SC-900 Practice Exam 63 — 20 Questions

Question 1

An organization is migrating its on-premises applications to Azure Infrastructure-as-a-Service (IaaS). According to the shared responsibility model, which of the following security responsibilities remain with Microsoft? (Select two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Physical security of the datacenters. In the shared responsibility model for IaaS, Microsoft retains responsibility for the physical security of its datacenters, including access controls, surveillance, and environmental protections. Additionally, Microsoft manages security at the hypervisor layer, which includes network controls that isolate virtual machines from each other and from the underlying host. These responsibilities are inherent to the infrastructure provider and cannot be delegated to the customer.

Answer

Patching the guest operating system on the VM

Answer

Configuring network security group (NSG) firewall rules

Question 2

Your organization uses Microsoft Purview eDiscovery to manage a legal case. You need to place a hold on emails for specific users, but you want to allow the system to apply the hold automatically. Which eDiscovery solution should you use?

Accepted Answer

Microsoft Purview eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) is the correct choice because it provides advanced legal hold capabilities, including the ability to apply holds automatically based on specified criteria such as user mailboxes or SharePoint sites. Unlike the Standard version, Premium supports policy-based holds that can be set to trigger automatically without manual intervention, which is essential for managing legal cases efficiently.

Answer

Microsoft Purview eDiscovery (Standard)

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview Communication Compliance

Question 3

Your organization uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on several endpoints. Which feature allows you to search for indicators of compromise (IOCs) across all endpoints?

Accepted Answer

Advanced hunting. Advanced hunting in Microsoft Defender for Endpoint is a query-based threat hunting tool that allows security analysts to search for indicators of compromise (IOCs) across all endpoints using the Kusto Query Language (KQL). It provides access to raw, schema-based tables (e.g., DeviceEvents, DeviceFileEvents, DeviceNetworkEvents) for up to 30 days of historical data, enabling proactive detection of malware outbreak patterns across the entire fleet.

Answer

Incidents and alerts

Answer

Threat analytics

Answer

Device inventory

Question 4

A multinational corporation uses Microsoft Entra ID for identity management. They want to allow their external partners to use their own corporate credentials to access the company's resources, rather than creating guest accounts. Which Entra ID feature should they use?

Accepted Answer

Entra ID External ID. Entra ID External ID (formerly Azure AD External Identities) is the correct feature because it enables external partners to authenticate using their own corporate credentials via federation, without requiring guest accounts. This allows seamless access to the company's resources while maintaining the partner's identity lifecycle.

Answer

Entra ID B2C

Answer

Entra ID Direct Federation

Answer

Entra ID Verified ID

Question 5

Your organization's security team wants to automatically investigate and respond to sophisticated email threats like business email compromise (BEC) without manual intervention. Which Microsoft 365 security solution should you use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes automated investigation and response (AIR) capabilities specifically designed to handle sophisticated email threats like business email compromise (BEC). It uses machine learning models and heuristics to detect BEC patterns—such as spoofed domains, compromised accounts, and social engineering—and can automatically trigger playbooks to contain, investigate, and remediate threats without manual intervention.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Question 6

Your company uses Microsoft Sentinel to manage security incidents. You need to automatically assign incidents to a specific analyst team based on the incident category (e.g., phishing incidents to the SOC team). What should you configure?

Accepted Answer

Automation rule with a condition on incident category and an action to assign to the SOC team. Automation rules in Microsoft Sentinel allow you to define conditions based on incident properties (like category) and automatically take actions such as assigning the incident to a specific team. This is the correct and most efficient method for routing incidents by category without requiring custom code or external playbooks.

Answer

Create a watchlist mapping categories to teams and use it in analytics rules

Answer

Configure the analytics rule to set the incident owner in the rule query

Answer

Playbook triggered by incident creation that assigns the incident

Question 7

A company maintains an on-premises Active Directory environment with over 10,000 domain-joined computers. The security team is concerned about advanced attacks that use stolen credentials to move laterally, such as pass-the-hash attacks or DCSync attacks targeting domain controllers. They need a solution that monitors on-premises Active Directory traffic and event logs to detect these identity-based threats and provides alerts for investigation. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity is the correct solution because it is specifically designed to monitor on-premises Active Directory traffic and event logs to detect advanced identity-based threats like pass-the-hash, pass-the-ticket, and DCSync attacks. It uses behavioral analytics and machine learning to identify suspicious activities, such as anomalous Kerberos ticket requests or replication attempts, and provides real-time alerts for investigation.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 8

Your company uses Microsoft Purview to protect sensitive data in SharePoint Online. You need to automatically apply a 'Confidential' sensitivity label to documents containing credit card numbers. What should you create?

Accepted Answer

An auto-labeling policy. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive info types, such as credit card numbers. Option B (DLP policy) is incorrect because while DLP can detect and protect sensitive data, it does not automatically apply labels; it applies actions like blocking or warning. Option C (retention policy) is incorrect because retention policies manage data retention and deletion, not labeling. Option D (eDiscovery case) is incorrect because eDiscovery cases are used for searching and legal hold purposes.

Answer

A Data Loss Prevention (DLP) policy

Answer

A retention policy

Answer

An eDiscovery case

Question 9

A security analyst wants to create a custom detection rule that tracks a specific multi-stage attack pattern: a user receives a phishing email, clicks a link, and then a script is executed on their device. The analyst needs to write a Kusto Query Language (KQL) query to detect this pattern and schedule it to run automatically, generating alerts. Which Microsoft 365 Defender capability should they use?

Accepted Answer

Custom detection rules. Custom detection rules in Microsoft 365 Defender allow security analysts to write KQL queries that run on a schedule and automatically generate alerts when the query returns results. This capability is specifically designed to detect multi-stage attack patterns, such as the phishing email → link click → script execution chain described, by querying advanced hunting data and triggering incident creation.

Answer

Advanced hunting

Answer

Automation

Answer

Threat analytics

Question 10

Which THREE are capabilities of Microsoft Defender for Cloud?

Accepted Answer

Just-in-time (JIT) VM access. Just-in-time (JIT) VM access is a capability of Microsoft Defender for Cloud that reduces the attack surface by locking down inbound traffic to Azure VMs. It uses Network Security Group (NSG) rules to allow access only when requested by an authorized user, for a specified time window, and from a specific IP address. This prevents persistent open management ports like RDP (TCP 3389) or SSH (TCP 22) from being exposed to the internet.

Answer

DDoS protection

Answer

SIEM and security orchestration

Question 11

Which TWO of the following are capabilities of Microsoft Entra ID? (Select two.)

Accepted Answer

Identity as a Service (IDaaS) for cloud applications. Microsoft Entra ID is a cloud-based identity and access management service, providing Identity as a Service (IDaaS) for cloud applications. It enables organizations to manage user identities and control access to resources, including thousands of pre-integrated SaaS applications through single sign-on (SSO). This makes option B correct because Entra ID's core function is identity management, not endpoint security or network infrastructure.

Answer

Antivirus and antimalware protection

Answer

Provide network firewall services

Answer

Manage mobile devices and applications

Question 12

Your company wants to allow employees to use their corporate Microsoft Entra ID credentials to sign in to third-party SaaS applications like Salesforce and ServiceNow. Which Microsoft Entra feature should you configure?

Accepted Answer

Enterprise applications with pre-integrated gallery apps.. Configuring a third-party SaaS application like Salesforce or ServiceNow as an Enterprise Application in Microsoft Entra ID allows you to set up federation using SAML 2.0 or OpenID Connect, enabling users to sign in with their corporate Entra ID credentials. The pre-integrated gallery apps provide pre-configured templates that simplify the setup of single sign-on (SSO) and user provisioning, making it the appropriate feature for this requirement.

Answer

Conditional Access policies.

Answer

Microsoft Entra B2B collaboration.

Answer

Microsoft Entra Identity Protection.

Question 13

A multinational company uses Microsoft 365 and has a retention policy that automatically applies a 7-year retention label to any document containing a credit card number. The retention label must be automatically applied at the time the document is created or modified. Which Microsoft Purview solution should the administrator use to configure this automatic labeling rule?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Records Management) is the correct solution because it provides the ability to create and apply retention labels automatically based on sensitive information types, such as credit card numbers, using auto-labeling policies. This ensures that the retention label is applied at the time of document creation or modification, meeting the requirement for automatic application without user intervention.

Answer

Microsoft Purview Retention Policy

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview eDiscovery

Question 14

A healthcare organization must comply with HIPAA regulations. They store patient health information (PHI) in SharePoint Online documents. The compliance team needs to automatically detect PHI (e.g., medical record numbers) in documents, apply a sensitivity label that encrypts the document, and prevent users from removing that label. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (option B) is correct because it provides the ability to automatically detect sensitive data types (such as PHI) using trainable classifiers or sensitive information types, apply a sensitivity label that enforces encryption, and configure label protection settings to prevent users from removing the label. This directly meets the HIPAA compliance requirement for automated detection, encryption, and label persistence on SharePoint Online documents.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Question 15

A multinational organization uses Microsoft Entra ID for identity management. The security team wants to implement a Conditional Access policy that blocks access from untrusted locations unless the user's device is marked as compliant by Microsoft Intune. However, users traveling to trusted partner locations should be allowed access even if their device is non-compliant. Which two conditions should be configured in the policy?

Accepted Answer

Locations: All locations, exclude trusted locations; Grant: Require compliant device.. The policy must block access from untrusted locations unless the device is compliant, while allowing access from trusted partner locations even if the device is non-compliant. By setting 'Locations: All locations' and excluding trusted locations, the policy applies only to untrusted locations. Then, 'Grant: Require compliant device' ensures that only compliant devices can access from those untrusted locations, meeting both requirements.

Answer

Locations: All trusted locations; Grant: Require compliant device.

Answer

Locations: All trusted locations; Grant: Block access.

Answer

Locations: All locations; Grant: Require compliant device.

Question 16

A company regularly performs automated backups of its critical databases and has a disaster recovery plan to restore operations quickly after a system failure. Which security principle is primarily being addressed by these measures?

Accepted Answer

Availability. Automated backups and a disaster recovery plan directly support the Availability principle of the CIA triad by ensuring that critical databases can be restored and operations resumed quickly after a system failure. Availability guarantees that systems and data are accessible to authorized users when needed, and these measures minimize downtime and data loss.

Answer

Confidentiality

Answer

Integrity

Answer

Non-repudiation

Question 17

A company runs workloads in Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP). The security team needs a single, unified dashboard to continuously assess the security posture of all cloud resources, identify misconfigurations, and receive prioritized recommendations for remediation. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct solution because it provides a unified cloud security posture management (CSPM) dashboard that continuously assesses resources across Azure, AWS, and GCP. It identifies misconfigurations against industry benchmarks (e.g., CIS, NIST) and delivers prioritized, actionable recommendations to remediate risks, directly meeting the requirement for a single dashboard across multi-cloud environments.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 18

A company issues laptops to all employees with BitLocker full-disk encryption enabled. If a laptop is stolen, the data on the hard drive cannot be read without the recovery key. Which security principle does this measure primarily protect?

Accepted Answer

Confidentiality. BitLocker full-disk encryption ensures that data on a stolen laptop's hard drive is unreadable without the recovery key, directly protecting against unauthorized access. This aligns with the confidentiality principle, which safeguards sensitive information from disclosure to unauthorized parties.

Answer

Integrity

Answer

Availability

Answer

Non-repudiation

Question 19

Your organization uses Microsoft Purview to classify sensitive data. You need to create a custom sensitive information type that detects employee IDs matching the pattern 'EMP-XXXXX' (where X is a digit). Which rule pack element must you define?

Accepted Answer

Regular expression. A regular expression (regex) is used to define the custom pattern for employee IDs like 'EMP-XXXXX'. Option A (keyword list) is for exact keywords, not patterns. Option D (function) is for built-in functions, not custom patterns. Option C (data store reference) is for external data sources, not pattern definition.

Answer

Keyword list

Answer

Data store reference

Answer

Function

Question 20

A company requires that all users accessing a financial application from outside the corporate network must complete multi-factor authentication (MFA). The IT team is configuring a Microsoft Entra ID Conditional Access policy to enforce this requirement. Which component of the policy should be configured to apply the MFA requirement?

Accepted Answer

Grant controls. Grant controls are the component of a Conditional Access policy that enforce the actual access requirements, such as requiring multi-factor authentication (MFA). By configuring the 'Require multi-factor authentication' checkbox under Grant controls, the policy ensures that users must complete MFA before accessing the financial application. This is the correct setting to apply the MFA requirement.

Answer

Conditions

Answer

Assignments

Answer

Session controls