating inside the network. Therefore, the design does not automatically trust any user or device, even if they are inside the corporate network, and requires continuous verification for every access request. Which security principle does this approach best represent?

Accepted Answer

Zero Trust. The Zero Trust security principle is based on the assumption that an attacker may already be inside the network, so no user or device is automatically trusted, regardless of location. This model requires continuous verification for every access request, enforcing strict identity verification and least-privilege access controls at each step. The scenario directly describes the core tenet of Zero Trust: 'never trust, always verify.'

Answer

Defense in depth

Answer

Shared responsibility

Answer

Least privilege

Question 20

A healthcare organization stores patient records in an encrypted database. Access to the database is restricted to authorized medical staff only. Which security principle is primarily being addressed by these measures?

Accepted Answer

Confidentiality. Confidentiality ensures that sensitive data, such as patient records, is accessible only to authorized individuals. Encryption renders the data unreadable to unauthorized parties, and access restrictions enforce that only authorized medical staff can decrypt and view the records. This directly aligns with the principle of confidentiality, which is a core pillar of the CIA triad.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation