SC-900 Practice Exam 65 — 20 Questions

Question 1

Your organization uses Microsoft Purview eDiscovery to manage legal holds. A legal hold has been placed on a user’s mailbox, but the user has left the company and their mailbox has been converted to a shared mailbox. You need to ensure that the legal hold remains effective. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the legal hold is still listed in the eDiscovery case for the mailbox.. When a mailbox is converted to a shared mailbox, the legal hold applied via eDiscovery remains in effect and does not need to be recreated. It is important to verify that the hold is still listed in the eDiscovery case. Option A is incorrect because converting back is unnecessary and may lose shared mailbox features. Option B is incorrect because the hold is still active; creating a new hold is redundant. Option D is incorrect because removing and reapplying the hold is not required.

Answer

Convert the shared mailbox back to a user mailbox to keep the hold.

Answer

Create a new legal hold for the shared mailbox.

Answer

Remove the legal hold and reapply it to the shared mailbox.

Question 2

You are a security administrator for Contoso Ltd., which uses Microsoft 365 E5. The company has 10,000 users and uses Microsoft Entra ID for identity. The security team has noticed an increase in sign-in attempts from anonymous IP addresses and from locations outside the company's home country. They want to implement a solution that automatically blocks sign-ins from anonymous IP addresses and requires MFA for sign-ins from outside the home country. They also want to ensure that if a user's risk level is high, they are forced to change their password. The solution must use Microsoft Entra ID Protection and Conditional Access. You have already configured a Conditional Access policy to require MFA for all users. Which of the following is the most efficient way to meet all requirements with minimal administrative overhead?

Accepted Answer

Configure Identity Protection sign-in risk policy to block anonymous IP addresses, user risk policy to require password change for high-risk users, and create a Conditional Access policy to require MFA for sign-ins from outside the home country.. A is correct. Identity Protection sign-in risk policies can detect and block sign-ins from anonymous IP addresses. User risk policies can require a password change for high-risk users. Conditional Access policies can enforce MFA based on location (e.g., outside home country). Option B is incorrect because a single Conditional Access policy cannot directly detect anonymous IP addresses (this is only available through Identity Protection). Option C is incorrect because it blocks sign-ins from outside the home country instead of requiring MFA. Option D is incorrect because it uses Conditional Access to require MFA for all users, which is already done by the existing policy, and it does not specifically enforce MFA for outside home country; also, requiring MFA for all users adds unnecessary friction. The most efficient method to meet all requirements with minimal administrative overhead is to combine Identity Protection risk policies for anonymous IP and high risk, and create a separate Conditional Access policy for location-based MFA, as in option A.

Answer

Create a single Conditional Access policy that blocks anonymous IP addresses, requires MFA based on location, and forces password change for high-risk users.

Answer

Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to block sign-ins from outside the home country.

Answer

Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to require MFA for all users.

Question 3

Your organization, Contoso Ltd., uses Microsoft 365 and Microsoft Defender XDR. You are a security administrator. Recently, a user named John Doe reported that his account is sending phishing emails internally. You suspect his account is compromised. You need to contain the threat immediately while preserving forensic data. The company has the following security solutions: Microsoft Entra ID P2, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, Microsoft Sentinel, and Microsoft Purview. You need to prevent the compromised account from causing further damage. Which action should you take first?

Accepted Answer

Disable the user account in Microsoft Entra ID. Disabling the user account in Microsoft Entra ID immediately prevents the compromised account from initiating any new actions, including sending phishing emails. This is the fastest containment step while preserving forensic data. Option A (reset password) is incorrect because it does not terminate active sessions; the attacker may still have a valid token. Option B (revoke refresh tokens) is a useful step but is not as immediate as disabling the account, and it may not stop all sessions. Option D (create mail flow rule) is too slow and may not affect sessions already authenticated.

Answer

Reset the user's password and require a password change

Answer

Revoke all refresh tokens for the user in Microsoft Entra ID

Answer

Create a mail flow rule in Exchange Online to block the user's emails

Question 4

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. Which statement about this policy is accurate?

Accepted Answer

The policy will delete items 7 years after they were last modified.. The exhibit shows a retention policy configured with the action 'Delete items' and a period of '7 years' based on 'When items were last modified.' This means the policy will delete items 7 years after their last modification date, not from creation. Option C correctly states this behavior.

Answer

The policy will delete items after 7 years from the date they were created.

Answer

The policy will retain items for 7 years from the last modification date.

Answer

The policy will keep items for 7 years and then delete them.

Question 5

Contoso Pharmaceuticals is implementing Microsoft Purview to meet regulatory compliance (HIPAA and GDPR). They need to: (1) automatically classify and protect patient health information (PHI) and personally identifiable information (PII) in Exchange Online, SharePoint Online, and OneDrive for Business; (2) detect and prevent unauthorized sharing of sensitive data; (3) retain audit logs for 7 years; and (4) allow users to manually apply classification labels to documents. The company has 5,000 users and uses Microsoft 365 E5 licenses. The security team wants to minimize manual effort and ensure consistent protection. What should the compliance administrator configure first?

Accepted Answer

Create sensitivity labels with auto-labeling policies configured to detect PHI and PII, and publish them via label policies.. Sensitivity labels with auto-labeling policies are the foundational Purview capability that classifies and protects PHI/PII across Exchange, SharePoint, and OneDrive, and they also enable users to manually apply labels. Auto-labeling uses trainable classifiers and sensitive information types (SITs) to detect content and apply protection (encryption, markings) consistently with minimal manual effort. DLP, retention, and auditing build on top of labels but do not themselves provide the classification-and-protection layer the scenario requires first.

Answer

Configure Data Loss Prevention (DLP) policies to block sharing of content containing PHI and PII.

Answer

Set up retention policies for Exchange, SharePoint, and OneDrive to retain data for 7 years.

Answer

Enable auditing for all workloads and configure alert policies for unauthorized access.

Question 6

Your organization needs to control which users can access Microsoft Purview compliance portal. Which method should you use to grant access?

Accepted Answer

Assign users to the Compliance Administrator role group in Microsoft Purview. Access to the Microsoft Purview compliance portal is granted by assigning users to the appropriate role group within Purview itself, such as the Compliance Administrator role group. Option A is incorrect because Azure RBAC roles manage access to Azure resources, not to Purview. Option B is incorrect because Intune policies control device management and compliance, not user access to Purview. Option D is incorrect while Microsoft 365 E5 licenses are required to use Purview features, they do not by themselves grant access; explicit role assignment is necessary.

Answer

Add users to an Azure RBAC role

Answer

Configure Intune policy to allow access

Answer

Assign Microsoft 365 E5 licenses to users

Question 7

Fabrikam Inc. is a global manufacturing company that uses Microsoft Entra ID for identity management. They have recently experienced a security incident where an attacker compromised a user account and accessed sensitive intellectual property. The security team wants to implement identity protection measures to detect and respond to such attacks in the future. They need a solution that can automatically detect suspicious sign-in behavior, such as impossible travel and anomalous token issuance, and then take action to block the sign-in or require additional verification. Additionally, they want to integrate threat intelligence feeds to improve detection. Which Microsoft security solution should they use to meet these requirements?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection uses machine learning to detect risks like impossible travel and anomalous token issuance, and can automatically enforce policies such as requiring MFA or blocking sign-ins. It also integrates with threat intelligence feeds. Option A is wrong because Microsoft Defender for Identity focuses on on-premises Active Directory, not cloud sign-ins. Option C is wrong because Microsoft Sentinel is a SIEM, not an automated response tool for sign-in risks. Option D is wrong because Microsoft Defender for Cloud Apps is for cloud app discovery and control, not primarily for sign-in risk detection.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 8

Tailspin Toys is a toy manufacturer with headquarters in the US and subsidiaries in Europe and Asia. You are the compliance administrator. The company must comply with the EU General Data Protection Regulation (GDPR). Requirements: 1) Personal data of EU residents must be retained only for as long as necessary (max 5 years after last interaction). 2) If a user tries to share personal data outside the EU, the action must be blocked. 3) Users must be able to manually mark documents as 'GDPR High Risk' which will encrypt them and add a watermark 'GDPR PROTECTED'. 4) All access to personal data must be audited. You have Microsoft Purview with E5 compliance licenses. What is the most efficient solution?

Accepted Answer

Create an auto-labeling policy to apply a 'Personal Data' sensitivity label; create a retention label 'GDPR Retention' to auto-apply to personal data and retain for 5 years; create a DLP policy to block sharing of labeled personal data outside EU; create a separate sensitivity label 'GDPR High Risk' for manual application with encryption and watermark; enable audit logging. It uses the full Microsoft Purview toolset appropriately: an auto-labeling policy applies a 'Personal Data' sensitivity label to identify and classify personal data at scale; a retention label 'GDPR Retention' is auto-applied to that labeled content to enforce the 5-year retention requirement; a DLP policy blocks sharing of labeled personal data outside the EU; a separate sensitivity label 'GDPR High Risk' is manually applied by users to encrypt and watermark documents; and audit logging is enabled. This combination meets all four requirements with minimal manual effort and leverages E5 compliance features like auto-labeling and DLP with sensitivity labels.

Answer

Use a retention policy to delete all content after 5 years; create a DLP policy to block sharing of personal data outside EU; create a sensitivity label for manual application with encryption and watermark; enable audit logging

Answer

Use a retention policy to delete personal data after 5 years; create a DLP policy to block cross-border sharing; use a sensitivity label with auto-labeling for personal data; enable audit logging

Answer

Create a DLP policy to block sharing of personal data outside EU; use a retention label for 5 years; use a single sensitivity label for both automatic and manual scenarios; enable audit logging

Question 9

Your company uses Microsoft Purview to meet data privacy regulations. You need to discover and classify personal data stored in Azure SQL Database. Which THREE tools or features can you use?

Accepted Answer

Microsoft Purview Data Estate Insights. Microsoft Purview Data Estate Insights (C) provides a centralized dashboard to monitor data estate health, including scanning and classification of personal data across sources like Azure SQL Database. It integrates with the Purview Data Map to track data lineage and sensitivity labels, enabling compliance with data privacy regulations.

Answer

Microsoft 365 compliance center

Answer

Azure Information Protection

Question 10

Your organization is adopting a Zero Trust security model. You are tasked with implementing identity protection. The requirements are: enforce multi-factor authentication (MFA) for all users when accessing cloud applications, ensure that risky sign-ins are detected and blocked automatically, and provide administrators with a dashboard showing user risk levels. You have Microsoft Entra ID P2 licenses. What should you configure?

Accepted Answer

Configure a Conditional Access policy to require MFA for all cloud apps, enable Identity Protection to detect and automatically block risky sign-ins, and use the Identity Protection dashboard.. Microsoft Entra ID P2 includes Identity Protection, which provides risk detection for sign-ins and users, and Conditional Access, which enforces access controls like MFA. A Conditional Access policy requiring MFA for all cloud apps directly meets the first requirement. Enabling Identity Protection allows automatic blocking of risky sign-ins via risk-based Conditional Access policies, and the Identity Protection dashboard shows user risk levels, satisfying the remaining requirements.

Answer

Configure Microsoft Sentinel to collect sign-in logs and create custom alerts for risky sign-ins.

Answer

Configure Privileged Identity Management for all users and enable MFA.

Answer

Configure Microsoft Defender for Cloud Apps to require MFA and detect risky sign-ins.

Question 11

You are a compliance officer for a law firm that uses Microsoft 365 E5 licenses. The firm must comply with GDPR. You need to implement a solution that automatically identifies personal data (e.g., email addresses) in SharePoint Online documents and applies a 'GDPR-Protected' sensitivity label. Additionally, you need to ensure that if a user attempts to share a labeled document externally, they receive a policy tip warning about GDPR compliance, but the share is not blocked. You have Microsoft Purview. What should you configure?

Accepted Answer

Create an auto-labeling policy to apply the 'GDPR-Protected' label to documents containing email addresses, and create a DLP policy for labeled documents that shows a policy tip when shared externally.. An auto-labeling policy in Microsoft Purview can use sensitive information types (SITs) such as email addresses to automatically apply the 'GDPR-Protected' sensitivity label to SharePoint Online documents. A DLP policy scoped to documents with that label can then show a policy tip when users attempt external sharing, without blocking the action, satisfying the requirement for a warning only. This combination meets both the auto-classification and the non-blocking policy tip requirements.

Answer

Create a retention policy to tag documents containing email addresses.

Answer

Create a sensitivity label policy that publishes the 'GDPR-Protected' label to users and train them to apply it manually.

Answer

Create a DLP policy that detects email addresses and shows a policy tip, but do not apply a label.

Question 12

Contoso Ltd. is a financial services company that must comply with strict regulatory requirements. They use Microsoft 365 E5, Microsoft Entra ID P2, Microsoft Purview, and Microsoft Defender for Cloud Apps. The compliance team needs to implement a data loss prevention (DLP) policy that detects and prevents the sharing of credit card numbers in Microsoft Teams messages. Additionally, they want to ensure that only users with a specific custom sensitivity label can access documents containing credit card numbers. The sensitivity label is named 'Financial-Confidential' and is applied automatically via auto-labeling. The DLP policy should block sharing of credit card numbers in Teams but allow users to override the block with a business justification. Which combination of actions should you configure in the Microsoft Purview DLP policy to meet these requirements?

Accepted Answer

Create a DLP policy in Microsoft Purview that blocks sharing of credit card numbers in Teams and allows overrides with business justification. Configure the policy to apply to content containing the 'Financial-Confidential' sensitivity label.. A Microsoft Purview DLP policy can detect credit card numbers in Teams messages and block sharing while allowing users to override with a business justification. Scoping the DLP policy to content containing the 'Financial-Confidential' sensitivity label applies the policy only to content with that label; it does not by itself restrict document access to only users with that label. Restricting access based on a sensitivity label requires a sensitivity label policy with encryption and access permissions. Therefore, option C addresses the Teams DLP requirement but does not fully implement the label-based access control; a separate sensitivity label policy would also be required.

Answer

Create a DLP policy in Microsoft Purview that blocks sharing of credit card numbers in Teams and does not allow overrides. Configure the policy to apply to all content.

Answer

Configure a session policy in Microsoft Defender for Cloud Apps that monitors Teams for credit card numbers and blocks sharing. Use the 'Block with override' action.

Answer

Use the built-in DLP template for financial data in Microsoft Purview and enable the 'Block with override' action. Set the scope to Teams.

Question 13

You are a security administrator for Contoso Ltd., a global financial services company with 5,000 employees. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Entra ID, Microsoft Defender XDR, Microsoft Purview, and Microsoft Intune. Recently, the security team identified a risk: employees are sharing sensitive financial reports via external email recipients without encryption. To address this, you need to implement a solution that automatically applies encryption to emails containing the sensitive information type 'U.S. Bank Account Number' when sent to external recipients. The solution must not block the email but should encrypt it. Additionally, you want to notify the sender with a policy tip that the email will be encrypted. You have access to the Microsoft Purview compliance portal. What should you configure?

Accepted Answer

Create a Data Loss Prevention (DLP) policy in Microsoft Purview that detects 'U.S. Bank Account Number' and applies encryption to emails sent to external recipients, with a policy tip.. A DLP policy in Microsoft Purview is the correct solution because it can automatically detect sensitive information types like 'U.S. Bank Account Number' in email content and apply encryption actions (such as Encrypt-Only or Do Not Forward) when the email is sent to external recipients. The policy can also be configured to show a policy tip to the sender, notifying them that the email will be encrypted, without blocking the email. This directly meets the requirement of automatic encryption with sender notification, leveraging the built-in DLP capabilities in Microsoft 365 E5.

Answer

Configure an email encryption rule in Microsoft Defender for Office 365.

Answer

Enable Microsoft Purview Message Encryption for all users.

Answer

Create a sensitivity label with encryption and publish it to all users, then train users to apply it manually.

Question 14

An Azure Policy definition has a Deny effect that denies storage accounts unless their network ACLs set defaultAction to Deny and include at least one IP rule. An administrator attempts to create a storage account named 'storagedev' with network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules. What will happen when this policy is assigned?

Accepted Answer

The storage account creation will be denied. The Azure Policy definition uses the 'Deny' effect, which explicitly blocks any resource creation that does not meet the specified conditions. Since the storage account 'storagedev' has network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules, it violates the policy's requirement for restricted network access. Therefore, Azure Policy will deny the creation of this storage account, preventing it from being provisioned.

Answer

The storage account will be created successfully

Answer

The policy will audit the storage account and mark it as non-compliant

Answer

The storage account will be created, but the policy will modify the ACLs

Question 15

Your company is adopting Microsoft Copilot for Microsoft 365 to improve productivity. The security team is concerned about data leakage, as Copilot can access emails, documents, and other content. You need to ensure that sensitive data, such as credit card numbers and social security numbers, is not inadvertently exposed by Copilot. The organization uses Microsoft Purview sensitivity labels and DLP. You need to configure a solution that automatically detects and prevents Copilot from accessing or generating content containing these sensitive data types. What should you do?

Accepted Answer

Create a DLP policy in Microsoft Purview that detects sensitive data types and blocks Copilot actions. A Microsoft Purview DLP policy that detects sensitive information types (credit card numbers, SSNs) and is scoped to Copilot interactions will block Copilot from processing or generating content containing that data. Purview DLP natively integrates with Copilot for Microsoft 365, so policies can enforce restrictions on prompts and responses in real time. This is the purpose-built control for the stated requirement.

Answer

Configure Microsoft Defender for Cloud Apps to control Copilot

Answer

Disable Copilot for users who handle sensitive data

Answer

Apply sensitivity labels to all documents containing sensitive data

Question 16

Which TWO capabilities are provided by Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Secure score and security recommendations. Microsoft Defender for Cloud provides a secure score and security recommendations (option A) as part of its Cloud Security Posture Management (CSPM) capabilities, continuously assessing resources against benchmarks like the Microsoft Cloud Security Benchmark and Azure Security Benchmark to surface prioritized remediation guidance. It also provides vulnerability assessment for VMs (option C) through integrated scanners such as Microsoft Defender for Servers' built-in vulnerability assessment powered by Qualys or the agentless scanning capability, surfacing CVEs and remediation steps in the portal. Option B (EDR) is a capability of Microsoft Defender for Endpoint, not Defender for Cloud itself, even though Defender for Servers can auto-provision the Defender for Endpoint agent. Option D (CASB) is delivered by Microsoft Defender for Cloud Apps, a separate product in the Defender suite. Option E (SIEM) is provided by Microsoft Sentinel, not Defender for Cloud.

Answer

Endpoint detection and response (EDR)

Answer

Cloud Access Security Broker (CASB)

Answer

Security Information and Event Management (SIEM)

Question 17

You need to ensure that sensitive documents in Microsoft SharePoint Online are automatically classified and protected when they contain credit card numbers. What should you configure?

Accepted Answer

A sensitivity label with auto-labeling for Microsoft Purview Information Protection. A sensitivity label with auto-labeling for Microsoft Purview Information Protection is correct because it can automatically classify and protect documents based on sensitive content, such as credit card numbers, using built-in sensitive information types. This ensures that when a document in SharePoint Online contains credit card data, it is automatically labeled with encryption and usage restrictions without manual intervention.

Answer

A retention policy for SharePoint

Answer

A data loss prevention (DLP) policy

Answer

A retention label for regulatory compliance

Question 18

Which TWO Microsoft security solutions can be used to detect and respond to threats across email, endpoints, and identities? (Choose two.)

Accepted Answer

Microsoft Sentinel. Microsoft Defender XDR (E) is correct because it is the extended detection and response platform that natively correlates signals across email (Defender for Office 365), endpoints (Defender for Endpoint), identities (Defender for Identity), and cloud apps, providing unified detection and automated response. Microsoft Sentinel (D) is correct because it is a cloud-native SIEM/SOAR solution that ingests telemetry from email, endpoint, identity, and other sources via connectors, then uses analytics rules, fusion, and playbooks to detect and respond to threats across those domains. Microsoft Intune (A) is not correct because it is a mobile device and endpoint management (MDM/MAM) service for configuration and compliance, not a threat detection and response solution. Microsoft Defender for Cloud Apps (B) is not correct here because, although it is part of the Defender XDR suite, on its own it is a CASB focused on cloud app discovery, session control, and SaaS threat protection rather than covering email, endpoints, and identities. Microsoft Purview (C) is not correct because it is a data governance, compliance, and information protection suite (DLP, eDiscovery, sensitivity labels), not a cross-domain threat detection and response platform.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview

Question 19

You are reviewing a Microsoft Purview DLP policy configuration as shown in the exhibit. What is the expected behavior when a user sends an email containing a credit card number to an external recipient?

Accepted Answer

The email is blocked, and the user receives a policy tip notification.. A DLP policy configured to block external sharing of credit card data will prevent the email from being sent and surface a policy tip to the user explaining the violation. The policy tip is the standard user-facing notification that accompanies a block action in Microsoft Purview DLP. Because the recipient is external and the content matches the sensitive information type, the block-and-notify behavior is triggered.

Answer

The email is delivered, but the user receives a warning.

Answer

The email is delivered, and the user is asked to provide a business justification.

Answer

The email is blocked, but only if the recipient is external and internal recipients are allowed.

Question 20

Your organization uses Microsoft Purview eDiscovery to manage legal holds. A legal hold has been placed on a user’s mailbox, but the user has left the company and their mailbox has been converted to a shared mailbox. You need to ensure that the legal hold remains effective. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An auto-labeling policy for sensitivity labels. An auto-labeling policy for sensitivity labels in Microsoft Purview can automatically apply a 'Confidential' label to documents containing PII in SharePoint Online. This policy uses pattern-based detection (e.g., regex for PII like Social Security numbers) to classify and protect content at rest, aligning with the compliance team's requirement to label sensitive data automatically.

Answer

A DLP policy to detect PII

Answer

A trainable classifier for PII

Answer

A retention label policy for PII