SC-900 Practice Exam 66 — 20 Questions

Question 1

An organization stores sensitive customer data in a cloud database. The security team uses encryption to protect the data while it is stored and while it is transmitted. They also implement role-based access control to ensure only authorized users can modify the data. Which two security principles are primarily being upheld by these actions?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Confidentiality and integrity. Encryption at rest and in transit directly protects confidentiality by preventing unauthorized access to sensitive data. Role-based access control (RBAC) ensures only authorized users can modify data, which upholds integrity by preventing unauthorized or accidental changes. Availability, which concerns system uptime and accessibility, is not primarily addressed by these measures.

Answer

Availability and integrity

Answer

Confidentiality and availability

Answer

Privacy and accountability

Question 2

A company uses Microsoft Teams and wants to ensure that messages containing offensive language are flagged for review. Which Microsoft Purview solution should be used?

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is designed to detect and flag messages containing offensive language, harassment, or other policy violations in Microsoft Teams, Exchange Online, and Yammer. It uses customizable policies and machine learning classifiers to automatically review communications and route flagged items for human review, making it the correct solution for this requirement.

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Audit

Question 3

Which TWO of the following are features of Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Cloud Workload Protection Platform (CWPP). Microsoft Defender for Cloud is a Cloud Workload Protection Platform (CWPP) that provides unified security management and advanced threat protection for workloads running in Azure, on-premises, and other clouds. It also includes Cloud Security Posture Management (CSPM) capabilities, which continuously assess your environment against security benchmarks (e.g., CIS, NIST) and provide actionable recommendations to improve your security posture.

Answer

Data classification and labeling

Answer

Security Information and Event Management (SIEM)

Answer

Mobile Threat Defense (MTD)

Question 4

Which THREE actions can Microsoft Sentinel perform as part of automated incident response using playbooks?

Accepted Answer

Block an IP address on a firewall. Microsoft Sentinel playbooks are built on Azure Logic Apps, so they can call connectors and REST APIs to take remediation and ticketing actions automatically. Option A is correct because a playbook can invoke a firewall connector or API to block a malicious IP address identified in an incident. Option C is correct because a playbook can call Microsoft Entra ID or Microsoft Graph actions to reset a compromised user's password as part of containment. Option D is correct because a playbook can use the ServiceNow connector to create an incident ticket, integrating Sentinel with ITSM workflows. Option B is not a typical Sentinel playbook action, since installing anti-malware on a device is an endpoint-management task handled by tools such as Microsoft Defender for Endpoint or Intune. Option E, while technically possible through Azure Resource Manager or Logic Apps, is not one of the three most common Sentinel playbook response actions: blocking an IP address, resetting a user password, and creating a ServiceNow ticket.

Answer

Install anti-malware software on a device

Answer

Modify a network security group rule

Question 5

Your organization has deployed Microsoft Intune for mobile device management. You need to ensure that users can only access corporate resources from devices that are compliant with your security policies. Which policy type should you configure?

Accepted Answer

A Conditional Access policy. A Conditional Access policy is the correct choice because it enforces access controls at the identity level, evaluating device compliance status before granting access to corporate resources. When combined with Intune compliance policies, Conditional Access can block or allow access based on real-time device health checks, ensuring only compliant devices can connect.

Answer

An app protection policy

Answer

A compliance policy

Answer

A configuration policy

Question 6

A company is subject to a legal investigation and must preserve all email communications related to the case for an indefinite period, even if users try to delete them. The compliance officer needs a solution that can place a hold on specific user mailboxes and prevent any permanent deletion of relevant content. Which Microsoft Purview feature should be used?

Accepted Answer

Litigation hold. Litigation hold is the correct feature because it places a hold on an entire mailbox, preserving all content including deleted items and versions, and prevents permanent deletion by users or automated processes. Unlike retention labels or policies, litigation hold applies to the entire mailbox and is designed specifically for legal investigations where indefinite preservation is required.

Answer

Retention labels

Answer

Data loss prevention

Answer

Compliance Manager

Question 7

Your organization, Fabrikam Inc., uses Microsoft 365 and has Microsoft Purview licensed. You need to implement a compliance solution to monitor and prevent the sharing of confidential financial data via email. Specifically, you want to: (1) Detect when users send emails containing financial account numbers (e.g., credit card numbers) to external recipients. (2) Automatically block such emails with a policy tip notifying the sender. (3) Allow the sender to override the block if they provide a business justification. (4) Create a report of all blocked emails for compliance review. Which Microsoft Purview feature should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information in emails and apply actions such as block with policy tip and allow override with justification. DLP also provides incident reports. Option A (Communication Compliance) is for communication monitoring, not data protection. Option B (Message Encryption) is for email encryption, not blocking. Option D (Data Lifecycle Management) is for retention, not real-time blocking.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Message Encryption

Answer

Microsoft Purview Data Lifecycle Management

Question 8

A company uses Microsoft 365 and several third-party SaaS apps. The security team wants to detect when a user signs in from a remote location that is significantly far from their typical sign-in location within a very short time, indicating possible account compromise. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) provides the 'impossible travel' detection capability, which analyzes sign-in events across both Microsoft 365 and third-party SaaS apps. It uses machine learning to establish a baseline of a user's typical sign-in locations and then alerts when two sign-ins occur from geographically distant locations within a time frame that makes physical travel impossible, indicating a potential account compromise.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint

Question 9

You need to implement a solution that allows users to access cloud applications without entering a password, using Windows Hello for Business. Which Microsoft Entra feature integrates with Windows Hello for Business?

Accepted Answer

Microsoft Entra ID. Windows Hello for Business integrates with Microsoft Entra ID (formerly Azure AD) to enable passwordless authentication. When a user enrolls a device with Windows Hello for Business, the biometric or PIN credential is bound to the device's TPM and linked to the user's identity in Microsoft Entra ID, allowing seamless access to cloud applications without a password.

Answer

Conditional Access

Answer

FIDO2 security keys

Answer

Microsoft Authenticator

Question 10

Which TWO of the following are capabilities of Microsoft Entra ID?

Accepted Answer

Identity and access management for cloud applications.. Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management (IAM) service. It provides authentication and authorization for cloud applications, including support for single sign-on (SSO) to thousands of pre-integrated SaaS applications like Salesforce, Office 365, and Workday. These are core IAM capabilities, not security functions like email filtering or network firewall management.

Answer

Email filtering and anti-malware protection.

Answer

Encryption of data at rest in Azure Storage.

Answer

Network firewall management.

Question 11

Your company uses Microsoft Purview Information Protection to classify sensitive data. A user reports that when they try to share a document containing a credit card number via email, the email is blocked. Which Purview feature is most likely causing this behavior?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is specifically designed to detect and block sensitive data—such as credit card numbers—from being shared via email. When a user attempts to send a document containing a credit card number, the DLP policy scans the email content and attachments, matches the credit card pattern (e.g., using the predefined Sensitive Info Type for credit card numbers), and enforces an action like blocking the message. This is the most likely cause of the email being blocked.

Answer

Audit log

Answer

Sensitivity label

Answer

Retention label

Question 12

A multinational corporation wants to detect scenarios where employees in the finance department are accessing and downloading customer credit card data from a CRM system and then emailing that data to personal accounts. The security team needs to define policies that identify this pattern of activity, analyze user behavior over time (e.g., building a user's baseline), and automatically escalate high-risk incidents for investigation. Which Microsoft Purview solution should they deploy?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is designed to detect risky user activities that violate organizational policies, such as accessing sensitive data and exfiltrating it via email. It uses machine learning to establish user baselines over time and automatically escalates high-risk incidents for investigation, directly matching the scenario's requirements.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery (Premium)

Question 13

A company uses Microsoft Intune to manage devices. They want to ensure that only devices with a specific minimum operating system version can access corporate email. What should they configure?

Accepted Answer

Create a device compliance policy specifying minimum OS version. To enforce a minimum operating system version for accessing corporate email, you need a device compliance policy in Microsoft Intune. This policy evaluates device attributes like OS version and marks devices as compliant or non-compliant. When combined with a Conditional Access policy in Entra ID, non-compliant devices can be blocked from accessing corporate resources, including email.

Answer

Deploy an app protection policy for the email app

Answer

Create a device configuration profile for OS settings

Answer

Configure a conditional access policy in Entra ID to block non-compliant devices

Question 14

Refer to the exhibit. A sensitivity label is configured as shown. Which statement about the label's behavior is accurate?

Accepted Answer

When applied, users can choose who can access the document and what permissions they have.. The exhibit shows a sensitivity label configured with 'Let users assign permissions' under 'User-defined permissions' in Azure Information Protection. This setting allows end users to define custom permissions (e.g., who can read, edit, or forward) when applying the label, rather than using a fixed template or automatic encryption.

Answer

The label disables encryption and only adds a header and footer.

Answer

The label automatically encrypts the document with a predefined template.

Answer

The label does not apply any protection; it only adds visual markings.

Question 15

A company must ensure that sensitive data in SharePoint Online is automatically classified and protected. They want to use built-in Microsoft Purview capabilities. Which feature should they implement?

Accepted Answer

Sensitivity labels. Sensitivity labels in Microsoft Purview can be configured with auto-labeling policies to automatically detect sensitive information (e.g., credit card numbers, PII) in SharePoint Online content. Once detected, the policy automatically applies the appropriate sensitivity label, which then enforces predefined protection actions such as encryption, access restrictions, and visual markings. This directly fulfills the requirement for automatic classification and protection of sensitive data.

Answer

Audit logs

Answer

Data Loss Prevention policies

Answer

Retention policies

Question 16

Which TWO of the following are benefits of using Microsoft Entra ID Conditional Access? (Choose two.)

Accepted Answer

Block access from locations that are not trusted. Conditional Access in Microsoft Entra ID is a policy engine that evaluates signals (user, device, location, app, and risk) to make access decisions, so option B is correct because you can create a named-location condition and block or deny access when a sign-in originates from an untrusted or unknown location. Option D is also correct because Conditional Access can use sign-in and user risk signals from Entra ID Protection as conditions to require multi-factor authentication (or block access) when risk is elevated. Option A is not a Conditional Access benefit; self-service password reset is a separate Entra ID feature configured under Authentication methods. Option C is not provided by Conditional Access; just-in-time privileged access is delivered by Privileged Identity Management (PIM), not by Conditional Access policies. Option E is incorrect because Conditional Access complements authentication and cannot remove the need for passwords or other credentials entirely.

Answer

Allow users to reset their own passwords

Answer

Automatically grant temporary admin access

Answer

Eliminate the need for passwords entirely

Question 17

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that when a user's on-premises account is disabled, their cloud account is automatically disabled within 5 minutes. Which configuration should you use?

Accepted Answer

Microsoft Entra Connect with directory sync configured for 5-minute sync interval. Microsoft Entra Connect with directory synchronization configured for a 5-minute sync interval ensures that changes made to on-premises Active Directory (such as disabling a user account) are replicated to Microsoft Entra ID within that interval. This meets the requirement of automatically disabling the cloud account within 5 minutes of the on-premises change.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Conditional Access with session controls

Answer

Microsoft Entra Connect Health

Question 18

Your organization uses Microsoft Defender for Cloud Apps. Security team wants to be alerted when a user accesses a cloud app from a risky IP address. Which solution should you use to create a policy that triggers an alert based on this activity?

Accepted Answer

Create an activity policy.. Microsoft Defender for Cloud Apps activity policies are designed to monitor user activity across cloud apps and trigger alerts, governance actions, or automated responses based on conditions like risky IP addresses, impossible travel, or suspicious download volumes. To alert when a user accesses a cloud app from a risky IP, you create an activity policy with the 'IP address' or 'risky IP' filter condition.

Answer

Create a session policy.

Answer

Create an app discovery policy.

Answer

Create an access policy.

Question 19

Which TWO features are part of Microsoft Defender XDR?

Accepted Answer

Automated investigation and response. Option A is correct because Automated investigation and response (AIR) is a core Microsoft Defender XDR capability that automatically investigates alerts, correlates evidence across endpoints, identities, email, and cloud apps, and applies remediation actions. Option E is correct because incident management across workloads is the defining feature of Defender XDR, which correlates alerts from Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps into unified incidents in the Microsoft 365 Defender portal. Option B is incorrect because Cloud app discovery is a Microsoft Defender for Cloud Apps (formerly MCAS) capability, not a Defender XDR feature itself. Option C is incorrect because Endpoint data loss prevention is a Microsoft Purview capability, not part of Defender XDR. Option D is incorrect because Identity Protection is a Microsoft Entra ID feature, distinct from Defender for Identity which is the Defender XDR identity workload.

Answer

Cloud app discovery

Answer

Endpoint data loss prevention

Answer

Identity Protection

Question 20

Your organization uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on several endpoints. Which feature allows you to search for indicators of compromise (IOCs) across all endpoints?

Accepted Answer

Advanced hunting. Advanced hunting in Microsoft Defender for Endpoint is a query-based threat hunting tool that allows security analysts to search for indicators of compromise (IOCs) across all endpoints using the Kusto Query Language (KQL). It provides access to raw, schema-based tables (e.g., DeviceEvents, DeviceFileEvents, DeviceNetworkEvents) for up to 30 days of historical data, enabling proactive detection of malware outbreak patterns across the entire fleet.

Answer

Incidents and alerts

Answer

Threat analytics

Answer

Device inventory