SC-900 Practice Exam 62 — 20 Questions

Question 1

A company uses a third-party SaaS CRM application. The security team needs to monitor user sessions in real-time when sales representatives access the CRM from personal, unmanaged devices. The goal is to prevent the download of sensitive customer data to local drives. The solution should block download actions and show a warning to the user. Which Microsoft security solution should the team deploy to enforce these session controls?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) provides session-level controls via its Conditional Access App Control feature. This allows real-time monitoring and control of user sessions in third-party SaaS apps like CRM, enabling actions such as blocking downloads and displaying warnings based on device compliance (e.g., unmanaged devices). The solution integrates with Azure AD Conditional Access to enforce these policies at the session layer without modifying the underlying SaaS application.

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 2

An organization wants to protect against password spray attacks by automatically blocking sign-ins from suspicious IP addresses. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection uses machine learning to detect and automatically block sign-ins from suspicious IP addresses, such as those associated with anonymous proxies or known malicious activity. It directly mitigates password spray attacks by applying risk-based conditional access policies that require additional verification or block the sign-in attempt.

Answer

Microsoft Entra Self-Service Password Reset

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Multifactor Authentication

Question 3

You are troubleshooting a Conditional Access policy in Microsoft Entra ID. The policy in the exhibit is not blocking some sign-ins that you expected to block. What is the most likely reason?

Accepted Answer

The policy only blocks based on user risk, not sign-in risk. The Conditional Access policy shown in the exhibit is configured to block access based on user risk level (e.g., high user risk), but it does not include sign-in risk as a condition. Sign-ins that exhibit suspicious behavior (e.g., from an anonymous IP address) but originate from a user account with low user risk will not be blocked, as the policy only evaluates user risk, not sign-in risk. To block such sign-ins, the policy must also include sign-in risk as a condition.

Answer

The policy is not assigned to any users

Answer

The grant control is set to allow access

Answer

The policy excludes certain users

Question 4

Your company uses Microsoft Purview Communication Compliance to detect and remediate inappropriate messages. You need to create a policy that monitors Microsoft Teams chats for potential harassment. Which type of policy should you create?

Accepted Answer

Communication Compliance policy. Microsoft Purview Communication Compliance is specifically designed to detect and remediate inappropriate messages, such as harassment, in Microsoft Teams chats and other communication channels. It uses customizable policies to scan for offensive language, sensitive information, or policy violations, enabling organizations to enforce internal compliance rules.

Answer

Data Loss Prevention (DLP) policy

Answer

Information Barriers policy

Answer

Retention policy

Question 5

You are the security administrator for Contoso Corporation. The company uses Microsoft 365 E5 licenses, which include Microsoft Entra ID P2, Microsoft Purview, and Microsoft Defender XDR. Contoso has a hybrid identity environment with Microsoft Entra Connect syncing on-premises Active Directory to Microsoft Entra ID. The company recently experienced a data breach where an attacker compromised a user's credentials and exfiltrated sensitive customer data from SharePoint Online. The investigation revealed that the compromised user did not have MFA enabled and had admin consent to a malicious third-party OAuth app. To prevent future incidents, management has mandated the following requirements: (1) Enforce MFA for all users, especially those accessing sensitive data. (2) Block all OAuth apps that are not pre-approved by IT. (3) Detect and respond to identity-based threats in real-time. (4) Classify and protect sensitive data in SharePoint and Teams. You need to recommend a solution that meets all requirements. Which combination of Microsoft security solutions should you implement?

Accepted Answer

Conditional Access to enforce MFA, Microsoft Defender for Cloud Apps to block unapproved OAuth apps, Microsoft Defender for Identity to detect identity threats, and Microsoft Purview Information Protection to classify and protect sensitive data.. Conditional Access enforces MFA and can block OAuth apps; Defender for Cloud Apps provides OAuth app governance; Defender for Identity detects identity threats; Purview Information Protection classifies and protects data. Defender for Cloud is for cloud workload protection, not identity or OAuth. Intune is for device management. Sentinel is a SIEM but not specific for identity threat detection. The correct combination covers all four requirements.

Answer

Conditional Access to enforce MFA, Microsoft Intune to block OAuth apps, Microsoft Defender for Endpoint to detect identity threats, and Microsoft Purview Audit to classify data.

Answer

Security defaults to enforce MFA, Microsoft Defender for Cloud to block OAuth apps, Microsoft Sentinel to detect identity threats, and Microsoft Purview Data Loss Prevention to classify data.

Answer

Microsoft Entra ID Protection to enforce MFA, Microsoft Defender for Identity to block OAuth apps, Microsoft Sentinel to detect identity threats, and Microsoft Purview Data Lifecycle Management to classify data.

Question 6

Your organization wants to classify documents based on whether they contain confidential business information like trade secrets. You need to use a classifier that learns from example documents. What should you use?

Accepted Answer

Trainable classifier. A trainable classifier is the correct choice because it uses machine learning to analyze example documents and learn patterns that distinguish content containing confidential business information, such as trade secrets. Unlike predefined sensitive information types, trainable classifiers can be customized to identify unique or proprietary content by training on your specific sample documents. This aligns with the requirement to 'learn from example documents' rather than relying on fixed patterns or exact matches.

Answer

Exact data match

Answer

Data loss prevention policy

Answer

Sensitive information type

Question 7

You are designing a compliance solution for a global company. You need to ensure that data stored in SharePoint Online is not accessible from a specific geographic region. Which Microsoft Purview feature should you use?

Accepted Answer

Compliance boundaries. This question is problematic because no Microsoft Purview feature listed directly restricts SharePoint Online data access based on geographic region. Compliance boundaries (A) are for eDiscovery scoping, not access control. Data loss prevention policies (B) prevent data loss but do not block access by region. Retention policies (C) manage data lifecycle, not access. Sensitivity labels (D) classify and protect data but cannot enforce geographic restrictions on their own. For this requirement, you would use a non-Purview feature such as Conditional Access in Microsoft Entra ID or Multi-Geo capabilities.

Answer

Data loss prevention policy

Answer

Retention policy

Answer

Sensitivity labels

Question 8

Your organization wants to audit all activities related to accessing sensitive files in Microsoft SharePoint. Which Microsoft Purview solution should you use?

Accepted Answer

Audit (Premium). Audit (Premium) in Microsoft Purview provides detailed logging of user and admin activities, including granular events like file access, modification, and permission changes in SharePoint. This solution enables organizations to investigate and audit all activities related to sensitive files by capturing and retaining audit records with high-volume event support and custom alerting.

Answer

Data lifecycle management

Answer

Information barriers

Answer

Data loss prevention

Question 9

A healthcare organization uses Microsoft 365. They need to prevent employees from sharing emails or documents that contain patient medical record numbers (MRNs) with external recipients. If an attempt is made, the message should be blocked and the sender should receive a policy tip notification. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and block the sharing of sensitive information, such as patient medical record numbers (MRNs), with external recipients. DLP policies can be configured to scan emails and documents for patterns (e.g., regex for MRNs), block the transmission, and display a policy tip notification to the sender, meeting all requirements.

Answer

Data Lifecycle Management

Answer

Records Management

Answer

Information Protection

Question 10

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access. Conditional Access in Microsoft Entra ID is the correct feature because it allows you to enforce policies that require devices to be marked as compliant by Microsoft Intune before granting access to corporate email. By integrating with Intune, Conditional Access evaluates device compliance status in real time and blocks or allows access accordingly, ensuring only managed and compliant devices can reach email resources.

Answer

Privileged Identity Management

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 11

Your company has Microsoft Defender for Office 365 and wants to configure anti-phishing policies to protect against spear-phishing attacks targeting executives. Which policy setting should you enable to provide the highest level of protection?

Accepted Answer

Impersonation protection for users. Impersonation protection for users is the correct setting because it specifically defends against spear-phishing attacks that impersonate high-value targets like executives. Microsoft Defender for Office 365 uses machine learning and sender intelligence to detect and block emails that spoof the display name or email address of protected users, providing the highest level of protection against targeted impersonation attacks.

Answer

Malware filter

Answer

Bulk email filtering

Answer

Spoof intelligence

Question 12

A user successfully authenticates to a system using a smart card. After authentication, the system checks whether the user's device is compliant with security policies before granting access to the network. This additional check is an example of which security concept?

Accepted Answer

Authorization. Authorization is the correct answer because after the user is authenticated via smart card, the system evaluates whether the user's device meets security compliance policies before granting network access. This decision—allowing or denying access based on conditions—is the core function of authorization, which determines what resources or actions an authenticated identity is permitted to perform.

Answer

Authentication

Answer

Accounting

Answer

Non-repudiation

Question 13

An organization wants to allow users to reset their own passwords without help desk intervention. Which Microsoft Entra feature should they enable?

Accepted Answer

Self-service password reset. Self-service password reset (SSPR) is the Microsoft Entra feature specifically designed to allow users to reset their own passwords without requiring help desk intervention. It enforces security through authentication methods (e.g., phone, email, security questions) and can be configured to meet organizational policies. This directly addresses the scenario of reducing help desk workload for password resets.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 14

Your organization uses Microsoft Purview to manage insider risk. You need to create a policy that detects users who exfiltrate sensitive data by copying it to personal cloud storage services like Dropbox. Which solution should you use?

Accepted Answer

Insider Risk Management. Insider Risk Management in Microsoft Purview is specifically designed to detect, investigate, and act on risky user activities, including the exfiltration of sensitive data to personal cloud storage services like Dropbox. It uses predefined or custom policies with indicators such as copying files to unauthorized cloud apps, which aligns directly with the requirement to detect data exfiltration to personal cloud storage.

Answer

eDiscovery (Premium)

Answer

Audit (Premium)

Answer

Communication Compliance

Question 15

Refer to the exhibit. The JSON snippet shows a sensitivity label configuration. What is the purpose of the 'SensitiveInfoTypes' property in this label?

Accepted Answer

It specifies the sensitive information types that trigger automatic labeling.. The 'SensitiveInfoTypes' property in a sensitivity label configuration specifies which built-in or custom sensitive information types (e.g., credit card numbers, passport numbers) should be detected in content. When these types are matched, the label can be applied automatically through auto-labeling policies, ensuring consistent protection without requiring manual user action.

Answer

It sets the retention period for content with this label.

Answer

It defines the user groups that can apply this label manually.

Answer

It configures the encryption settings for the label.

Question 16

Which TWO Microsoft Purview solutions can be used to protect sensitive data in Microsoft Teams chats and channels? (Choose two.)

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is correct because it helps organizations detect and act on inappropriate or sensitive messages in Teams chats and channels by analyzing communications for policy violations such as offensive language, harassment, or sharing of sensitive data. Microsoft Purview Data Loss Prevention (DLP) policies are correct because they can be configured to automatically detect and prevent the sharing of sensitive information (e.g., credit card numbers, social security numbers) in Teams chats and channels by scanning messages and attachments in real time.

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview Retention Policies

Question 17

A company needs to automatically detect and protect sensitive information such as credit card numbers in emails sent from Exchange Online and documents stored in SharePoint Online. They want to create policies that can block emails if such data is detected, and also automatically encrypt documents with specific labels. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect sensitive information (e.g., credit card numbers) in Exchange Online emails and SharePoint Online documents, and then enforce protective actions such as blocking email transmission or applying encryption labels. DLP policies use sensitive information types and policy tips to identify and remediate data exposure risks across these workloads.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Compliance Manager

Question 18

Your company is implementing records management for legal retention requirements. Documents must be locked and cannot be modified or deleted after a specific event. Which Microsoft Purview capability should you use?

Accepted Answer

Retention label configured as a regulatory record. A retention label configured as a regulatory record is the correct choice because it enforces immutable, locked records that cannot be modified, deleted, or have their retention period shortened by any user, including administrators. This capability is specifically designed for legal retention requirements where documents must be preserved after a triggering event, using a policy that prohibits any changes or deletions.

Answer

Retention policy applied to a SharePoint site

Answer

Sensitivity label with encryption

Answer

Data Loss Prevention policy

Question 19

A financial institution uses Microsoft 365 and must ensure that Microsoft support engineers cannot access the institution's content (e.g., Exchange Online mailboxes, SharePoint sites) without explicit approval from the institution's compliance officer. The compliance officer needs to review and approve or reject each access request. Which Microsoft Purview feature should be configured?

Accepted Answer

Customer Lockbox. Customer Lockbox is the correct feature because it provides a controlled access approval process for Microsoft support engineers to access customer content. When a support case requires access to Exchange Online mailboxes or SharePoint sites, Customer Lockbox ensures the request is sent to the institution's compliance officer for explicit approval or rejection before access is granted, meeting the requirement for explicit approval.

Answer

Communication Compliance

Answer

Insider Risk Management

Answer

Data Lifecycle Management

Question 20

A company uses digital signatures on all official emails sent to customers. The signature is created using the sender’s private key, allowing recipients to verify that the email truly came from the claimed sender and that it was not altered in transit. Which security goal is primarily achieved by the digital signature?

Accepted Answer

Non-repudiation. Digital signatures use asymmetric cryptography where the sender signs the email with their private key. The recipient can verify the signature using the sender's public key, which proves the identity of the sender and ensures the message has not been tampered with. This directly achieves non-repudiation because the sender cannot deny having sent the email, as only their private key could have created the signature.

Answer

Confidentiality

Answer

Integrity

Answer

Availability