SC-900 Practice Exam 67 — 20 Questions

Question 1

You are a security administrator for Contoso Ltd. The company uses Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Entra ID. Recently, several users reported receiving phishing emails that bypassed the existing anti-phishing policies. The security team suspects that attackers are using sophisticated techniques to evade detection. You need to enhance the email security posture by implementing a solution that uses AI and machine learning to detect advanced phishing attempts, including those using social engineering and impersonation. Which Microsoft solution should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes advanced anti-phishing capabilities with AI and machine learning, such as impersonation protection and spoof intelligence. Microsoft Sentinel is a SIEM/SOAR, not an email security solution. Defender for Cloud Apps is a CASB. Defender for Identity identifies threats via on-premises AD signals. Microsoft Purview focuses on compliance and data governance.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 2

Which THREE are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Detect sensitive information in documents and emails. Microsoft Purview DLP is designed to detect sensitive information (e.g., credit card numbers, PII) in documents and emails by using built-in or custom sensitive information types. When a match is found, DLP can enforce policies to block sharing with external users and display policy tips to inform users of the violation, making options B, C, and E correct capabilities.

Answer

Automatically classify and label data

Answer

Manage encryption keys for data at rest

Question 3

Your organization uses Microsoft Entra ID to manage identities for employees and external partners. You need to ensure that external partners can access only specific applications and that their access expires automatically after 60 days. Which Microsoft Entra feature should you use?

Accepted Answer

Microsoft Entra entitlement management.. Microsoft Entra entitlement management allows you to create access packages that govern external partner access to specific applications, groups, and sites, with built-in time-limited access that automatically expires after a defined period (e.g., 60 days). This feature directly addresses the requirement to scope access to only specific applications and enforce automatic expiration, which is not natively handled by other Entra ID features.

Answer

Microsoft Entra B2B collaboration.

Answer

Conditional Access policies.

Answer

Microsoft Entra Identity Protection.

Question 4

A company is required by a compliance regulation to retain all user and admin activity audit logs for 2 years. They also need the ability to perform faster, historical searches on this audit data. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit (Premium). Microsoft Purview Audit (Premium) provides a 2-year retention capability for audit logs, which meets the compliance regulation requirement. Additionally, it offers faster, historical searches through features like high-bandwidth access to the Audit Log Search API and intelligent insights, enabling efficient querying of large volumes of audit data. Standard Audit only retains logs for 90 days by default and lacks the performance optimizations for historical searches.

Answer

Microsoft Purview Audit (Standard)

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview eDiscovery (Premium)

Question 5

A multinational corporation wants to implement a Zero Trust security model. They plan to verify every access request explicitly, use least privilege access, and assume breach. Which Microsoft security solution should they use to enforce conditional access policies based on user, device, location, and risk?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct solution for enforcing conditional access policies based on signals like user, device, location, and risk. Option A (Microsoft Sentinel) is a SIEM/SOAR solution for security analytics, not access control. Option B (Microsoft Intune) manages devices but does not enforce access policies on its own. Option D (Microsoft Defender for Cloud Apps) provides cloud app security but is not the primary conditional access engine.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Question 6

Which TWO of the following are capabilities of Microsoft Entra ID Governance?

Accepted Answer

Access Reviews. Access Reviews (B) is a core Microsoft Entra ID Governance capability that lets organizations automate periodic reviews of group memberships, application access, and role assignments to ensure users retain only the access they need. Entitlement Management (C) is also part of Entra ID Governance, providing access packages, catalogs, and policies to automate the request, approval, assignment, and expiration of access for internal and external users. These two features directly address governance concerns such as access lifecycle management, least privilege, and compliance attestation. Privileged Identity Management (A) is a separate Microsoft Entra ID service focused on just-in-time privileged role activation, while Conditional Access (D) is an access-control policy engine and Identity Protection (E) is a risk-detection and remediation service; neither is categorized as an Entra ID Governance capability.

Answer

Privileged Identity Management

Answer

Conditional Access

Answer

Identity Protection

Question 7

Which THREE of the following are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Detect credit card numbers in Exchange Online emails. Option A is correct because Microsoft Purview DLP includes built-in sensitive information types (SITs) such as Credit Card Number that can be applied to Exchange Online as a workload location, inspecting email content and attachments for matches. Option C is correct because DLP policies support Microsoft Teams as a location, scanning chat and channel messages for sensitive information types and taking actions like blocking or warning. Option E is correct because SharePoint Online is a supported DLP workload location, and SITs such as Passport Number (e.g., the U.S. Passport Number or international variants) can be detected in documents stored there. Option B is not a DLP capability; blocking traffic from suspicious IP addresses is a network security function handled by firewalls, Azure Firewall, or Defender for Cloud, not by Purview DLP. Option D is not a DLP capability; malware detection in email attachments is performed by Exchange Online Protection and Microsoft Defender for Office 365, not by Purview DLP, which focuses on sensitive information rather than malicious code.

Answer

Block network traffic from suspicious IP addresses

Answer

Detect malware in email attachments

Question 8

Refer to the exhibit. You are reviewing a Privileged Identity Management (PIM) configuration for a role in Microsoft Entra ID. The roleDefinitionId corresponds to a specific role. What is the effect of this configuration?

Accepted Answer

The user is eligible for the role indefinitely, but activation requires approval and lasts up to 1 hour.. The configuration shown in the exhibit sets the role assignment to 'Eligible' with an activation duration of 1 hour and requires approval (the approval toggle is on). An 'Eligible' assignment means the user is not permanently active; they must activate the role when needed. The requirement for approval ensures that an authorized approver must approve each activation request. The 1-hour duration limits how long each activation lasts. This matches the description of being eligible indefinitely, with activation requiring approval and lasting up to 1 hour.

Answer

The user is permanently activated for the role for 1 hour.

Answer

The user is permanently assigned the role for 1 hour.

Answer

The user can activate the role without approval for up to 1 hour.

Question 9

Your organization uses Microsoft Purview Insider Risk Management. You need to create a policy that detects users exfiltrating sensitive data via email to external recipients. Which policy type should you configure?

Accepted Answer

Data leaks. Data leaks policy type in Microsoft Purview Insider Risk Management is specifically designed to detect and alert on the unauthorized transmission of sensitive data to external recipients, including via email. This policy type analyzes email headers, attachments, and body content against defined sensitive information types (e.g., credit card numbers, PII) and triggers when data is sent outside the organization, matching the scenario described.

Answer

Offensive language

Answer

Data theft

Answer

Security policy violations

Question 10

A company's security team has adopted a strategy that assumes a breach has already occurred. They implement network segmentation, apply strict least privilege access, continuously verify all access requests, and never trust users or devices solely because they are inside the network perimeter. This approach best describes which security model?

Accepted Answer

Zero Trust. The scenario explicitly describes the core tenets of the Zero Trust model: assume breach, enforce least privilege, segment networks, and never trust any user or device based solely on network location. Zero Trust, as defined by NIST SP 800-207, mandates continuous verification of every access request, treating every request as if it originates from an untrusted network, which directly matches the company's strategy.

Answer

Shared responsibility model

Answer

Defense in depth

Answer

Identity and Access Management (IAM)

Question 11

A company uses Microsoft Purview to classify and protect data. They need to ensure that when a user attempts to share a file containing a credit card number externally, the file is blocked and the user is prompted with a policy tip. Which type of Microsoft Purview policy should they configure?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies in Microsoft Purview are designed to detect sensitive information types such as credit card numbers and take action — blocking sharing, showing policy tips, or restricting access. DLP policies evaluate content in Exchange, SharePoint, OneDrive, Teams, and endpoints, and can trigger user notifications when a policy match occurs. This directly satisfies the requirement to block external sharing and prompt the user.

Answer

Retention policy

Answer

Insider Risk Management policy

Answer

Sensitivity label policy

Question 12

A company uses Microsoft Entra ID Privileged Identity Management (PIM) to manage elevated access to Microsoft Entra ID roles. They want to ensure that a user who activates a privileged role must provide a justification and receive approval from their manager before activation is complete. Which PIM configuration should be used?

Accepted Answer

Configure role settings to require approval on activation. Microsoft Entra ID Privileged Identity Management (PIM) allows administrators to configure role settings that require approval before a role is activated. By enabling the 'Require approval to activate' setting, a designated approver (such as the user's manager) must review and approve the activation request, ensuring that the justification is validated before access is granted.

Answer

Configure role settings to require multi-factor authentication on activation

Answer

Configure role settings to assign the user as permanently active

Answer

Configure role settings to require an Microsoft Entra ID compliant device

Question 13

Your company is using Microsoft Entra ID to manage identities. You want to allow users to reset their own passwords without help desk intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

Accepted Answer

Enable Self-Service Password Reset (SSPR) in Microsoft Entra ID.. Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords without help desk intervention, provided they have registered for the feature. This directly meets the requirement of allowing password resets only for registered users, as SSPR requires prior registration to verify identity before a reset is permitted.

Answer

Require all users to register for Microsoft Entra MFA.

Answer

Configure Microsoft Entra password protection.

Answer

Implement Privileged Identity Management (PIM).

Question 14

You are an identity consultant for a mid-sized company with 5,000 employees. They use Microsoft Entra ID P1 and Microsoft Intune for device management. The company wants to implement passwordless authentication for all employees to improve security and user experience. Currently, users sign in with username and password plus MFA via the Microsoft Authenticator app. The company has a mix of Windows 10/11 devices (both domain-joined and Microsoft Entra joined) and iOS/Android mobile devices. They want to support passwordless sign-in on all platforms. The CTO is concerned about cost and wants to minimize additional licensing. Which passwordless method should you recommend?

Accepted Answer

Use the Microsoft Authenticator app for passwordless sign-in. The Microsoft Authenticator app supports passwordless sign-in using phone-based authentication, which works on both iOS and Android devices and can be used to sign into Windows 10/11 devices via the 'Sign in with phone' feature. This method leverages existing Microsoft Entra ID P1 licensing without requiring additional costs, as it is included with the current P1 license. It provides a seamless user experience by eliminating the need for hardware tokens or additional infrastructure, aligning with the CTO's cost-minimization goal.

Answer

Enable Windows Hello for Business for all devices

Answer

Deploy FIDO2 security keys to all employees

Answer

Implement SMS-based one-time passcodes

Question 15

Which TWO Microsoft Purview features can be used to automatically classify and protect sensitive data in documents?

Accepted Answer

Trainable classifiers. Sensitive information types (E) are the built-in or custom pattern-based definitions in Microsoft Purview that automatically detect and classify sensitive data such as credit card numbers, national ID numbers, or health records, making them a core automatic classification mechanism. Trainable classifiers (C) use machine learning to automatically identify and classify sensitive content by category (for example, source code, resumes, or contracts) when pattern matching alone is insufficient. Together, these two features feed the classification engine that can then trigger protection such as encryption or DLP. Data loss prevention policies (A) act on already-classified sensitive data to prevent sharing, but they are a protection/enforcement mechanism rather than a classification feature. eDiscovery (Premium) (B) is used for identifying, collecting, and reviewing content for legal cases, not for automatic classification and protection. Retention labels (D) govern how long content is kept or deleted, which is a lifecycle function, not automatic classification of sensitive data.

Answer

Data loss prevention policies

Answer

eDiscovery (Premium)

Answer

Retention labels

Question 16

A user reports frequent password reset requests. You suspect password spray attacks. Which Microsoft Entra ID feature should you use to investigate?

Accepted Answer

Identity Protection risk detections. Identity Protection risk detections are the correct feature because they specifically analyze sign-in patterns and flag suspicious activities such as password spray attacks. A password spray attack involves an attacker trying a small number of common passwords against many accounts, and Identity Protection uses machine learning to detect this anomalous behavior and generate risk detections like 'Unfamiliar sign-in properties' or 'Malicious IP address'.

Answer

Audit logs

Answer

Conditional Access policies

Answer

Multifactor authentication

Question 17

Your organization uses Microsoft Defender XDR. You need to investigate a potential lateral movement attack where a compromised user account is used to access multiple workstations. Which feature should you use to visualize the attack path?

Accepted Answer

Attack graph. Attack graph in Microsoft Defender XDR is the correct feature because it automatically maps and visualizes the potential paths an attacker could take to move laterally across devices using compromised credentials. It correlates alerts and incidents to show the sequence of events, such as a user account authenticating to multiple workstations, enabling security teams to identify the scope and entry point of the attack.

Answer

Microsoft Sentinel workbooks

Answer

Threat analytics in Microsoft 365 Defender

Answer

Incident queue

Question 18

A multinational organization uses Microsoft Entra ID for identity management. The security team wants to implement a Conditional Access policy that blocks access from untrusted locations unless the user's device is marked as compliant by Microsoft Intune. However, users traveling to trusted partner locations should be allowed access even if their device is non-compliant. Which two conditions should be configured in the policy?

Accepted Answer

Locations: All locations, exclude trusted locations; Grant: Require compliant device.. The policy must block access from untrusted locations unless the device is compliant, while allowing access from trusted partner locations even if the device is non-compliant. By setting 'Locations: All locations' and excluding trusted locations, the policy applies only to untrusted locations. Then, 'Grant: Require compliant device' ensures that only compliant devices can access from those untrusted locations, meeting both requirements.

Answer

Locations: All trusted locations; Grant: Require compliant device.

Answer

Locations: All trusted locations; Grant: Block access.

Answer

Locations: All locations; Grant: Require compliant device.

Question 19

A security analyst runs the above KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Identify users with more than 5 MFA failure anomalies in the last 7 days. The KQL query uses `summarize` with `count()` on MFA failure anomalies, then filters with `where count_ > 5` and `where TimeGenerated > ago(7d)`. This explicitly returns only users whose anomaly count exceeds 5 in the last 7 days, making option D correct. The query does not correlate with other events, list all users with any anomaly, or check block status.

Answer

Correlate MFA failures with other security events

Answer

Identify all users who had an MFA failure anomaly in the last 7 days

Answer

Identify users who have been blocked due to MFA failures

Question 20

Which TWO are principles of the Zero Trust security model?

Accepted Answer

Verify explicitly. Option A, "Verify explicitly," is a core Zero Trust principle: every access request must be authenticated and authorized based on all available data points, including user identity, device health, location, and resource sensitivity, rather than granting implicit trust based on network location. Option C, "Assume breach," is the other foundational Zero Trust principle: organizations must operate as if an attacker is already present, which drives micro-segmentation, least-privilege access, end-to-end encryption, and continuous monitoring to minimize blast radius and detect threats. Option B, "Trust everything inside the network," is the opposite of Zero Trust, which explicitly rejects the castle-and-moat assumption that internal traffic is inherently trustworthy. Option D, "Use a VPN for remote access," is a connectivity mechanism, not a Zero Trust principle; Zero Trust instead favors per-request, identity-based access controls over implicit network-level trust. Option E, "Layer defenses," describes defense in depth, a complementary but distinct security strategy, not one of the three canonical Zero Trust principles (verify explicitly, use least-privilege access, assume breach).

Answer

Trust everything inside the network

Answer

Use a VPN for remote access

Answer

Layer defenses