SC-900 Practice Exam 68 — 20 Questions

Question 1

Your organization is implementing a new policy to ensure that only authorized users can access sensitive financial data stored in Microsoft SharePoint Online. The security team wants to enforce multi-factor authentication (MFA) for all users accessing this data, but only when accessing from outside the corporate network. Which Microsoft Entra ID conditional access policy setting should you configure to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant access requiring multi-factor authentication when the location is not trusted. A conditional access policy can be configured to require multi-factor authentication only when the location is not trusted, which meets the requirement of enforcing MFA for remote access while allowing trusted network access without MFA. Option A is incorrect because app-enforced restrictions are session controls that do not enforce MFA at sign-in. Option B is incorrect because requiring a compliant device does not directly enforce MFA. Option D is incorrect because blocking access from untrusted locations would prevent remote access entirely, which is not the requirement.

Answer

Use app-enforced restrictions for SharePoint

Answer

Grant access requiring device to be marked as compliant when location is not trusted

Answer

Block access when the location is not trusted

Question 2

Which THREE of the following are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Detect credit card numbers in Exchange Online emails. Options A, C, and E are correct. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information such as credit card numbers in Exchange Online emails (A), detect sensitive information in Microsoft Teams messages (C), and detect passport numbers in SharePoint Online documents (E). Option B is incorrect because blocking network traffic from suspicious IP addresses is a network security feature, not a DLP capability. Option D is incorrect because detecting malware in email attachments is the function of Microsoft Defender for Office 365, not DLP.

Answer

Block network traffic from suspicious IP addresses

Answer

Detect malware in email attachments

Question 3

Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID feature should you use to verify that users and devices meet specific health requirements before granting access to corporate resources?

Accepted Answer

Conditional Access. Conditional Access policies can enforce device compliance, MFA, and other health checks before granting access. Option A is wrong because Privileged Identity Management manages just-in-time admin roles, not device health. Option B is wrong because Identity Governance manages access reviews and lifecycle, not real-time health verification. Option C is wrong because Identity Protection detects risks but does not enforce device health requirements.

Answer

Privileged Identity Management (PIM)

Answer

Identity Governance

Answer

Identity Protection

Question 4

Refer to the exhibit. A security analyst runs this Microsoft Graph PowerShell command. What is the most likely purpose of this command?

Accepted Answer

To find users whose user principal name starts with 'j'.. The command uses the Get-MgUser cmdlet with a -Filter parameter to retrieve users whose userPrincipalName starts with 'j'. The -Select parameter limits the output to specific properties. Therefore, option A correctly identifies the purpose. Option B is incorrect because no update operations (e.g., Update-MgUser) are used. Option C is incorrect because no removal operations (e.g., Remove-MgUser) are used. Option D is incorrect because the command filters by userPrincipalName and does not display group membership.

Answer

To update the display names of users starting with 'j'.

Answer

To remove users whose user principal name starts with 'j'.

Answer

To list all users and their group memberships.

Question 5

A healthcare organization must comply with HIPAA regulations. They use Microsoft Purview to classify and label patient data. Which Microsoft Purview capability helps them enforce data protection policies automatically?

Accepted Answer

Data loss prevention (DLP) policies. Data loss prevention (DLP) policies in Microsoft Purview can automatically detect and protect sensitive data like health information. Option A is wrong because eDiscovery focuses on searching content for legal purposes, not automatic enforcement. Option B is wrong because audit logs record events but don't enforce policies. Option C is wrong because sensitivity labels apply classification but not automatic protection actions.

Answer

eDiscovery

Answer

Audit logs

Answer

Sensitivity labels

Question 6

A company uses Azure virtual machines for a production database. The security team wants to minimize the attack surface by blocking all inbound RDP (port 3389) traffic. However, administrators occasionally need to connect for maintenance. The team needs a solution that allows administrators to request temporary access to the RDP port, which is automatically revoked after a specified time. Which Microsoft Defender for Cloud feature should they use?

Accepted Answer

Just-in-time (JIT) VM access. Just-in-time (JIT) VM access is the correct feature because it specifically addresses the need to block inbound RDP (port 3389) traffic by default while allowing administrators to request temporary, time-bound access. When a request is approved, JIT dynamically modifies the network security group (NSG) to open the port for a specified duration, then automatically reverts the rule to deny all inbound traffic after the time expires. This directly minimizes the attack surface by eliminating persistent open management ports.

Answer

Adaptive application controls

Answer

File Integrity Monitoring (FIM)

Answer

Security alerts

Question 7

Which TWO components are part of the 'Zero Trust' security model? (Choose two.)

Accepted Answer

Least privilege. Correct answers are A and D: Least privilege ensures users have only the minimum access needed, and Verify explicitly assumes every access request is a potential threat. Option B (VPN access) is a network access method, not a Zero Trust principle. Option C (password complexity) is a security control but not a core component of the Zero Trust model. Option E (perimeter-based security) is the traditional model that Zero Trust replaces.

Answer

VPN access

Answer

Password complexity

Answer

Perimeter-based security

Question 8

Refer to the exhibit. A security analyst runs this Kusto Query Language (KQL) query in Microsoft Sentinel. What is being identified?

Accepted Answer

Sign-in attempts by disabled user accounts.. The query filters sign-in logs from the last day with ResultType 50057, which indicates that the user account is disabled. Therefore, the query is identifying sign-in attempts by disabled user accounts. Option A is incorrect because MFA failures have different result types (e.g., 500121, 50074). Option B is incorrect because successful sign-ins have ResultType 0. Option C is incorrect because unknown IP addresses are not identified by ResultType 50057; they would involve other fields or result types.

Answer

Multi-factor authentication failures.

Answer

Successful sign-ins in the last day.

Answer

Sign-in attempts from unknown IP addresses.

Question 9

Which TWO of the following are benefits of using Microsoft Entra ID for identity management? (Choose two.)

Accepted Answer

Conditional Access policies. Correct answers are B and C. Single sign-on (SSO) allows users to access multiple applications with one set of credentials, improving user experience and security. Conditional Access policies enable organizations to enforce access controls based on conditions like user location, device state, or risk level. Option A (storing passwords in plaintext) is never a benefit and is a security risk. Option D (local authentication for all apps) contradicts the cloud-based identity model of Microsoft Entra ID, which centralizes authentication. Option E (on-premises authentication only) is not a benefit as it limits cloud integration and modern features.

Answer

Storing passwords in plaintext

Answer

Local authentication for all apps

Answer

On-premises authentication only

Question 10

Your organization uses Microsoft Sentinel for SIEM. You receive an alert that a user account was compromised. You need to automatically disable the user's access across all cloud apps (SaaS) and reset their password. What should you use?

Accepted Answer

Create a Microsoft Sentinel automated response playbook. Microsoft Sentinel's automated response playbooks, built on Azure Logic Apps, can trigger an incident-based workflow that disables the user in Microsoft Entra ID and resets their password via the Microsoft Graph API. This provides the necessary cross-cloud automation to remediate a compromised account across all SaaS apps without manual intervention.

Answer

Use Microsoft Intune to remote wipe the user's device

Answer

Manually disable the user in Microsoft Entra ID and reset password

Answer

Configure a Microsoft Defender for Cloud Apps session policy

Question 11

A small business wants to enable single sign-on (SSO) for its employees using their existing on-premises Active Directory. They plan to migrate to cloud-based identity management. Which Microsoft service should they use to connect their on-premises directory to Microsoft Entra ID?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory with Microsoft Entra ID, enabling single sign-on (SSO). Option A is correct because it provides the primary and most comprehensive synchronization service for hybrid identity. Option C (AD FS) is for federation, not the primary synchronization service for connecting on-premises AD to Entra ID. Option B (Microsoft Intune) is for device management, not identity synchronization. Option D (Microsoft Entra Cloud Sync) is a lightweight synchronization service that can connect on-premises AD and enable SSO via Password Hash Synchronization; however, Microsoft Entra Connect offers a broader range of SSO methods (including Pass-through Authentication and Seamless SSO) and comprehensive hybrid identity features (like device writeback and custom sync rules), making it the more complete and standard solution for connecting on-premises AD and enabling full SSO as implied by a general migration scenario.

Answer

Microsoft Intune

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Cloud Sync

Question 12

You run the following KQL query in Microsoft Sentinel. What is the purpose of this query?

```kusto
SigninLogs
| where UserPrincipalName == "admin@contoso.com"
| where ResultType == "50126"
| summarize FailedAttempts = count() by IPAddress
| sort by FailedAttempts desc
```

Accepted Answer

To detect potential brute-force attacks against a specific user account. This query filters sign-in logs for a specific user account and failed authentication results, then counts failed attempts by IP address. This pattern is used in Microsoft Sentinel to detect potential brute-force attacks against that specific user account.

Answer

To find all users who signed in from multiple IP addresses

Answer

To identify sign-ins that failed multi-factor authentication

Answer

To list all IP addresses that accessed the tenant

Question 13

Refer to the exhibit. A security administrator is reviewing an Azure Resource Manager template for a virtual machine. What is the purpose of the 'identity' section shown?

Accepted Answer

It assigns a user-assigned managed identity to the VM so it can access other Azure resources securely.. The 'identity' section in this Azure Resource Manager template assigns a user-assigned managed identity to the virtual machine. The 'type' is set to 'UserAssigned' and the 'userAssignedIdentities' property references an existing managed identity by its resource ID. This allows the VM to authenticate to Azure services without storing credentials, using the specified identity. Option D is correct because it accurately describes this behavior.

Answer

It enables system-assigned managed identity for the VM.

Answer

It configures multi-factor authentication for the VM.

Answer

It creates a new managed identity named 'id1' in the resource group.

Question 14

Your organization wants to use Microsoft Entra ID to provide single sign-on (SSO) for a third-party SaaS application. What must you configure in Microsoft Entra ID?

Accepted Answer

Enterprise application registration. Enterprise application registration. To enable SSO for a third-party SaaS application in Microsoft Entra ID, you must register the application as an enterprise application and configure SSO settings. Option A is incorrect because Identity Protection policies are for detecting and responding to identity risks, not for SSO configuration. Option B is incorrect because Conditional Access policies enforce access controls based on conditions, but the prerequisite for SSO is the application registration. Option D is incorrect because self-service password reset is unrelated to SSO setup.

Answer

Identity Protection policy

Answer

Conditional Access policy

Answer

Self-service password reset

Question 15

Refer to the exhibit. You are reviewing a Privileged Identity Management (PIM) configuration for a role in Microsoft Entra ID. The roleDefinitionId corresponds to a specific role. What is the effect of this configuration?

Accepted Answer

The user is eligible for the role indefinitely, but activation requires approval and lasts up to 1 hour.. The configuration shown in the exhibit sets the role assignment to 'Eligible' with an activation duration of 1 hour and requires approval (the approval toggle is on). An 'Eligible' assignment means the user is not permanently active; they must activate the role when needed. The requirement for approval ensures that an authorized approver must approve each activation request. The 1-hour duration limits how long each activation lasts. This matches the description of being eligible indefinitely, with activation requiring approval and lasting up to 1 hour.

Answer

The user is permanently activated for the role for 1 hour.

Answer

The user is permanently assigned the role for 1 hour.

Answer

The user can activate the role without approval for up to 1 hour.

Question 16

A company is migrating its on-premises applications to Azure. The CIO states that the company is fully responsible for managing the security of its own applications and data, while Microsoft is responsible for the security of the underlying physical infrastructure, such as hardware and data centers. This division of security responsibilities is an example of which concept?

Accepted Answer

Shared responsibility model. The scenario directly describes the shared responsibility model, which delineates security obligations between the cloud provider and the customer. Microsoft secures the physical infrastructure (hardware, data centers, networking), while the customer is responsible for securing their own applications, data, and identity management. This division is a foundational concept in cloud computing, explicitly defined in Microsoft's documentation for Azure.

Answer

Defense in depth

Answer

Zero Trust

Answer

Least privilege

Question 17

A company's IT department deploys a multi-layered security strategy that includes a perimeter firewall, network segmentation, endpoint antivirus software, data encryption, and employee security awareness training. Which security model does this approach represent?

Accepted Answer

Defense in Depth. The described approach—combining perimeter firewalls, network segmentation, endpoint antivirus, encryption, and training—is the classic definition of Defense in Depth. This model layers multiple independent security controls so that if one layer fails (e.g., a firewall rule is misconfigured), subsequent layers (e.g., segmentation, antivirus) still protect the asset. It does not assume any single control is sufficient, which is the core principle of Defense in Depth.

Answer

Zero Trust

Answer

Least Privilege

Answer

Shared Responsibility

Question 18

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. You have discovered a new cloud app that employees are using to store corporate data. The app is not sanctioned. You need to sanction the app but also ensure that users cannot upload sensitive data to it. You have configured a session policy to monitor the app. What additional step should you take?

Accepted Answer

Create a file policy in Microsoft Defender for Cloud Apps that detects sensitive data and blocks uploads.. A file policy in Defender for Cloud Apps can detect sensitive data in files and block uploads, allowing the app to be sanctioned while preventing data leakage. Option B is incorrect because blocking the app entirely prevents its use, which is not the goal. Option C is incorrect because Conditional Access policies control access based on conditions like device compliance, not content-based blocking. Option D is incorrect because the session policy currently only monitors; to block uploads based on content, you need a file policy.

Answer

Block the app entirely by adding it to the blocked list.

Answer

Configure a Conditional Access policy to require device compliance for the app.

Answer

Use the session policy to block all uploads to the app.

Question 19

Your organization, Contoso Ltd., has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are deploying Microsoft Defender for Identity (MDI) to protect against identity-based attacks. You have installed the MDI sensor on domain controllers and configured the service with the necessary permissions. After installation, you notice that MDI is not generating alerts for pass-the-hash attacks. You have verified that the sensors are healthy and that audit policies are correctly configured. You need to ensure that MDI can detect pass-the-hash attacks. What should you do?

Accepted Answer

Enable password hash synchronization in Microsoft Entra Connect. The current explanation states: "Enabling password hash synchronization (PHS) in Entra Connect allows MDI to analyze NTLM hashes and detect pass-the-hash attacks." This is incorrect. Password Hash Synchronization (PHS) is a method for synchronizing user password hashes from on-premises Active Directory to Microsoft Entra ID for cloud authentication purposes. MDI's detection of pass-the-hash attacks relies on monitoring NTLM authentication traffic and relevant security events on domain controllers, not on the hashes synchronized to Microsoft Entra ID via PHS. Therefore, enabling PHS does not enable or enhance MDI's ability to detect pass-the-hash attacks on-premises.

Option B is wrong because the MDI sensor is already installed on domain controllers, and installing it on all servers is not the specific missing step for pass-the-hash detection. 
Option C is wrong because pass-the-hash attacks primarily leverage NTLM hashes, and while Kerberos logging is important for other attacks, it's not the primary mechanism for pass-the-hash detection. The stem also states audit policies are correctly configured.
Option D is wrong because multi-factor authentication is a preventative control that strengthens authentication; it does not enable MDI to detect pass-the-hash attacks. Given that the sensors are healthy and audit policies are correctly configured, none of the provided options directly address a common missing configuration for MDI to detect pass-the-hash attacks.

Answer

Install the Azure ATP agent on all servers

Answer

Enable Kerberos event logging on domain controllers

Answer

Configure multi-factor authentication for all users

Question 20

Your company, Fabrikam, uses Microsoft 365 and has Microsoft Purview Information Protection deployed. You need to protect sensitive documents labeled as 'Confidential' so that they cannot be printed or copied when opened in Microsoft Word. You have created a sensitivity label with the appropriate encryption settings. However, users report that they can still print and copy content from these documents. You verify that the label is published and assigned to the correct users. What should you configure to enforce the protection?

Accepted Answer

Configure the sensitivity label to apply an Azure Rights Management template that restricts printing and copying. The sensitivity label must be configured with an Azure Rights Management (RMS) template that specifies user rights, such as denying printing and copying. The label's encryption settings allow applying an RMS template that restricts these actions. Option B is incorrect because conditional access policies control access to resources, not usage rights within documents. Option C is incorrect because auto-labeling policies only automatically apply labels but do not enforce rights. Option D is incorrect because data loss prevention (DLP) policies can detect and block certain actions, but to prevent printing and copying within the document, rights management via RMS is required.

Answer

Implement conditional access policies to block access from unmanaged devices

Answer

Configure auto-labeling policies to apply the label automatically

Answer

Create a data loss prevention policy that blocks printing and copying