SC-900 Practice Exam 68 — 20 Questions

Question 1

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to improve their secure score. What should they do?

Accepted Answer

Implement the security recommendations. Microsoft Defender for Cloud's secure score quantifies an Azure subscription's security posture based on implemented recommendations. To improve the score, the organization must remediate the identified security recommendations — such as enabling MFA, applying patches, or restricting network access. Each implemented recommendation increases the score, reflecting a stronger security posture.

Answer

Remove all virtual machines from the subscription

Answer

Increase the Azure budget

Answer

Disable Microsoft Defender for Cloud

Question 2

Your organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. You need to ensure that when a user attempts to share a document containing credit card numbers via email, the document is blocked and the user receives a policy tip. What should you configure in the DLP policy?

Accepted Answer

Set the action to 'Block'. The requirement is to block sharing of a document containing credit card numbers via email and show the user a policy tip. In Microsoft Purview DLP, the 'Block' action prevents the sensitive data from being shared and displays a policy tip to the user. 'Block with override' would additionally allow the user to bypass the block with a justification or false positive, which is not required here. Therefore, 'Block' is the correct action.

Answer

Set the action to 'Audit only'

Answer

Set the action to 'Block with override'

Answer

Set the action to 'Notify only'

Question 3

Your organization uses Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from their CEO asking for a wire transfer. The email passed through the spam filter. What additional protection should be enabled to detect such attacks?

Accepted Answer

Impersonation protection in anti-phishing policy. The attack described is a business email compromise (BEC) or CEO fraud, which relies on impersonation rather than malicious links or attachments. Microsoft Defender for Office 365's anti-phishing policy includes impersonation protection that specifically detects and mitigates attempts where a sender spoofs a high-profile user (like the CEO) or domain. Enabling impersonation protection in the anti-phishing policy is the correct additional safeguard because the email passed the spam filter, indicating it was not a bulk or malware-based threat.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Safe Links policy

Question 4

A company uses Microsoft 365 and sanctioned cloud apps like Salesforce and Box. The security team wants to prevent users from downloading sensitive documents from these apps when accessing from unmanaged personal devices, while still allowing read-only access. They need real-time session monitoring and control. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps provides real-time session monitoring and control via its Conditional Access App Control feature. This allows administrators to enforce policies that block downloads or restrict access to sensitive data based on device compliance, such as blocking downloads from unmanaged personal devices while permitting read-only access. The solution integrates with sanctioned cloud apps like Salesforce and Box to apply these controls at the session level.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Endpoint

Question 5

A company uses Microsoft Defender for Endpoint. An alert indicates that a device is communicating with a known malicious IP address. The security team wants to automatically block the IP address on all devices. Which action should they configure?

Accepted Answer

Indicator of compromise (IoC). An Indicator of Compromise (IoC) in Microsoft Defender for Endpoint lets security teams define a known malicious IP address, URL, domain, or file hash and configure an action such as 'Block' or 'Alert and block'. Once created, the IoC is enforced across all onboarded devices, automatically blocking communication with the malicious IP. This is the correct feature for automated, organization-wide blocking.

Answer

Custom detection rule

Answer

Automated investigation

Answer

Threat analytics report

Question 6

An organization uses Microsoft Purview Information Protection to classify and protect data. Which TWO methods can be used to apply sensitivity labels automatically?

Accepted Answer

Auto-labeling policies in Microsoft 365 compliance center. Auto-labeling policies can apply labels based on conditions. Client-side labeling via the Azure Information Protection unified labeling client also supports automatic classification. Manual labeling is not automatic. Labeling in Microsoft 365 Apps is default but not automatic. PowerShell cannot directly apply labels automatically without scripts.

Answer

Default labeling policy for Microsoft 365 Apps

Answer

Manual labeling by end users

Answer

PowerShell scripts to apply labels on export

Question 7

A company wants to use Microsoft Intune to enforce that mobile devices have a PIN of at least 6 characters to access corporate resources. What should they configure?

Accepted Answer

Device compliance policy. A device compliance policy in Microsoft Intune defines the rules that devices must meet to be considered compliant, such as requiring a PIN of at least 6 characters. When a device is marked non-compliant, Conditional Access can block access to corporate resources. This is the correct mechanism to enforce the PIN requirement at the device level before granting access.

Answer

Conditional access policy

Answer

App protection policy

Answer

Device configuration profile

Question 8

Your organization is deploying Microsoft Defender XDR to detect and respond to advanced threats. You need to ensure that security alerts from Microsoft Defender for Endpoint are automatically correlated with alerts from Microsoft Defender for Office 365. What should you configure?

Accepted Answer

Ensure that all Microsoft Defender services are onboarded to the same tenant and that the incidents feature is enabled. Microsoft Defender XDR automatically correlates alerts from different Microsoft Defender services (e.g., Defender for Endpoint and Defender for Office 365) when they are onboarded to the same tenant and the incidents feature is enabled. This built-in correlation uses the Microsoft 365 Defender backend to fuse related alerts into a single incident, providing a unified view of the attack chain without additional configuration.

Answer

Configure a custom detection rule in Microsoft 365 Defender

Answer

Create an advanced hunting query to join alerts from different data sources

Answer

Enable Microsoft Sentinel and configure incident creation rules

Question 9

A company wants to automatically detect and remediate compliance issues such as sharing sensitive data externally. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, alert, and automatically remediate when sensitive data (e.g., credit card numbers, personally identifiable information) is shared externally via email, Teams, or cloud apps. DLP policies can enforce actions like blocking the transmission or applying encryption, directly addressing the requirement to prevent unauthorized external sharing of sensitive data.

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 10

An organization wants to allow users to sign in using their mobile phone number and a verification code. Which Microsoft Entra ID feature enables this?

Accepted Answer

SMS-based authentication. SMS-based authentication allows users to sign in to Microsoft Entra ID by entering their mobile phone number and receiving a verification code via text message. This is a form of passwordless authentication that leverages the user's phone number as the primary identifier and the SMS-delivered code as the second factor, meeting the organization's requirement for phone number and verification code sign-in.

Answer

FIDO2 security keys

Answer

App passwords

Answer

Password hash synchronization

Question 11

Your organization wants to ensure that all external emails are automatically tagged with a disclaimer at the top of the email body. Which Microsoft Exchange Online feature should you configure?

Accepted Answer

Mail flow rule (transport rule). Mail flow rules (also known as transport rules) in Exchange Online allow you to inspect messages and take actions such as adding a disclaimer to the top of the email body. This rule can be scoped to apply only to external emails by using the condition 'The sender is located outside the organization'. The action 'Prepend a disclaimer' inserts the text at the beginning of the message body, meeting the requirement precisely.

Answer

Journal rule

Answer

Data loss prevention (DLP) policy

Answer

Safe Links policy

Question 12

Your organization uses Microsoft Purview to manage data lifecycle. You need to ensure that after a project ends, all related files are automatically deleted after 3 years. What should you configure?

Accepted Answer

Create a retention label with a retention period of 3 years and a disposition action of deletion. A retention label in Microsoft Purview allows you to define a retention period and then automatically trigger a disposition action—such as permanent deletion—when that period expires. By creating a label with a 3-year retention period and setting the disposition action to 'Delete', all files tagged with that label will be automatically removed after three years, meeting the requirement without manual intervention.

Answer

Configure a DLP policy to delete files after 3 years

Answer

Create an eDiscovery case and manually delete the files

Answer

Apply a sensitivity label marked 'Project' and configure auto-deletion

Question 13

A company uses a hybrid environment with Azure virtual machines (IaaS) and on-premises Windows servers. The security team needs a single solution that continuously assesses the security posture of these workloads, provides a regulatory compliance dashboard with actionable recommendations, and enables threat detection. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct answer because it provides a unified security management platform that continuously assesses the security posture of both Azure VMs (IaaS) and on-premises Windows servers via Azure Arc. It offers a regulatory compliance dashboard with actionable recommendations based on built-in standards like CIS, NIST, and Azure Security Benchmark, and integrates with Microsoft Defender for Cloud's workload protection plans to enable threat detection for these hybrid workloads.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Question 14

Your company uses Microsoft Entra ID and wants to allow external partners to sign in using their own Google or Facebook accounts. Which feature should you enable?

Accepted Answer

External Identities (social identity providers). External Identities (social identity providers) in Microsoft Entra ID allows you to configure Google and Facebook as identity providers for external users. This enables partners to sign in using their existing social accounts without needing a separate Microsoft account, leveraging OAuth 2.0 and OpenID Connect protocols for authentication.

Answer

Azure Active Directory Domain Services

Answer

Microsoft Entra B2C

Answer

Microsoft Entra B2B collaboration

Question 15

Your organization uses Microsoft Entra ID for identity management. You need to enable users to sign in using a QR code from the Microsoft Authenticator app. Which Microsoft Entra feature should you configure?

Accepted Answer

Passwordless sign-in with Microsoft Authenticator. The Microsoft Authenticator app supports passwordless sign-in by allowing users to approve a notification or scan a QR code from the sign-in screen. This feature eliminates the need for a password and relies on the Authenticator app as a primary authentication method, which is configured under the Passwordless sign-in with Microsoft Authenticator option in Entra ID.

Answer

FIDO2 security keys

Answer

Temporary Access Pass

Answer

My Security-info (https://aka.ms/mysecurityinfo)

Question 16

A company uses Microsoft Entra ID. The IT department has three teams: Helpdesk, Global Administrators, and Security Administrators. The company wants to allow the Helpdesk team to manage password resets and group memberships, but only for users who belong to the 'Sales' organizational unit. Which Microsoft Entra feature should the administrator use to define this delegated administrative scope?

Accepted Answer

Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions scoped to specific organizational units, such as the 'Sales' OU. By placing Sales users into an AU and assigning the Helpdesk team roles like 'Helpdesk Administrator' or 'User Administrator' scoped to that AU, you precisely control which users they can manage for password resets and group memberships. This directly meets the requirement for delegated administrative scope without granting broader tenant-wide permissions.

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access policies

Answer

Identity Governance (Access Reviews)

Question 17

A company wants to detect potentially malicious insider activities, such as employees copying large volumes of files to external drives or sending sensitive emails to personal accounts. The security team needs to investigate these activities with visual timelines and assign cases for review. Which Microsoft Purview solution should they use?

Accepted Answer

Insider Risk Management. Insider Risk Management in Microsoft Purview is purpose-built to detect, triage, and investigate risky insider activities such as mass file downloads, exfiltration to USB drives, and sending sensitive content to personal email accounts. It correlates signals from Microsoft 365, endpoints, and HR data into visual timelines and supports creating cases for investigator review. This matches the requirement for detection plus investigation workflow.

Answer

Communication Compliance

Answer

eDiscovery (Premium)

Answer

Data Loss Prevention

Question 18

A company wants employees to be able to access corporate applications from their personal mobile devices, but only if those devices are enrolled in mobile device management (MDM) and have a PIN code set. Which Microsoft Entra capability should the administrator use to enforce these requirements?

Accepted Answer

Conditional Access. Conditional Access is the correct Microsoft Entra capability because it allows administrators to create policies that enforce specific requirements—such as device enrollment in MDM and a PIN code—before granting access to corporate applications. By configuring a Conditional Access policy with a grant control requiring 'Require device to be marked as compliant' (which depends on MDM enrollment and PIN compliance), the administrator can block access from personal devices that do not meet these conditions.

Answer

Identity Protection

Answer

Privileged Identity Management

Answer

Enterprise App Registration

Question 19

A company uses Microsoft Entra ID (Microsoft Entra ID) to manage access to internal applications for employees and guest users. The compliance team requires that all guest users' access to a sensitive application must be reviewed every 90 days by the application owner. If the owner does not respond to the review request, the guest's access must be automatically revoked. Which Microsoft Entra ID feature should the company use?

Accepted Answer

Access Reviews. Access Reviews in Microsoft Entra ID allow administrators to create recurring reviews of guest user access to applications, groups, or roles. The scenario requires a 90-day review cycle with automatic revocation if the owner does not respond, which is a built-in configuration option within an Access Review policy. This directly meets the compliance team's requirement for periodic attestation and automated removal of access.

Answer

Conditional Access

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Question 20

A company uses Microsoft Entra ID and wants to allow users to reset their own passwords without help desk intervention. However, they want to ensure that only users who have already registered for multifactor authentication (MFA) can use self-service password reset (SSPR). Which Microsoft Entra feature should the administrator configure to enforce this requirement?

Accepted Answer

Self-Service Password Reset (SSPR) settings. Self-Service Password Reset (SSPR) settings in Microsoft Entra ID include a configuration option to require users to register for multifactor authentication (MFA) before they can use SSPR. By enabling the 'Require users to register when they sign in' setting under SSPR, the administrator ensures that only MFA-registered users can reset their own passwords, meeting the requirement without additional policies.

Answer

Conditional Access

Answer

Identity Protection

Answer

Privileged Identity Management