SC-900 Practice Exam 63 — 20 Questions

Question 1

Your organization is implementing Microsoft Defender for Office 365 to protect against phishing attacks. You need to ensure that when a user clicks a malicious link in an email, the user is warned and the action is blocked. Which policy should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Safe Links policy. Safe Links in Microsoft Defender for Office 365 specifically protects users from malicious URLs in email messages and Office documents. When a user clicks a link, Safe Links checks the URL against a list of known malicious sites and applies policies that can block the click and display a warning page. This directly addresses the requirement to warn and block the action.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Anti-phishing policy

Question 2

A company has enabled Microsoft Defender for Cloud. They want to assess their Azure resources for compliance with security benchmarks like CIS and Azure Security Benchmark, and view a secure score. Which feature of Defender for Cloud provides this capability?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is the Defender for Cloud feature specifically designed to assess Azure resources against industry security benchmarks such as CIS and the Azure Security Benchmark. It continuously evaluates your environment, provides a secure score based on compliance findings, and offers actionable recommendations to improve your security posture. This directly matches the scenario's requirement for benchmark compliance assessment and secure score visibility.

Answer

Microsoft Defender for Servers

Answer

Microsoft Defender for App Service

Answer

Just-in-time (JIT) VM access

Question 3

An organization wants to allow users to reset their own passwords without help desk intervention. They also need to enforce multifactor authentication during the reset process. Which Microsoft Entra feature should they configure?

Accepted Answer

Microsoft Entra Self-Service Password Reset. Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. By integrating with Microsoft Entra Multifactor Authentication, SSPR can enforce MFA during the reset process, satisfying both requirements.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Multifactor Authentication

Question 4

Which TWO Microsoft Purview solutions can be used to protect sensitive data in Microsoft Teams?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is correct because Microsoft Purview DLP policies can be scoped to Microsoft Teams chat and channel messages, detecting sensitive information types (for example, credit card or Social Security numbers) and taking protective actions such as blocking the message or generating alerts. Sensitivity labels are correct because they can be applied to Teams sites, channels, and files shared in Teams, and they enforce protection such as encryption and access restrictions that travel with the content. Information barriers are not the best fit here because they restrict communication between groups rather than protect sensitive data content itself. Communication compliance is designed to detect and remediate inappropriate or risky communications for compliance review, not to apply data protection controls. eDiscovery is used for identifying, preserving, and collecting content for legal or investigative purposes, not for preventing sensitive data exposure.

Answer

Information barriers

Answer

Communication compliance

Answer

eDiscovery

Question 5

An organization uses Microsoft Sentinel for SIEM. The security operations center (SOC) wants to automatically create an incident when a user account is compromised and suspicious activity is detected. Which Microsoft Sentinel feature should be used?

Accepted Answer

Analytics rules. Analytics rules in Microsoft Sentinel are the correct feature because they define conditions for generating alerts and can automatically create incidents when those conditions are met. In this scenario, an analytics rule can be configured to detect a compromised user account and suspicious activity, then automatically create an incident for the SOC to investigate.

Answer

Watchlists

Answer

Automation playbooks

Answer

Workbooks

Question 6

Your organization wants to use Microsoft Entra Verified ID to issue digital credentials to employees. Which Microsoft Entra service provides the ability to issue and verify verifiable credentials?

Accepted Answer

Microsoft Entra Verified ID. Microsoft Entra Verified ID is the specific service designed to issue and verify verifiable credentials based on decentralized identity standards such as W3C Verifiable Credentials and Decentralized Identifiers (DIDs). It enables organizations to create, issue, and cryptographically verify digital credentials without relying on a central authority, aligning with the scenario described.

Answer

Microsoft Entra Entitlement Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 7

A company uses Microsoft 365 and needs to automatically apply a retention label to documents that contain personally identifiable information (PII) in SharePoint Online. The label should retain the documents for 5 years and then delete them. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Records Management) is the solution specifically designed to apply retention labels and policies that automatically retain content for a specified period and then delete it. In this scenario, the requirement to automatically apply a retention label to documents containing PII in SharePoint Online and then retain them for 5 years before deletion is a core capability of Data Lifecycle Management, which uses auto-labeling policies based on sensitive information types.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery

Question 8

Your organization, Contoso, uses Microsoft Entra ID P2. You have a Microsoft Entra tenant with several privileged roles including Global Administrator, Exchange Administrator, and SharePoint Administrator. The security team wants to enforce just-in-time (JIT) access for these roles, requiring users to request activation and get approval before they can use the role. Additionally, all activations must be logged and reviewed monthly. What should you configure?

Accepted Answer

Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for role activation and enable access reviews.. Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by requiring users to activate their role assignments with approval from designated approvers. It also includes access reviews that can be scheduled to audit and confirm active role assignments, meeting the logging and monthly review requirements. This directly addresses the need for activation approval and periodic review of privileged role usage.

Answer

Configure Conditional Access policies to require MFA for privileged roles.

Answer

Use Microsoft Entra Entitlement Management to create access packages for roles.

Answer

Create an Identity Protection risk policy to block risky sign-ins for privileged users.

Question 9

A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team wants to detect when a user downloads a large number of files from a cloud storage app after hours, which may indicate data exfiltration. Which Microsoft security solution should be used to detect such anomalous behavior in cloud apps?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it provides Cloud Access Security Broker (CASB) functionality, including anomaly detection policies that can identify unusual user behavior such as downloading a large number of files from a cloud storage app after hours. MDCA uses machine learning to establish a baseline of normal user activity and then triggers alerts when deviations like high-volume downloads occur, which is a classic indicator of data exfiltration.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud

Question 10

A company subscribes to a cloud-based email service that is delivered as Software-as-a-Service (SaaS). According to the shared responsibility model, who is primarily responsible for the physical security of the data centers where the email data is stored?

Accepted Answer

The cloud provider. In the shared responsibility model for SaaS, the cloud provider is responsible for the physical security of the data centers, including hardware, network infrastructure, and physical access controls. The customer is responsible for securing their own data, user access, and compliance within the service, but not the underlying physical infrastructure.

Answer

The customer

Answer

Both the customer and the cloud provider equally

Answer

Neither the customer nor the cloud provider

Question 11

A company uses Microsoft Entra ID and requires that all guest users from a partner organization must sign in using Microsoft Authenticator for MFA. The partner organization manages their own identities. What should you configure?

Accepted Answer

Configure cross-tenant access settings to trust MFA from the partner's Microsoft Entra ID tenant. Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA claims from an external partner's tenant. Since the partner manages their own identities, trusting their MFA ensures that guest users from that partner organization can satisfy MFA requirements using their own Microsoft Authenticator without needing to register again in your tenant.

Answer

Enable Microsoft Entra ID Protection and configure MFA registration policy for guests

Answer

Use Microsoft Entra ID Governance to require access reviews for guests

Answer

Create a Conditional Access policy that requires MFA for guest users

Question 12

A company wants to block users from accessing phishing websites via Microsoft Edge. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender SmartScreen. Microsoft Defender SmartScreen is the correct solution because it is specifically designed to protect users from phishing and malicious websites directly within Microsoft Edge. It operates by comparing visited URLs against a dynamic list of reported phishing sites and analyzing site behavior in real time, blocking access before the user can interact with the page.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 13

A company wants to gain visibility into the use of unsanctioned cloud applications (shadow IT) within their organization. The security team has access to network proxy logs that show traffic to various cloud services. They want to use a Microsoft security solution to analyze these logs and identify which cloud apps are being used, by whom, and how much data is being consumed. Which capability of Microsoft Defender for Cloud Apps should they use?

Accepted Answer

Cloud Discovery. Cloud Discovery in Microsoft Defender for Cloud Apps analyzes network proxy logs (or traffic logs from firewalls and proxies) to identify unsanctioned cloud app usage (shadow IT). It provides visibility into which cloud apps are being used, by which users, and how much data is consumed, directly matching the company's requirement to analyze logs for shadow IT detection.

Answer

App governance

Answer

Conditional Access App Control

Answer

App Connectors

Question 14

A company subscribes to a SaaS human resources application hosted by an external provider. The provider is responsible for maintaining the physical data centers, network infrastructure, and the underlying application software. The company is responsible for managing user accounts, configuring user permissions, and classifying the data they upload. Which security model does this arrangement primarily describe?

Accepted Answer

Shared responsibility model. The scenario explicitly describes a division of security responsibilities between the SaaS provider and the customer. The provider handles physical security, network infrastructure, and application software (security *of* the cloud), while the company manages user accounts, permissions, and data classification (security *in* the cloud). This is the core definition of the shared responsibility model, which is foundational to cloud computing and directly tested in SC-900.

Answer

Defense in depth

Answer

Zero Trust

Answer

CIA triad

Question 15

An organization's security team needs to investigate a security incident that occurred two months ago. They need to search the unified audit log for specific activities performed by a user, such as file access, email actions, and sign-in events, to understand the scope of the compromise. Which Microsoft Purview solution provides these audit log search capabilities?

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) provides the ability to search the unified audit log for activities like file access, email actions, and sign-in events. This solution is designed for forensic investigation of user and admin activity within Microsoft 365, making it the correct choice for investigating a security incident that occurred two months ago.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Question 16

Your company is implementing a passwordless authentication strategy. You want users to be able to sign in using the Microsoft Authenticator app on their mobile devices. Which Microsoft Entra feature should you enable?

Accepted Answer

Passwordless phone sign-in with Microsoft Authenticator. Passwordless phone sign-in with Microsoft Authenticator allows users to sign in without entering a password by approving a notification or entering a number displayed on the screen. This directly aligns with the requirement to use the Microsoft Authenticator app on mobile devices for a passwordless authentication strategy.

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Answer

Temporary Access Pass

Question 17

A company wants to collect security logs from on-premises servers, cloud applications, and network devices into a central repository, and then use advanced analytics detect threats and automate incident response. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution. It collects security logs from diverse sources like on-premises servers, cloud apps, and network devices into a central Log Analytics workspace, then uses built-in analytics and machine learning to detect threats and automate incident response via playbooks.

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 Defender

Answer

Azure Firewall

Question 18

A company uses Microsoft Entra ID (Microsoft Entra ID) and wants to allow users to sign in using biometrics (fingerprint or face) on their mobile devices instead of passwords. They want this to work for both iOS and Android devices. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Passwordless authentication using Microsoft Authenticator. Microsoft Authenticator supports passwordless authentication using FIDO2-based biometric verification on mobile devices. This feature allows users to sign in with a fingerprint or face on both iOS and Android, eliminating the need for a password while leveraging the device's built-in biometric capabilities.

Answer

Microsoft Entra Connect Sync Health

Answer

Microsoft Entra ID Protection

Answer

Self-Service Password Reset (SSPR)

Question 19

A company uses Microsoft Defender for Cloud to secure its hybrid cloud environment. They need to continuously assess compliance with regulatory standards like ISO 27001 and receive recommendations for remediation. Which feature should they enable?

Accepted Answer

Defender for Cloud’s regulatory compliance dashboard. Microsoft Defender for Cloud's regulatory compliance dashboard continuously assesses resources against built-in or custom standards such as ISO 27001, PCI DSS, and NIST, showing compliance posture and providing remediation recommendations. This directly matches the requirement to assess compliance with regulatory standards and receive remediation guidance.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Answer

Defender for Cloud’s Secure Score

Question 20

Your organization wants to enforce multi-factor authentication (MFA) for all users accessing cloud applications. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Create a Conditional Access policy. Conditional Access policies in Microsoft Entra ID are the recommended way to enforce MFA for all users accessing cloud applications. A Conditional Access policy evaluates signals (user, device, location, app, risk) and can require MFA as a grant control. This provides granular, centralized control and supports reporting and what-if analysis.

Answer

Configure Privileged Identity Management

Answer

Use Identity Protection

Answer

Enable MFA per user