SC-900 Practice Exam 62 — 20 Questions

Question 1

Your organization, Contoso Ltd., has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are deploying Microsoft Defender for Identity (MDI) to protect against identity-based attacks. You have installed the MDI sensor on domain controllers and configured the service with the necessary permissions. After installation, you notice that MDI is not generating alerts for pass-the-hash attacks. You have verified that the sensors are healthy and that audit policies are correctly configured. You need to ensure that MDI can detect pass-the-hash attacks. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable password hash synchronization in Microsoft Entra Connect. The current explanation states: "Enabling password hash synchronization (PHS) in Entra Connect allows MDI to analyze NTLM hashes and detect pass-the-hash attacks." This is incorrect. Password Hash Synchronization (PHS) is a method for synchronizing user password hashes from on-premises Active Directory to Microsoft Entra ID for cloud authentication purposes. MDI's detection of pass-the-hash attacks relies on monitoring NTLM authentication traffic and relevant security events on domain controllers, not on the hashes synchronized to Microsoft Entra ID via PHS. Therefore, enabling PHS does not enable or enhance MDI's ability to detect pass-the-hash attacks on-premises.

Option B is wrong because the MDI sensor is already installed on domain controllers, and installing it on all servers is not the specific missing step for pass-the-hash detection. 
Option C is wrong because pass-the-hash attacks primarily leverage NTLM hashes, and while Kerberos logging is important for other attacks, it's not the primary mechanism for pass-the-hash detection. The stem also states audit policies are correctly configured.
Option D is wrong because multi-factor authentication is a preventative control that strengthens authentication; it does not enable MDI to detect pass-the-hash attacks. Given that the sensors are healthy and audit policies are correctly configured, none of the provided options directly address a common missing configuration for MDI to detect pass-the-hash attacks.

Answer

Install the Azure ATP agent on all servers

Answer

Enable Kerberos event logging on domain controllers

Answer

Configure multi-factor authentication for all users

Question 2

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a compliant antivirus solution can access corporate email. Which policy type should be configured?

Accepted Answer

Conditional Access policy in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID evaluate signals such as device compliance status before granting access to cloud apps like corporate email. By integrating with Intune device compliance policies, they can block access from devices that lack a compliant antivirus solution. This is the correct mechanism because Conditional Access enforces the access decision at the authentication layer, not just at the device management layer.

Answer

App protection policy in Microsoft 365

Answer

Device compliance policy in Intune

Answer

Security baseline in Microsoft Defender for Cloud

Question 3

A healthcare organization needs to automatically classify documents containing patient health information (PHI) in Microsoft SharePoint. The solution should apply a 'Confidential - Healthcare' sensitivity label to any document that matches the HIPAA content pattern. Which Microsoft Purview feature should be used?

Accepted Answer

Auto-labeling for sensitivity labels. Auto-labeling for sensitivity labels (Option D) is correct because it automatically applies the specified sensitivity label to documents that match a defined pattern (e.g., HIPAA content) in SharePoint. Option A is wrong because retention label auto-apply is for retention, not sensitivity. Option B is wrong because manual labeling requires user action and does not auto-classify. Option C is wrong because DLP policies enforce rules to prevent data loss, they do not apply sensitivity labels.

Answer

Retention label auto-apply

Answer

Manual sensitivity labeling

Answer

Data loss prevention (DLP) policy

Question 4

A company uses Microsoft Entra ID. The security team wants to enforce multifactor authentication (MFA) only when users sign in from devices that are not compliant with company security policies. They also want to block sign-ins from unknown geographic locations. Which Microsoft Entra feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to create policies that evaluate signals such as device compliance and geographic location before granting access. By configuring a policy that requires MFA for non-compliant devices and blocks sign-ins from unknown locations, the security team can enforce these specific conditions. This granular control is unique to Conditional Access, which integrates with Microsoft Entra ID to enforce access decisions based on real-time risk and context.

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Self-Service Password Reset (SSPR)

Question 5

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to receive alerts when a user attempts to share a file containing personally identifiable information (PII) via email. Which DLP rule component is used to define the notification action?

Accepted Answer

Actions. In Microsoft Purview DLP, the 'Actions' component defines what happens when a DLP rule is triggered, including sending notifications or alerts to administrators. For the scenario of receiving alerts when a user attempts to share PII via email, the notification action is configured within the rule's Actions section. Conditions define what data to match, Locations specify where to monitor, and Exceptions refine rule scope, but only Actions contain the notification settings.

Answer

Conditions

Answer

Location

Answer

Exceptions

Question 6

You are deploying Microsoft Entra Verified ID to issue verifiable credentials for employee onboarding. Which component is required to issue credentials?

Accepted Answer

A decentralized identifier (DID) for your organization. Microsoft Entra Verified ID requires a decentralized identifier (DID) for your organization to issue verifiable credentials. The DID serves as the cryptographic anchor that proves your organization's authority to issue credentials, as it is registered on a decentralized ledger (ION) and linked to your public keys. Without a DID, the verifiable credentials cannot be cryptographically signed and verified by relying parties.

Answer

A public key infrastructure (PKI) certificate

Answer

A custom application registered in Microsoft Entra ID

Answer

A blockchain node for the decentralized ledger

Question 7

A company uses Microsoft Purview Information Protection to classify and label sensitive documents. The compliance team wants to automatically apply a 'Confidential' label to documents containing an employee's passport number. Which method should they use?

Accepted Answer

Auto-labeling policy. An auto-labeling policy in Microsoft Purview Information Protection automatically applies sensitivity labels to documents and emails based on sensitive information types (e.g., passport numbers) without user intervention. This method uses content scanning to detect patterns and enforce labeling rules, making it the correct choice for the compliance team's requirement.

Answer

Manual labeling by users

Answer

Trainable classifiers

Answer

DLP policy

Question 8

An organization wants to protect its fleet of Windows 10 laptops from advanced malware and ransomware. The solution must detect suspicious behavior (e.g., a process encrypting files) and provide security teams with the ability to isolate an infected device from the network for investigation. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities, including behavioral-based detection of advanced malware and ransomware (e.g., detecting a process encrypting files via machine learning and behavioral analytics). It also includes automated investigation and remediation features, such as the ability to isolate an infected device from the network (device isolation) to prevent lateral movement while allowing security teams to investigate.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Question 9

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to assess compliance with the CIS benchmark. What should you enable?

Accepted Answer

Regulatory compliance standards in Microsoft Defender for Cloud. To assess compliance with the CIS benchmark in Microsoft Defender for Cloud, you must enable the appropriate regulatory compliance standard. Defender for Cloud includes built-in support for industry standards like CIS, and by adding the CIS benchmark as a regulatory compliance standard, the service continuously assesses your Azure resources against the CIS controls and displays compliance status in the dashboard.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Firewall

Question 10

A user reports that they are repeatedly prompted for multifactor authentication when accessing Microsoft 365 apps from the same trusted device. What should you do to reduce the number of prompts?

Accepted Answer

Configure 'Remember MFA' settings in Conditional Access. The 'Remember MFA' setting in Conditional Access allows administrators to configure the session lifetime for MFA prompts on trusted devices. By extending the 'MFA reauthentication frequency' or enabling 'Remember Multifactor Authentication' for a longer period (e.g., 30 days), users will not be repeatedly challenged on the same device, reducing friction while maintaining security.

Answer

Disable MFA for the user

Answer

Change the user's MFA method to text message

Answer

Reset the user's MFA registration

Question 11

A company wants to detect and respond to advanced attacks targeting their on-premises Active Directory infrastructure, such as Kerberos Golden Ticket attacks, pass-the-hash, and brute-force attempts. The solution should integrate with Microsoft Sentinel and Microsoft 365 Defender for cross-domain investigations. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is specifically designed to protect on-premises Active Directory by monitoring for advanced attacks like Kerberos Golden Ticket, pass-the-hash, and brute-force attempts. It integrates natively with Microsoft Sentinel and Microsoft 365 Defender to enable cross-domain investigations, correlating identity signals with endpoint and cloud data.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Question 12

An organization has deployed Microsoft Entra ID Governance and wants to automate the process of revoking access to a critical application when an employee leaves the company. Which feature should they configure?

Accepted Answer

Microsoft Entra ID Governance Lifecycle Workflows. Microsoft Entra ID Governance Lifecycle Workflows enable automated workflows triggered by HR events like employee termination. When an employee leaves, a lifecycle workflow can be configured to automatically remove the user from the application's access group or disable their account, ensuring immediate revocation of access without manual intervention.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Terms of Use

Question 13

Your organization uses Microsoft Sentinel. You need to create an automation rule that automatically closes a low-severity incident after 24 hours of inactivity. Which action should you include in the rule?

Accepted Answer

Change status to Closed. Changing the status to 'Closed' is the direct action needed to automatically resolve a low-severity incident after a period of inactivity in Microsoft Sentinel. Automation rules can trigger status changes based on conditions like time elapsed, and closing the incident removes it from the active queue without manual intervention.

Answer

Run playbook

Answer

Create incident

Answer

Add comment

Question 14

Refer to the exhibit. The KQL query is run in Microsoft Defender for Endpoint. What is the purpose of this query?

Accepted Answer

To find devices with a high number of operations on potentially sensitive files.. The KQL query filters for `DeviceFileEvents` where `SensitivityLabel` is not empty, indicating files with sensitivity labels applied (e.g., confidential, internal). It then summarizes the count of operations per device and orders by the highest count. This identifies devices with a high number of operations on potentially sensitive files, aligning with data loss prevention (DLP) monitoring.

Answer

To list all devices that have files named confidential.

Answer

To detect malware on devices.

Answer

To list all file creation events.

Question 15

A security analyst wants to create a custom detection rule that tracks a specific multi-stage attack pattern: a user receives a phishing email, clicks a link, and then a script is executed on their device. The analyst needs to write a Kusto Query Language (KQL) query to detect this pattern and schedule it to run automatically, generating alerts. Which Microsoft 365 Defender capability should they use?

Accepted Answer

Custom detection rules. Custom detection rules in Microsoft 365 Defender allow security analysts to write KQL queries that run on a schedule and automatically generate alerts when the query returns results. This capability is specifically designed to detect multi-stage attack patterns, such as the phishing email → link click → script execution chain described, by querying advanced hunting data and triggering incident creation.

Answer

Advanced hunting

Answer

Automation

Answer

Threat analytics

Question 16

An organization wants to automatically retain all financial documents for seven years and then delete them. Which Microsoft Purview solution should be used to create the retention policy?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it provides retention and deletion policies that can automatically retain data for a specified period (e.g., seven years) and then permanently delete it. This solution is designed specifically for managing the lifecycle of content across Exchange, SharePoint, OneDrive, and Teams, making it ideal for regulatory compliance requirements like financial document retention.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Communication Compliance

Question 17

Your organization uses Microsoft Purview to manage records. For legal reasons, you need to preserve all documents related to a specific litigation case and prevent any modification or deletion. Which feature should you use?

Accepted Answer

eDiscovery (Premium) legal hold. eDiscovery (Premium) legal hold is the correct feature because it preserves content in-place by placing a hold on data sources (e.g., Exchange mailboxes, SharePoint sites, OneDrive accounts) associated with a specific litigation case. This prevents any modification or deletion of documents while the hold is active, ensuring compliance with legal preservation requirements. Unlike retention labels, which manage lifecycle policies, legal hold is designed specifically for litigation scenarios to freeze data immutably.

Answer

Retention labels

Answer

Data Loss Prevention

Answer

Audit logs

Question 18

A healthcare organization stores patient records in SharePoint Online. The compliance officer needs to ensure that records containing Protected Health Information (PHI) are retained for 7 years per regulatory requirements. Which Microsoft Purview solution should they implement?

Accepted Answer

Microsoft Purview Records Management. Microsoft Purview Records Management is the correct solution because it enables organizations to apply retention labels and policies that enforce mandatory retention periods for regulatory compliance. For patient records containing PHI, a retention label can be configured to retain the data for exactly 7 years and then trigger a disposition review or automatic deletion, ensuring the organization meets healthcare regulatory requirements.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Lifecycle Management

Question 19

A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team needs to discover which unsanctioned cloud apps employees are using (Shadow IT). They also want to get a risk score for each app and receive alerts when a high-risk app is used. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it is specifically designed for Cloud Access Security Broker (CASB) functions, including Shadow IT discovery, risk scoring of cloud apps, and policy-based alerts. It integrates with Microsoft 365 and third-party SaaS apps via API connectors and log collectors to identify unsanctioned app usage and assign a risk score based on factors like compliance, security controls, and industry standards.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Purview Compliance Manager

Question 20

A company uses Microsoft 365 and needs to automatically detect documents in SharePoint Online that contain personally identifiable information (PII) such as social security numbers. When such documents are detected, they want to apply a sensitivity label that encrypts the document and restricts access to only the compliance team. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically scan documents in SharePoint Online for sensitive information types (e.g., social security numbers) using built-in or custom sensitive info types. When a match is found, DLP policies can trigger an action to apply a sensitivity label that encrypts the document and restricts access, such as limiting it to the compliance team. This combines content detection with automated protection, which is exactly the scenario described.

Answer

Data Lifecycle Management

Answer

Records Management

Answer

Communication Compliance