SC-900 Practice Exam 65 — 20 Questions

Question 1

An organization implements a policy where users must provide two forms of verification, such as a password and a text message code, to access the corporate network. Which security concept does this demonstrate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Multifactor authentication. Multifactor authentication (MFA) requires two or more distinct factors (e.g., something you know like a password, and something you have like a text message code) to verify identity. This is correct because the policy explicitly demands two forms of verification, which is the defining characteristic of MFA, not just single-factor authentication.

Answer

Authorization

Answer

Authentication

Answer

Accounting

Question 2

An organization implements a security policy where users must authenticate using a smart card and PIN. After successful authentication, the system checks whether the user's device is managed by the organization and complies with security baselines. If the device is compliant, the user is granted access to the corporate network. If not, access is denied. This approach most directly reflects which security model?

Accepted Answer

Zero Trust. The scenario explicitly enforces 'never trust, always verify' by requiring authentication (smart card + PIN) and then validating device compliance before granting network access. This directly aligns with the Zero Trust model's core principle of conditional access based on identity and device health, rather than implicit trust from network location.

Answer

Defense in depth

Answer

CIA triad

Answer

Least privilege

Question 3

Your organization wants to enable passwordless authentication for users. Which Microsoft Entra ID feature should you use?

Accepted Answer

Passwordless authentication methods. Passwordless authentication methods is the correct feature because it is the specific Microsoft Entra ID capability that allows users to sign in without a password, using methods such as Windows Hello for Business, the Microsoft Authenticator app, FIDO2 security keys, or phone sign-in. This directly enables the organization's goal of passwordless authentication.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 4

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to improve their secure score. What should they do?

Accepted Answer

Implement the security recommendations. The secure score is calculated based on the implementation of security recommendations provided by Microsoft Defender for Cloud. By implementing these recommendations, the company improves their security posture and increases their secure score. Option B is incorrect because simply removing virtual machines does not address underlying security issues and may not improve the score. Option C is incorrect because increasing the Azure budget does not directly impact the secure score; the score depends on security configurations, not spending. Option D is incorrect because disabling Microsoft Defender for Cloud would remove the security assessments and recommendations, leading to a lower or unavailable secure score.

Answer

Remove all virtual machines from the subscription

Answer

Increase the Azure budget

Answer

Disable Microsoft Defender for Cloud

Question 5

A financial services organization needs to automatically classify and protect sensitive documents containing credit card information in SharePoint Online and OneDrive for Business. They want a purple-colored label to be applied automatically when the document is saved, and the document should be encrypted with a predefined template that restricts editing to internal users only. Which Microsoft Purview solution should they configure?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling in Microsoft Purview can automatically apply a purple-colored label to documents containing credit card information when saved in SharePoint Online or OneDrive for Business. This label can be configured with encryption using a predefined template that restricts editing to internal users only, meeting the organization's classification and protection requirements.

Answer

Data Loss Prevention (DLP) policies

Answer

Data Lifecycle Management (retention labels)

Answer

Audit (Unified Auditing)

Question 6

A company uses a third-party SaaS project management application. The security team wants to monitor and control user sessions when employees access the application from personal, unmanaged devices. Specifically, they want to block the download of files to local drives and display a warning message to the user if they attempt to download. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) is the correct solution because it provides session-level controls via Conditional Access App Control. This allows the security team to monitor and control user sessions in real-time, including blocking file downloads to unmanaged devices and displaying custom warning messages, by proxying the SaaS application traffic through Defender for Cloud Apps.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Question 7

According to the Zero Trust security model, which principle assumes that a breach has already occurred and therefore requires segmenting access and monitoring for lateral movement?

Accepted Answer

Assume breach. The 'Assume breach' principle of the Zero Trust security model explicitly operates under the mindset that a breach has already occurred or is inevitable. This drives the need for segmenting access (e.g., micro-segmentation using network policies or Azure Virtual Network security groups) and continuous monitoring for lateral movement (e.g., using Microsoft Defender for Identity to detect pass-the-hash or Kerberos ticket attacks).

Answer

Verify explicitly

Answer

Use least privilege

Answer

Trust but verify

Question 8

Refer to the exhibit. A Microsoft Purview DLP policy is configured as shown. What will happen when a user tries to email an external recipient a document containing a credit card number?

Accepted Answer

The email will be blocked and the user will receive a notification. The DLP policy is configured with the action 'Block' and the user notification is enabled. When a user attempts to email a document containing a credit card number to an external recipient, the policy blocks the email from being sent and displays a notification to the user explaining the policy violation. This is the default behavior for a 'Block' action with user notification in Microsoft Purview DLP.

Answer

The email will be sent but the attachment will be removed

Answer

The email will be delivered and the admin will be alerted

Answer

The email will be sent and the event will be logged for audit

Question 9

A company has deployed Microsoft Defender for Identity and wants to detect pass-the-hash attacks in real time. Which alert type should they monitor?

Accepted Answer

Suspected Pass-the-Hash attack. Microsoft Defender for Identity specifically detects pass-the-hash attacks by monitoring anomalous NTLM authentication patterns, such as the use of hashed credentials from one machine to authenticate to another. The 'Suspected Pass-the-Hash attack' alert is triggered when Defender for Identity identifies a hash being reused across multiple devices in a way that indicates lateral movement, which is the core behavior of a pass-the-hash attack.

Answer

Suspected Kerberoasting attack

Answer

Suspected Brute Force attack

Answer

Suspected Golden Ticket attack

Question 10

Your organization uses Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from a single IP address within 5 minutes. Which rule type should you use?

Accepted Answer

Scheduled query rule. A scheduled query rule is correct because it allows you to define a KQL query that counts failed sign-ins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type supports custom aggregation and threshold-based alerting, which is exactly what the requirement specifies.

Answer

Fusion rule

Answer

Near-real-time (NRT) rule

Answer

ML Behavior Analytics rule

Question 11

You are the identity architect for a global organization with 100,000 users across 50 countries. The company uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. Recently, the security team identified that several compromised user accounts were used to exfiltrate data from a cloud storage app. The CISO wants to implement a solution that detects anomalous behavior (e.g., impossible travel, mass download) and automatically blocks the user session when such behavior is detected. The solution must also provide the ability to investigate and remediate after the fact. Which Microsoft Entra feature should you use in conjunction with Defender for Cloud Apps to meet these requirements?

Accepted Answer

Microsoft Entra Conditional Access session controls with Defender for Cloud Apps integration. Microsoft Entra Conditional Access session controls integrate directly with Defender for Cloud Apps to enable real-time session monitoring and blocking. When anomalous behaviors like impossible travel or mass downloads are detected by Defender for Cloud Apps, the session control can automatically block the user session, while also providing full investigation and remediation capabilities through the Defender for Cloud Apps portal. This meets the CISO's requirement for both automated blocking and post-incident analysis.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra access reviews

Question 12

A company uses Microsoft Purview to map their data estate. They need to classify data stored in Azure SQL Database and Amazon S3. What should they use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct choice because it provides automated data discovery, classification, and lineage across hybrid and multi-cloud environments, including Azure SQL Database and Amazon S3. It uses built-in scanners and classifiers to scan structured and unstructured data sources, mapping sensitive data types such as PII or financial information. This directly fulfills the requirement to classify data across both Azure and AWS platforms.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 13

Your organization uses Microsoft Purview to manage data classification. You need to ensure that sensitive data containing social security numbers is automatically labeled when stored in SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy for sensitivity labels. D is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to files containing sensitive data, such as social security numbers, when stored in SharePoint Online. This uses pattern-based detection to classify and label content at rest without manual intervention.

Answer

Use the data classification dashboard in Microsoft Purview

Answer

Create a retention label policy

Answer

Configure a data loss prevention (DLP) policy

Question 14

A financial services company uses Microsoft 365 and must prevent employees from emailing credit card numbers in plain text. The compliance team wants to automatically detect credit card numbers in outgoing emails and block them before delivery. They also want to allow users to override the block with a business justification. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data, such as credit card numbers, in transit (e.g., email) and enforce actions like blocking the message. DLP policies can be configured with user override options that require a business justification, meeting the compliance team's requirement for automatic detection and conditional blocking.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Insider Risk Management

Question 15

Which THREE are features of Microsoft Entra ID? (Choose three.)

Accepted Answer

Multifactor authentication. Microsoft Entra ID provides multifactor authentication (MFA) as a core identity security feature, requiring users to verify their identity using two or more methods such as a password plus a phone call or mobile app notification. This significantly reduces the risk of credential theft and unauthorized access.

Answer

Firewall management

Answer

Anti-malware protection

Question 16

A security architect is explaining the Zero Trust model to the board. The architect emphasizes that the network perimeter can no longer be considered a safe zone. Which statement best describes the modern primary security perimeter according to Zero Trust principles?

Accepted Answer

The identity of the user and device. In the Zero Trust model, the primary security perimeter is the identity of the user and device, not the network location. This is because Zero Trust assumes breach and requires explicit verification for every access request, regardless of whether it originates from inside or outside the corporate network. By treating identity as the new control plane, organizations enforce least-privilege access and continuous authentication, making the user and device identity the critical trust boundary.

Answer

The corporate network firewall and VPN

Answer

The physical on-premises data center

Answer

The endpoint antivirus and anti-malware solution

Question 17

A financial services firm must monitor employee communications (email and Microsoft Teams) for potential insider trading. The compliance team wants to automatically detect messages containing specific financial keywords (e.g., 'non-public material information') and flag them for review. They also need to be able to remove violating messages from recipients' inboxes. Which Microsoft Purview solution should they configure?

Accepted Answer

Communication Compliance. Communication Compliance is the correct solution because it is specifically designed to detect and remediate inappropriate communications, including insider trading signals. It can automatically scan emails and Microsoft Teams messages for configurable sensitive information types (e.g., 'non-public material information') and enforce actions like removing violating messages from recipients' inboxes.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

Audit

Question 18

A compliance administrator creates the DLP policy shown in the exhibit. When a user shares a document containing a credit card number with an external partner, what is the expected outcome?

Accepted Answer

The document is blocked from being shared externally, and the user receives a notification.. The DLP policy is configured with an action to block external sharing and notify the user when a credit card number is detected. When the user shares the document externally, the policy triggers this action, preventing the share and sending a notification to the user. This matches option A exactly.

Answer

The document is automatically deleted.

Answer

A sensitivity label is automatically applied.

Answer

The document is blocked from being shared both internally and externally.

Question 19

A user reports that they cannot sign in to Microsoft Entra ID because they forgot their password. Which Microsoft Entra ID feature allows them to reset their password without contacting IT support?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own forgotten passwords without needing to contact IT support. It works by verifying the user's identity through pre-configured authentication methods (e.g., phone, email, security questions) before permitting the password change. This directly addresses the user's inability to sign in due to a forgotten password.

Answer

Microsoft Entra ID Connect

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra ID Domain Services

Question 20

A security team wants to receive a unified security posture assessment for their hybrid workloads including Azure VMs, on-premises SQL servers, and AWS EC2 instances. They need to get actionable recommendations to harden configurations and improve their overall security score. Which Microsoft security solution provides this capability?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a unified security posture assessment across hybrid and multi-cloud workloads, including Azure VMs, on-premises SQL servers, and AWS EC2 instances. It continuously assesses configurations against security baselines (e.g., Azure Security Benchmark, CIS controls) and generates a secure score with actionable recommendations to harden resources. This aligns directly with the requirement for a single dashboard covering all listed workload types.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps