SC-900 Practice Exam 66 — 20 Questions

Question 1

A security analyst needs to detect and investigate compromised identities in on-premises Active Directory. They want to monitor for lateral movement, reconnaissance, and credential theft using behavioral analytics. Which Microsoft security solution is designed specifically for this purpose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats like lateral movement, reconnaissance, and credential theft. It uses behavioral analytics and machine learning to profile user and entity behavior, alerting on suspicious activities such as Pass-the-Hash, DCSync, and Kerberoasting without requiring agents on domain controllers.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 2

A security team needs to detect and investigate advanced attacks targeting on-premises Active Directory accounts, such as Pass-the-Hash (PtH) and Golden Ticket attacks. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is specifically designed to detect advanced attacks targeting on-premises Active Directory, such as Pass-the-Hash (PtH) and Golden Ticket attacks. It uses behavioral analytics and machine learning to monitor AD traffic, Kerberos authentication, and NTLM protocol anomalies, identifying lateral movement and privilege escalation attempts that characterize these attacks.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Question 3

A healthcare organization uses digital signatures on electronic medical records to ensure that the records have not been tampered with during transmission. Which security goal is primarily being addressed by this practice?

Accepted Answer

Integrity. Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the electronic medical record, which is then encrypted with the signer's private key. Any tampering with the record during transmission will cause the hash verification to fail, directly ensuring data integrity. This practice does not primarily address confidentiality (which requires encryption) or availability (which focuses on uptime).

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 4

Refer to the exhibit. An administrator created a retention label with the settings shown. What is the behavior of this label when applied to content?

Accepted Answer

It retains content for 7 years and then automatically deletes it.. The retention label is configured with a retention period of 7 years and an action of 'Delete items automatically when the retention period ends.' Since no disposition review is enabled, the content will be automatically deleted after 7 years. This matches option C exactly.

Answer

It retains content for 5 years and then applies a disposition review.

Answer

It marks content as a regulatory record and prevents deletion.

Answer

It retains content indefinitely with no deletion.

Question 5

A company uses Microsoft Sentinel as its SIEM. They need to create a custom analytics rule that runs every hour and queries for failed logins from a specific IP address. Which rule scheduling option should they configure?

Accepted Answer

Run every 1 hour with a 1-hour query period. To ensure the analytics rule captures all failed logins from the specified IP address that occur within the hour, the rule should be scheduled to run every 1 hour with a query period of 1 hour. This means each time the rule runs, it will query logs from the previous hour, covering the time since the last run. Options A and C have mismatched frequencies and query periods, and Option B runs too infrequently for hourly monitoring.

Answer

Run every 5 minutes with a 5-minute query period

Answer

Run every 24 hours with a 24-hour query period

Answer

Run every 1 hour with a 5-minute query period

Question 6

A company wants to enforce conditional access policies that require multifactor authentication (MFA) for all users accessing financial apps from outside the corporate network. Which Microsoft Entra ID license is minimally required to create conditional access policies?

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 (formerly Azure AD Premium P1) is the minimum license required to create and enforce conditional access policies. Conditional access is a premium feature that is not available in Free or Microsoft 365 Business Basic tiers, and while P2 includes additional capabilities like Identity Protection, it is not necessary for basic MFA enforcement based on location.

Answer

Microsoft 365 Business Basic

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID Free

Question 7

A company uses Microsoft Entra ID. They want to enforce that users accessing the payroll application from outside the corporate network must use multifactor authentication and must access the app only from devices that are marked as compliant by Intune. Which Conditional Access component should they use to combine these requirements?

Accepted Answer

Grant controls. B is correct because Grant controls in a Conditional Access policy allow administrators to specify the access requirements that must be satisfied before a user can access a resource. In this scenario, the requirement to enforce both multifactor authentication and device compliance (from Intune) is achieved by configuring the Grant control to 'Require multifactor authentication' and 'Require device to be marked as compliant', combined with the 'Require all the selected controls' option. This ensures that both conditions must be met simultaneously for access to the payroll application from outside the corporate network.

Answer

Conditions

Answer

Sign-in risk policy

Answer

Session controls

Question 8

Your organization is implementing Microsoft 365 and needs to prevent sensitive data from being copied to USB drives. Which Microsoft Purview solution should you configure?

Accepted Answer

Endpoint data loss prevention (Endpoint DLP). Endpoint DLP (Data Loss Prevention) monitors and controls actions users take on devices, such as copying sensitive data to USB drives. It enforces policies directly on Windows, macOS, and other endpoints to block unauthorized transfers, making it the correct solution for preventing data exfiltration via removable media.

Answer

Audit logs

Answer

Communication Compliance

Answer

Sensitivity labels

Question 9

A company stores sensitive financial data on on-premises Windows Server file shares. The compliance team needs to automatically discover files containing credit card numbers, classify them by applying a sensitivity label, and optionally enforce protection actions like encryption. They want this solution to run on the on-premises file servers without needing to manually scan. Which Microsoft Purview solution should the compliance team deploy?

Accepted Answer

Microsoft Purview Information Protection scanner. The Microsoft Purview Information Protection scanner is designed to run on on-premises Windows Server file shares to automatically discover, classify, and protect sensitive data. It uses content inspection to identify patterns like credit card numbers, applies sensitivity labels, and can enforce encryption without requiring manual scanning.

Answer

Microsoft Purview Data Loss Prevention (DLP) for on-premises

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Question 10

A multinational company uses a hybrid infrastructure with on-premises Active Directory and Azure resources. They have deployed Microsoft Defender for Cloud to protect their Azure workloads. They now want to extend threat detection to their on-premises Active Directory by collecting security events from domain controllers to detect attacks like Golden Ticket, DCSync, and malicious Kerberos activity. The solution should integrate with Microsoft Sentinel for automated response. Which security solution should they deploy on the on-premises domain controllers?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory signals, including security events from domain controllers, to detect advanced identity-based attacks such as Golden Ticket, DCSync, and malicious Kerberos activity. MDI integrates natively with Microsoft Sentinel to enable automated response workflows, fulfilling the requirement for extending threat detection to on-premises AD.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Question 11

Your organization uses Microsoft Entra ID. You need to grant external partners limited access to a SharePoint site for 30 days. After 30 days, access should automatically expire. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra entitlement management. Microsoft Entra entitlement management allows you to create access packages that grant external users time-limited access to resources like SharePoint sites. By configuring an access package with a 30-day expiration policy, access is automatically revoked when the policy expires, meeting the requirement exactly.

Answer

Microsoft Entra access reviews

Answer

Microsoft Entra B2B guest user accounts

Answer

Microsoft Entra Conditional Access

Question 12

Your organization uses Microsoft 365 and wants to classify and protect documents based on their content, such as credit card numbers. Which Microsoft Purview feature automatically classifies content based on sensitive information types?

Accepted Answer

Auto-labeling with sensitivity labels. Auto-labeling with sensitivity labels in Microsoft Purview can automatically classify and protect documents by detecting sensitive information types (e.g., credit card numbers) using built-in or custom data classifiers. This feature applies the appropriate sensitivity label based on content matches, enabling consistent protection across Microsoft 365 services.

Answer

Data Loss Prevention policy

Answer

Unified labeling client

Answer

eDiscovery

Question 13

A multinational corporation needs to restrict data sharing in Microsoft Teams to comply with regional regulations. Users must not be able to share files with external domains from specific departments. What should the administrator configure?

Accepted Answer

Sensitivity labels with container management in Microsoft Purview. Sensitivity labels with container management in Microsoft Purview allow administrators to configure external sharing restrictions for Microsoft Teams, SharePoint, and Groups. By applying a sensitivity label to a team, you can block external sharing for specific departments, ensuring compliance with regional regulations. This is the correct solution because it directly controls sharing behavior at the container level based on the label's settings.

Answer

Microsoft Intune device compliance policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Data Loss Prevention (DLP) policy in Microsoft Purview

Question 14

A company must retain all customer service emails in Exchange Online for 7 years for regulatory purposes. After 7 years, the emails must be automatically deleted. Additionally, employees must not be able to permanently delete these emails before the retention period ends. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Lifecycle Management (retention policies and labels). Data Lifecycle Management (DLM) via retention policies and labels in Microsoft Purview is the correct solution because it allows you to define a retention period of 7 years for Exchange Online emails and then automatically delete them. Additionally, DLM retention policies prevent users from permanently deleting emails before the retention period ends by locking the items in a 'preservation hold' state, ensuring regulatory compliance.

Answer

Communication Compliance

Answer

eDiscovery (Premium)

Answer

Data Loss Prevention (DLP)

Question 15

Which THREE of the following are features of Microsoft Entra ID Protection?

Accepted Answer

Ability to define risk-based Conditional Access policies.. Microsoft Entra ID Protection provides risk detection signals that can be integrated into Conditional Access policies, enabling administrators to automatically enforce controls such as requiring multi-factor authentication or blocking access based on user or sign-in risk levels. This allows organizations to respond dynamically to detected threats without manual intervention.

Answer

Automatically notify users when their password is about to expire.

Answer

Just-in-time privileged role activation.

Question 16

A security team wants to detect when a user downloads an unusually large number of files from a third-party cloud storage app (e.g., Box) after logging in from an unfamiliar location. They also want to automatically suspend the user's account if such behavior is detected. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it provides Cloud Access Security Broker (CASB) capabilities, including anomaly detection for user behavior across third-party cloud apps like Box. It can detect activities such as an unusually large number of file downloads from an unfamiliar location using its built-in behavioral analytics and then automatically apply a governance action, such as suspending the user's account, via policy-driven automated responses.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Endpoint

Question 17

A company wants to allow employees to use their corporate Microsoft Entra ID credentials to sign in to third-party SaaS applications like Salesforce and ServiceNow. Which feature provides this capability?

Accepted Answer

Microsoft Entra federation with SaaS applications. Microsoft Entra federation with SaaS applications (Option A) enables single sign-on (SSO) by establishing a trust relationship between Microsoft Entra ID and third-party SaaS apps like Salesforce and ServiceNow. This allows users to authenticate using their corporate Entra ID credentials via federation protocols such as SAML 2.0 or OpenID Connect, eliminating the need for separate credentials.

Answer

Microsoft Entra B2B collaboration

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Question 18

A multinational organization must comply with GDPR and local data residency requirements. The compliance team needs to ensure that personal data is not stored in regions outside the permitted locations. Which Microsoft Purview capability should they use to discover and map personal data across the organization's data estate?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct capability because it provides automated data discovery, classification, and lineage across hybrid and multi-cloud data estates. It enables organizations to scan, map, and catalog personal data, including GDPR-sensitive attributes, and enforce data residency policies by identifying where data is stored. This directly supports the compliance team's need to discover and map personal data across permitted locations.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Audit

Question 19

Your organization uses Microsoft Defender for Cloud to protect Azure virtual machines. You need to ensure that critical vulnerabilities identified on the VMs are automatically remediated using a just-in-time patching mechanism. What should you configure?

Accepted Answer

Enable Azure Update Manager. Azure Update Manager is a unified service that provides managed update capabilities for Azure VMs and Arc-enabled servers. It enables just-in-time patching by allowing you to schedule and apply critical updates as needed, automatically remediating vulnerabilities. In contrast, Adaptive application controls and just-in-time VM access in Defender for Cloud are security controls that reduce attack surface but do not apply patches. Intune is for endpoint management, and Azure Automation Update Management is a legacy solution being replaced by Azure Update Manager.

Answer

Enable adaptive application controls and just-in-time VM access in Defender for Cloud

Answer

Deploy Microsoft Intune for update management

Answer

Configure Azure Automation Update Management

Question 20

You are reviewing a Microsoft Purview DLP policy rule represented in JSON. What is the effect of this rule?

Accepted Answer

It blocks the sending of an email if it contains 10 or more credit card numbers with high confidence. The JSON rule defines a condition where the DLP policy blocks email transmission when the count of credit card numbers detected with high confidence meets or exceeds 10. The 'BlockAccess' action in the rule enforces this by preventing the email from being sent, and the 'NotifyUser' action with 'NotifyOnly' set to false ensures the user is notified of the block. This matches the behavior of a Microsoft Purview DLP policy that uses a threshold-based condition with high confidence to block sensitive data sharing.

Answer

It notifies the user when a single credit card number is detected in email

Answer

It triggers a policy tip when a single credit card number is detected

Answer

It blocks access to a SharePoint site containing credit card numbers