SC-900 Practice Exam 67 — 20 Questions

Question 1

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to ensure that only managed compliant devices can access corporate email via Outlook mobile app. What is the most efficient approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy that requires a compliant device and create an app protection policy for Outlook. A Conditional Access policy requiring a compliant device ensures only managed devices can access corporate email, while an app protection policy (APP) adds data protection for the Outlook app, preventing data leakage. Option A is wrong because an app protection policy alone does not enforce device compliance; it only protects data within the app. Option B is wrong because device compliance plus Conditional Access without an app protection policy may allow data leakage from the app. Option C is wrong because MFA only provides authentication, not device management or data protection.

Answer

Create an app protection policy in Microsoft Intune for Outlook and assign it to all users

Answer

Enforce device compliance policies in Intune and create a Conditional Access policy that requires compliant device

Answer

Create a Conditional Access policy that requires MFA for the Outlook app

Question 2

Your organization is planning to deploy Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that logs from your network proxy servers are ingested. Which method should you use to connect the logs?

Accepted Answer

Log collector. Microsoft Defender for Cloud Apps uses log collectors to ingest traffic logs from network proxy servers for shadow IT discovery. The log collector is a dedicated component that parses and uploads proxy logs (e.g., from Squid, Blue Coat, or Zscaler) to Defender for Cloud Apps for analysis. This method is specifically designed for log-based discovery of unsanctioned cloud app usage.

Answer

Conditional Access App Control

Answer

Microsoft Sentinel data connector

Answer

App connector API

Question 3

A company implements multiple layers of security controls including a firewall, an intrusion detection system (IDS), antivirus software on endpoints, and regular security awareness training for employees. This approach is an example of which security concept?

Accepted Answer

Defense in depth. Defense in depth is the correct answer because the company is implementing multiple layers of security controls (firewall, IDS, antivirus, and security awareness training) to protect assets. This layered approach ensures that if one control fails, another control is in place to mitigate the threat, which is the core principle of defense in depth.

Answer

Zero Trust

Answer

Least privilege

Answer

Shared responsibility

Question 4

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. You need to ensure that when a user attempts to share a document containing a credit card number via email, the email is blocked and the user receives a policy tip. Which action should you configure in the DLP policy?

Accepted Answer

Block with user notification. In Microsoft Purview DLP, the 'Block with user notification' action sends a policy tip and blocks the email. 'Block override' allows override with justification. 'Audit only' logs without blocking. 'Notify user' sends an email but does not block. Option C is correct because it blocks the email and shows a policy tip.

Answer

Notify user

Answer

Audit only

Answer

Block override

Question 5

Your company is implementing a zero-trust security model. Which principle requires verifying every access request as though it originates from an untrusted network, even if the request comes from within the corporate network?

Accepted Answer

Explicit verification. 'Explicit verification' is the zero-trust principle that requires verifying every access request as though it originates from an untrusted network, regardless of the source. Option A is incorrect because 'Least privilege' limits access rights but does not inherently treat all requests as untrusted. Option B is incorrect because 'Trust but verify' is a traditional security model that trusts internal networks, contradicting zero-trust. Option D is incorrect because 'Assume breach' focuses on minimizing the impact of a breach, not on verifying every access request.

Answer

Least privilege

Answer

Trust but verify

Answer

Assume breach

Question 6

A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to emails containing credit card numbers. Which policy should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview are specifically designed to automatically apply sensitivity labels based on conditions, including the detection of sensitive information types like credit card numbers. Option B is incorrect because retention policies manage the lifecycle of data (how long it's kept or deleted), not the automatic application of sensitivity labels. Option C is incorrect because sensitivity label policies are used to publish sensitivity labels, making them available for manual application by users or for use by other policies, but they do not automatically apply labels based on content detection. Option D is incorrect because DLP policies are primarily used to detect sensitive information and enforce actions to prevent its unauthorized sharing or use, rather than automatically applying sensitivity labels as their primary function.

Answer

Retention policy

Answer

Sensitivity label policy

Answer

Data loss prevention (DLP) policy

Question 7

Your company uses Microsoft Defender for Cloud Apps. You notice that a user is downloading large volumes of data from a sanctioned cloud app that exceeds the normal pattern. Which action should you take to automatically block this activity?

Accepted Answer

Create a session policy to monitor and control downloads. You can create a session policy in Microsoft Defender for Cloud Apps that monitors user behavior and can block or restrict downloads that exceed a predefined threshold. Option B is wrong because a cloud discovery policy is used to discover shadow IT, not to block downloads. Option C is wrong because Microsoft Purview DLP policies are for data loss prevention based on content classification, not for blocking based on volume of downloads. Option D is wrong because blocking the entire app is too restrictive; a session policy allows targeted action on specific risky activities.

Answer

Configure a cloud discovery policy

Answer

Create a Microsoft Purview DLP policy

Answer

Block the app in Defender for Cloud Apps

Question 8

A company wants to implement a Zero Trust security model. Which TWO of the following are core principles of Zero Trust?

Accepted Answer

Verify explicitly. Options B and E are correct. Zero Trust core principles are: verify explicitly (B), use least privilege access (E), and assume breach. Option A is incorrect because Zero Trust does not trust based on network location. Option C is incorrect because perimeter-based security is not a Zero Trust principle. Option D is incorrect because Zero Trust rejects implicit trust for internal users.

Answer

Trust based on network location

Answer

Perimeter-based security

Answer

Implicit trust for internal users

Question 9

Which TWO of the following are principles of the Zero Trust security model? (Select two.)

Accepted Answer

Verify explicitly. The correct principles of Zero Trust are 'Verify explicitly' and 'Use least privilege access' (or 'Least privilege access'). Therefore, options A and E are correct. Option B (Perimeter-based security) is a traditional security model, opposite of Zero Trust. Option C (Implicit trust) and D (Trust but verify) are not part of Zero Trust; Zero Trust assumes no implicit trust and uses 'verify explicitly' instead.

Answer

Perimeter-based security

Answer

Implicit trust

Answer

Trust but verify

Question 10

Your organization wants to enforce multi-factor authentication (MFA) for all users accessing cloud applications. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Create a Conditional Access policy. Conditional Access policies allow you to require MFA based on conditions like user, location, or device. Option A is incorrect because Privileged Identity Management (PIM) manages role activation and assignment, not MFA enforcement. Option C is incorrect because Identity Protection detects risks such as leaked credentials but does not directly enforce MFA. Option D is incorrect because enabling MFA per user is a legacy method that does not provide granular conditional access.

Answer

Configure Privileged Identity Management

Answer

Use Identity Protection

Answer

Enable MFA per user

Question 11

Which THREE of the following are capabilities of Microsoft Purview Information Protection? (Select three.)

Accepted Answer

Rights management. Options A, C, and D are correct. Microsoft Purview Information Protection includes rights management (A), data classification (C), and sensitivity labels (D) as core capabilities. Option B (eDiscovery) is a separate solution in Microsoft Purview, not part of Information Protection. Option E (data loss prevention policies) is also a different solution, although it works together with Information Protection.

Answer

eDiscovery

Answer

Data loss prevention policies

Question 12

Which of the following is a primary purpose of Microsoft Entra ID Identity Protection?

Accepted Answer

Detect and remediate identity risks. Microsoft Entra ID Identity Protection is designed to detect, investigate, and remediate identity-based risks such as leaked credentials, sign-ins from unfamiliar locations, and risky user behaviors. Option B is incorrect because managing privileged roles is the purpose of Privileged Identity Management (PIM), not Identity Protection. Option C is incorrect because classifying and protecting sensitive data is handled by Microsoft Purview Information Protection. Option D is incorrect because managing device compliance policies is a function of Microsoft Intune.

Answer

Manage privileged roles

Answer

Classify and protect sensitive data

Answer

Manage device compliance policies

Question 13

A company wants to improve password security across its Microsoft Entra ID tenant. The security team wants to prevent users from setting passwords that appear on Microsoft's global banned password list, which includes commonly compromised passwords. Additionally, they need to add a custom banned password containing the company name so that users cannot use variations of it. Which Microsoft Entra ID feature should they configure to enforce these password policies?

Accepted Answer

Password Protection. Password Protection in Microsoft Entra ID is the feature specifically designed to enforce both global and custom banned password lists. It prevents users from using commonly compromised passwords from Microsoft's global list and allows administrators to add custom terms, such as the company name, to block variations. This directly addresses the requirement to improve password security by blocking weak and organization-specific passwords.

Answer

Conditional Access

Answer

Identity Protection

Answer

Multi-factor authentication (MFA)

Question 14

Your organization uses Microsoft Defender XDR. The security team wants a central dashboard showing the overall security posture and recommended actions. Which tool should they use?

Accepted Answer

Microsoft Secure Score. Microsoft Secure Score provides a dashboard with security recommendations and posture assessment. Option A is incorrect because Microsoft Purview is for data governance. Option B is incorrect because Microsoft Entra ID is identity management. Option C is incorrect because Microsoft Sentinel is a SIEM.

Answer

Microsoft Purview

Answer

Microsoft Entra ID

Answer

Microsoft Sentinel

Question 15

A company uses Microsoft Entra ID. They want to enforce that users accessing the finance app from outside the corporate network must use multifactor authentication (MFA) and access from a device marked as compliant. Additionally, if the user's sign-in risk is medium or higher, access must be blocked. Which component of a Conditional Access policy should the administrator configure to specify the 'Block access' action for high-risk sign-ins?

Accepted Answer

Grant controls. The 'Block access' action is specified within the Grant controls section of a Conditional Access policy. Grant controls allow administrators to either require specific conditions (like MFA or compliant device) to be met for access to be granted, or to explicitly block access entirely. By selecting 'Block access' in the Grant controls, the policy enforces that any user meeting the policy's conditions (such as high sign-in risk) is denied access.

Answer

Conditions

Answer

Assignments

Answer

Session controls

Question 16

An organization uses Microsoft Intune to manage devices. They want to ensure that only devices that are compliant with security policies (e.g., encryption enabled, latest patches) can access corporate email. Which Microsoft Entra feature should they use to enforce this requirement?

Accepted Answer

Conditional Access in Microsoft Entra ID. Conditional Access in Microsoft Entra ID allows administrators to create policies that enforce access controls based on conditions such as device compliance, as reported by Intune. Only devices that satisfy the compliance requirements (e.g., encryption enabled, latest patches) are granted access to corporate email. Option B (Microsoft Defender for Endpoint) focuses on threat detection and response, not access enforcement. Option C (Device compliance policies in Microsoft Intune) defines the compliance criteria and marks devices as compliant or non-compliant, but it does not enforce access at the application level—that enforcement is done by Conditional Access. Option D (Azure AD Join) is a device identity registration method, not an access control mechanism.

Answer

Microsoft Defender for Endpoint

Answer

Device compliance policies in Microsoft Intune

Answer

Azure AD Join

Question 17

A company uses Microsoft Entra ID. The security team wants to provide just-in-time (JIT) administrative access to Azure resources. They require that administrators must request approval before gaining elevated privileges, and that the elevated access automatically expires after the task is completed. Which Microsoft Entra capability should they use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct choice because it provides just-in-time (JIT) privileged access to Azure resources with time-bound activation, approval workflows, and automatic expiration. PIM allows administrators to request elevation for a specific role, which must be approved by designated approvers, and the elevated access automatically expires after the configured duration (e.g., 1–8 hours). This directly meets the security team's requirements for approval-based, time-limited administrative access.

Answer

Conditional Access

Answer

Identity Protection

Answer

Self-Service Password Reset (SSPR)

Question 18

A company uses Microsoft Entra ID. The security team wants to enforce a policy that prevents users from choosing commonly used weak passwords like 'Winter2024!' or 'Password@123', and also blocks customized variants based on organizational context (e.g., company name). Users must create passwords that meet standard complexity requirements. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Microsoft Entra ID Password Protection. Microsoft Entra ID Password Protection (B) is the correct feature because it specifically enforces custom banned password lists that block weak passwords like 'Winter2024!' and organizational variants such as the company name. It works alongside standard password complexity requirements to prevent users from choosing passwords that appear on a global banned list or a tenant-specific custom list. This directly addresses the security team's need to block commonly used weak passwords and context-based variants.

Answer

Password hash synchronization

Answer

Self-Service Password Reset

Answer

Conditional Access

Question 19

Which TWO of the following are identity-related security best practices recommended by Microsoft? (Choose two.)

Accepted Answer

Implement Conditional Access policies. The correct answers are B and E. Implementing Conditional Access policies allows organizations to enforce access controls based on conditions, which is a best practice for identity security. Enabling multi-factor authentication (MFA) adds an extra layer of security beyond passwords. Option A is incorrect because sharing passwords violates security best practices. Option C is incorrect because SSO without MFA does not provide adequate protection. Option D is incorrect because disabling sign-in logs reduces visibility and hinders security monitoring.

Answer

Share passwords with team members for critical accounts

Answer

Use single sign-on (SSO) without MFA

Answer

Disable sign-in logs to reduce storage costs

Question 20

A company deploys Microsoft Defender for Cloud Apps. They want to detect when a user downloads more than 100 files from SharePoint in 10 minutes. Which policy type should they create?

Accepted Answer

Anomaly detection policy. An anomaly detection policy in Defender for Cloud Apps can identify unusual file download activities based on predefined thresholds. Option A is wrong because a file policy monitors files based on metadata or content, not behavioral patterns. Option C is wrong because an app permission policy governs permissions granted to third-party apps. Option D is wrong because a session policy enforces real-time controls on user sessions.

Answer

File policy

Answer

App permission policy

Answer

Session policy