SC-900 Practice Exam 64 — 20 Questions

Question 1

A company uses Microsoft Sentinel as its SIEM. They need to create a custom analytics rule that runs every hour and queries for failed logins from a specific IP address. Which rule scheduling option should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run every 1 hour with a 1-hour query period. The requirement is to run the analytics rule every hour, so the scheduling frequency must be set to 1 hour. The query period should also be 1 hour to cover the full window between runs, ensuring no failed logins are missed. Microsoft Sentinel analytics rules evaluate the query over the specified lookback period each time they run.

Answer

Run every 5 minutes with a 5-minute query period

Answer

Run every 24 hours with a 24-hour query period

Answer

Run every 1 hour with a 5-minute query period

Question 2

An organization has a Microsoft Purview Data Lifecycle Management policy that retains all documents for 5 years. However, legal requires that documents related to a specific lawsuit be preserved indefinitely. What should you do?

Accepted Answer

Place the relevant sites on litigation hold. Litigation hold (now called legal hold in Microsoft Purview) preserves all content in a SharePoint site or OneDrive account indefinitely, overriding any retention policy. This ensures documents related to the lawsuit are not deleted or altered, even if a Data Lifecycle Management policy would otherwise remove them after 5 years. The hold applies at the site level, not to individual items, and prevents both deletion and modification.

Answer

Configure information barriers

Answer

Apply a retention label with indefinite retention

Answer

Create a DLP policy to block deletion

Question 3

An organization uses Microsoft Purview Information Protection. They want to ensure that when a user manually applies a 'Highly Confidential' sensitivity label to a document, the label is automatically applied to any new content pasted from that document into another app. Which configuration should they enable?

Accepted Answer

Marking content as sensitive. Microsoft Purview Information Protection's 'marking content as sensitive' feature (also known as content marking) ensures that when a user manually applies a sensitivity label, the label is automatically applied to any new content pasted from that document into another app. This is achieved through automatic marking that tracks the label even when content is copied. Option B (Data Loss Prevention policies) is incorrect because DLP policies enforce rules to prevent data loss but do not automatically apply labels to copied content. Option C (Encryption with rights management) is incorrect because encryption protects content but does not propagate labels across copy-paste. Option D (Auto-labeling policies) is incorrect because auto-labeling automatically classifies content based on conditions, not manual application.

Answer

Data Loss Prevention policies

Answer

Encryption with rights management

Answer

Auto-labeling policies

Question 4

Which THREE of the following are capabilities of Microsoft Purview Compliance Manager? (Choose three.)

Accepted Answer

Automated testing of controls. Option A (Automated testing of controls) is correct because Compliance Manager can automatically test certain Microsoft cloud controls against your tenant configuration — for example, verifying MFA enforcement or password policies — and update their status without manual evidence collection. Option C (Improvement actions) is correct because Compliance Manager provides a catalog of improvement actions that map to controls and standards, letting you assign owners, set implementation status, and track remediation steps to raise your compliance posture. Option E (Compliance score) is correct because Compliance Manager calculates a compliance score that quantifies your progress based on completed improvement actions and passed assessments, weighted by control importance. Option B (Manage user identities) is not a Compliance Manager capability; identity lifecycle and authentication are handled by Microsoft Entra ID. Option D (Create data loss prevention policies) is not a Compliance Manager capability; DLP policies are authored and enforced through Microsoft Purview Data Loss Prevention in the compliance portal, not through Compliance Manager.

Answer

Manage user identities

Answer

Create data loss prevention policies

Question 5

A company wants to automatically classify and protect sensitive documents stored in SharePoint Online. The compliance administrator needs to create a policy that detects credit card numbers and applies encryption. Which Microsoft Purview solution should the administrator use?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling (Option B) is the correct Microsoft Purview solution because it allows the compliance administrator to create a policy that automatically detects sensitive data types, such as credit card numbers, and applies encryption to documents in SharePoint Online. This feature uses trainable classifiers or sensitive information types to scan content at rest and automatically assign a label that enforces protection actions like encryption, meeting the requirement without manual user intervention.

Answer

Communication Compliance

Answer

Microsoft Entra ID

Answer

Data Lifecycle Management

Question 6

A company wants to use Microsoft Entra ID (Azure AD) to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. Which security feature should they implement?

Accepted Answer

Conditional Access policies. Conditional Access policies in Microsoft Entra ID allow administrators to enforce MFA based on conditions such as user, group, application, location, and device state. This is the primary feature for requiring MFA for access to sensitive applications. It provides granular control and integrates with other signals.

Answer

Privileged Identity Management (PIM)

Answer

Password Protection

Answer

Identity Protection policies

Question 7

A security administrator is explaining the shared responsibility model to a new team member. The company uses a Software-as-a-Service (SaaS) application such as Microsoft 365. For which of the following items is the customer primarily responsible under this model?

Accepted Answer

Managing user access and classifying data stored in the service. In the shared responsibility model for SaaS like Microsoft 365, the customer is responsible for managing user access (e.g., configuring Microsoft Entra ID roles, conditional access policies, and multi-factor authentication) and classifying data stored in the service (e.g., applying sensitivity labels via Microsoft Purview Information Protection). The provider manages the underlying infrastructure, including physical security, hypervisor patching, and application updates.

Answer

Physical security of the data center hosting the SaaS application

Answer

Patching the hypervisor that runs the SaaS infrastructure

Answer

Applying security updates to the SaaS application itself

Question 8

An organization uses Microsoft 365 Defender and wants to automate the investigation and response to common email-based phishing attacks. They want the system to automatically take actions such as deleting malicious emails from user inboxes across the organization after analysis. Which Microsoft 365 Defender component provides this automated capability?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes automated investigation and response (AIR) capabilities specifically designed for email-based threats like phishing. When a phishing email is detected, AIR can automatically trigger remediation actions—such as soft-deleting or hard-deleting the malicious message from user mailboxes—based on predefined playbooks, without requiring manual intervention.

Answer

Azure AD Identity Protection

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 9

A company deploys a custom web application on Azure App Service (PaaS). The application stores user data in Azure SQL Database. The security team is responsible for securing the application code, managing authentication, and configuring TLS for data in transit. According to the Microsoft shared responsibility model, which security responsibility remains with Microsoft for this PaaS deployment?

Accepted Answer

Patching the operating system of the underlying physical and virtual hosts. In a PaaS deployment like Azure App Service, Microsoft is responsible for the security of the underlying cloud infrastructure, including patching the operating system of the physical and virtual hosts that run the platform. This is a core tenant of the shared responsibility model, where the customer manages application-level security (code, authentication, TLS) while Microsoft manages the host OS and hypervisor.

Answer

Configuring the firewall rules for the web application

Answer

Managing user access to the application

Answer

Encrypting the application data at rest in Azure SQL Database

Question 10

Your organization, Contoso Ltd., is a multinational company with offices in the US, EU, and Asia. You are the compliance administrator. The legal team requires that all documents containing personally identifiable information (PII) of EU citizens be retained for 10 years after the last modification. Additionally, any document classified as 'Highly Confidential' must be encrypted and have a custom header 'CONFIDENTIAL - DO NOT FORWARD' when shared externally. You also need to ensure that only users in the EU region can access documents containing EU PII. You have Microsoft Purview with the necessary licenses. You need to design a compliance solution that meets these requirements with minimal administrative overhead. What should you do?

Accepted Answer

Create a retention label for 10-year retention based on PII content; create a sensitivity label 'Highly Confidential' with encryption and header; create a sensitivity label for EU PII with an authentication context, and configure a conditional access policy in Microsoft Entra ID to restrict access to that authentication context to EU users. Option B correctly uses a retention label to retain documents containing EU PII for 10 years after last modification and a sensitivity label to encrypt and add the required header to 'Highly Confidential' documents. For the EU PII location restriction, the correct approach is to apply an EU PII sensitivity label configured with an authentication context, then enforce a Conditional Access policy in Microsoft Entra ID that permits access only from EU locations. This meets all stated requirements with minimal administrative overhead.

Answer

Create a Data Loss Prevention (DLP) policy to block external sharing of PII; create a retention policy for 10 years on all content; use sensitivity labels for encryption

Answer

Use a single unified label that combines retention and sensitivity settings; then configure an auto-labeling policy to apply it; use a device compliance policy to restrict access

Answer

Create a retention policy for 10 years on all content; use sensitivity labels with encryption; then configure a DLP policy to add the header when shared externally

Question 11

Refer to the exhibit. You are analyzing a Microsoft Sentinel workspace using KQL. The query returns no results, but you know that malware alerts have been generated today. What is the most likely reason?

Accepted Answer

The column name 'AlertName' is incorrect.. The KQL query likely returns no rows because the column reference in the query is not an exact match for the actual column in the SecurityAlert table. KQL is case-sensitive: a reference such as `alertName`, `Alertname`, or another small typo is treated as a different column, so the predicate silently matches nothing. This makes the column name as written in the query incorrect. The SecurityAlert table does include `AlertSeverity`, `order by` is valid KQL, and `ago(1d)` covers alerts generated today, so A, B, and C are not the cause.

Answer

The table does not contain a 'AlertSeverity' column.

Answer

The 'order by' clause is invalid.

Answer

The time range is too short.

Question 12

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email, but allow sharing via Microsoft Teams messages. What should they configure?

Accepted Answer

Create a DLP policy scoped to Exchange Online with a block action, and a separate DLP policy scoped to Teams with an audit-only action. Microsoft Purview DLP allows you to create separate policies scoped to different workloads. By creating a DLP policy for Exchange Online with a block action, you prevent credit card numbers from being shared via email. A separate DLP policy scoped to Microsoft Teams with an audit-only action allows sharing in Teams while still logging the activity for monitoring.

Answer

Create a single DLP policy that blocks credit card numbers in both Exchange and Teams

Answer

Configure an exception in the DLP policy for Teams using a rule exception

Answer

Use Microsoft Purview Insider Risk Management to block sharing in Teams

Question 13

You work at a mid-sized company that uses Microsoft Defender for Business (a subscription included with Microsoft 365 Business Premium). The company has 300 devices enrolled in Microsoft Intune. Recently, a malware outbreak occurred on several devices. You need to implement a solution that automatically remediates devices that are found to be infected with malware. The solution should isolate the device from the network and run a full scan. Which action should you take?

Accepted Answer

Enable automatic investigation and remediation in Microsoft Defender for Business.. Microsoft Defender for Business includes automated investigation and remediation (AIR), which can automatically isolate an infected device and trigger a full antivirus scan based on the investigation verdict. Enabling AIR is the only option that provides automatic remediation actions rather than just detection or access blocking. Conditional Access and compliance policies restrict access but do not remediate the device itself.

Answer

Create a Conditional Access policy to block access for devices with malware.

Answer

Create an Intune compliance policy to mark devices as non-compliant if malware is detected.

Answer

Configure Microsoft Defender Antivirus to run a weekly scan.

Question 14

A small consulting company, Northwind Traders, uses Microsoft 365 Business Premium and wants to implement basic compliance solutions. They have 50 users and need to: (1) prevent employees from sharing customer credit card information via email; (2) retain all deleted emails for 1 year; (3) allow users to classify documents as 'Confidential' manually; (4) generate reports on policy violations. The company has limited IT staff and wants a quick, out-of-the-box solution. What should they configure?

Accepted Answer

Use Microsoft Purview to create a DLP policy for credit card info, a retention policy for deleted emails, and publish a sensitivity label for 'Confidential'.. Microsoft Purview provides out-of-the-box compliance capabilities that directly address all four requirements: DLP policies to block credit card information in email, retention policies for deleted emails, sensitivity labels for manual classification, and reporting on policy violations. It is designed for quick deployment with minimal IT overhead, making it the ideal choice for a small company.

Answer

Use Microsoft Intune to set data loss prevention policies and configure document classification.

Answer

Use Microsoft 365 Defender to block sharing of credit card data and configure email retention.

Answer

Use Microsoft Entra ID to create conditional access policies and enable retention.

Question 15

You are the security administrator for a large healthcare organization that uses Microsoft 365 E5. The organization must comply with HIPAA and GDPR regulations. You have implemented Microsoft Purview Information Protection with sensitivity labels to classify and protect patient data. Recently, the compliance team identified that some documents containing Protected Health Information (PHI) are being shared externally without protection. You need to prevent users from sharing documents classified as 'Highly Confidential' with external users unless the document is encrypted and labeled. Additionally, you must ensure that any external sharing of such documents is automatically blocked. You have the following options available. Which action should you take?

Accepted Answer

Create a data loss prevention (DLP) policy in Microsoft Purview that detects the 'Highly Confidential' label and blocks sharing with external users. A Microsoft Purview Data Loss Prevention (DLP) policy can detect documents that carry the 'Highly Confidential' sensitivity label and enforce actions such as blocking external sharing. This directly addresses the requirement to automatically block external sharing of documents classified as 'Highly Confidential'. DLP policies work across SharePoint, OneDrive, Exchange, and Teams, providing the enforcement layer that labels alone do not. Note: DLP blocks sharing based on the label; it does not itself apply encryption or labels. The 'encrypted and labeled' condition is handled by the sensitivity label and its encryption settings, not by the DLP policy.

Answer

Configure auto-labeling for SharePoint to automatically apply the 'Highly Confidential' label to all documents containing PHI

Answer

Configure a conditional access policy in Microsoft Entra ID to block external access to SharePoint sites containing PHI

Answer

Create a retention policy for SharePoint that prevents deletion of documents with the 'Highly Confidential' label

Question 16

You are the compliance administrator for Contoso, a multinational corporation with headquarters in the US and subsidiaries in Europe and Asia. Contoso uses Microsoft 365 E5 and Microsoft Purview. The company handles personal data subject to GDPR and CCPA. You need to design a compliance solution that meets the following requirements:
- Automatically classify and protect documents containing personal data in SharePoint Online and OneDrive for Business.
- Ensure that data subject requests (DSRs) for access and deletion can be fulfilled within the regulatory timeframes.
- Prevent accidental sharing of sensitive data via email and Teams.
- Maintain an audit trail of all activities related to personal data for at least one year.
- Manage data retention to comply with local laws that require different retention periods for different types of data.
Which combination of Microsoft Purview solutions should you use?

Accepted Answer

Sensitivity labels with auto-labeling, DLP, eDiscovery, Data Lifecycle Management, and Audit (Premium). It includes all the necessary Purview solutions: Sensitivity labels with auto-labeling classify and protect documents containing personal data; DLP prevents accidental sharing via email and Teams; eDiscovery enables fulfilling data subject requests (DSRs) for access and deletion; Data Lifecycle Management allows configuring different retention periods for different data types; Audit (Premium) provides one-year audit trail retention. Options B, C, and D each miss one or more critical components needed to meet all requirements.

Answer

Insider Risk Management, DLP, eDiscovery, and Data Lifecycle Management

Answer

Data Lifecycle Management, Information Barriers, DLP, and Audit (Premium)

Answer

Sensitivity labels, Communication Compliance, eDiscovery, and Audit (Standard)

Question 17

You are a compliance administrator for Contoso, a multinational company that uses Microsoft 365. The company has the following requirements: 
1. Automatically retain all documents containing personally identifiable information (PII) for 7 years. 
2. Prevent users from sharing PII via email with external recipients unless they provide a business justification. 
3. Monitor and alert when users access sensitive data outside of business hours. 
4. Generate a compliance score for GDPR and ISO 27001. 
You need to configure the appropriate Microsoft Purview solutions. For each requirement, match the correct solution. Which combination of solutions should you use?

Accepted Answer

Data Lifecycle Management for retention; DLP for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring. Requirement 1 (retain PII for 7 years) is met by a retention label or policy from Data Lifecycle Management (not Information Protection, which is for classification). Requirement 2 (prevent sharing without justification) is met by a Data Loss Prevention (DLP) policy that can block sharing and require user override with business justification. Requirement 3 (monitor access outside business hours) is met by Insider Risk Management, which can detect anomalous access patterns. Requirement 4 (compliance score) is met by Compliance Manager. Option A is wrong because Information Protection labels are for classification, not retention; also monitoring access outside hours needs Insider Risk Management, not DLP. Option B is wrong because Communication Compliance is for monitoring communications, not for preventing sharing via email; DLP is needed for that. Option D is wrong because eDiscovery is for legal discovery, not for access monitoring.

Answer

Information Protection for retention; DLP for sharing; Data Lifecycle Management for monitoring; Compliance Manager for scoring

Answer

Data Lifecycle Management for retention; Communication Compliance for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

Answer

Information Protection for retention; eDiscovery for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

Question 18

You work for a law firm that uses Microsoft 365 E5. The firm handles highly confidential client information and must comply with attorney-client privilege. You need to implement a compliance solution that:
- Prevents unauthorized sharing of privileged documents via email.
- Enables lawyers to easily classify documents as 'Privileged' and automatically encrypt them.
- Allows the compliance team to monitor for accidental exposure of privileged information in Teams chats.
- Ensures that privileged documents are retained for 7 years after case closure, then automatically deleted.
- Provides the ability to search for privileged documents in case of a legal hold.
What should you configure?

Accepted Answer

Sensitivity labels with encryption, DLP, Communication Compliance, Data Lifecycle Management, and eDiscovery. Sensitivity labels with encryption classify and encrypt privileged documents, DLP prevents unauthorized email sharing, Communication Compliance monitors Teams chats for accidental exposure, Data Lifecycle Management enforces 7-year retention then deletion, and eDiscovery supports legal hold searches. Together these Microsoft Purview solutions meet all five requirements. This combination is the only one that covers classification, encryption, monitoring, retention, and search.

Answer

DLP, Communication Compliance, Data Lifecycle Management, and Audit (Standard)

Answer

Insider Risk Management, DLP, Data Lifecycle Management, and eDiscovery

Answer

Sensitivity labels, Information Barriers, Data Lifecycle Management, and eDiscovery

Question 19

Your organization, Northwind Traders, uses Microsoft Intune to manage Windows 10 devices. You have created a compliance policy that requires devices to have BitLocker enabled. After assigning the policy, you notice that some devices are reporting as non-compliant due to BitLocker not being enabled. You have verified that the devices support BitLocker and that the policy is correctly assigned. You need to ensure that BitLocker is enabled on these devices automatically. What should you do?

Accepted Answer

Create an endpoint protection configuration profile to enable BitLocker. A compliance policy in Intune only evaluates and reports on device state; it does not enforce settings. To automatically enable BitLocker, you must deploy a configuration profile (specifically an endpoint protection configuration profile) that configures BitLocker settings. This ensures devices receive the policy to turn on BitLocker and become compliant.

Answer

Modify the compliance policy to allow non-compliant devices

Answer

Create a Windows update ring policy

Answer

Use a PowerShell script to enable BitLocker manually

Question 20

You are a compliance officer at a healthcare organization that uses Microsoft 365. The organization must comply with HIPAA regulations. You have Microsoft Purview, Microsoft Defender for Cloud Apps, and Microsoft Intune. You need to ensure that all devices accessing patient health information (PHI) are compliant with the organization's security policies, which require device encryption, a minimum OS version, and the use of a compliant mobile device management (MDM) provider. Currently, some devices are not managed by Intune. You need to enforce that only compliant devices can access PHI stored in SharePoint Online. What should you do?

Accepted Answer

Configure a conditional access policy in Microsoft Entra ID to require compliant devices. Conditional Access in Microsoft Entra ID is the policy engine that evaluates signals such as device compliance state at sign-in time and can grant, block, or require remediation. By creating a CA policy that requires a compliant device (or hybrid Microsoft Entra ID joined device) for the SharePoint Online cloud app, only devices that satisfy the Intune compliance policy (encryption, minimum OS, MDM enrollment) can reach PHI.

Answer

Create a device compliance policy in Microsoft Intune and assign it to all users

Answer

Deploy an app protection policy in Microsoft Intune to restrict data access

Answer

Create a DLP policy in Microsoft Purview to block access from non-compliant devices