SC-900 Practice Exam 69 — 20 Questions

Question 1

Your organization has implemented Microsoft Defender for Cloud to protect Azure resources. You are responsible for security posture management. You need to ensure that all Azure VMs have the latest security updates installed. You have enabled automatic VM patching via Azure Update Manager. However, some VMs are not receiving updates because they are not registered with the Update Manager. You need to identify which VMs are missing updates and ensure they are patched. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs.. Microsoft Defender for Cloud provides the recommendation 'System updates should be installed on your machines' that identifies VMs missing updates, including those not registered with Azure Update Manager. Option A is incorrect because Azure Policy can enforce compliance but does not directly identify missing updates. Option C is incorrect because Azure Update Manager's compliance view shows update status for registered VMs but may not show unregistered VMs. Option D is incorrect because security alerts are for threats, not missing updates.

Answer

Create an Azure Policy to enforce automatic updates on all VMs.

Answer

Review Microsoft Defender for Cloud security alerts for 'Missing system updates'.

Answer

Use Azure Update Manager's compliance view to export a list of VMs with missing updates.

Question 2

You are the security administrator for a small business that uses Microsoft 365 Business Premium. The company wants to enable multi-factor authentication (MFA) for all users. You need to ensure that users are prompted for MFA when they sign in from unfamiliar locations or devices. The solution should be easy to deploy without additional licensing. Which of the following should you configure?

Accepted Answer

Enable security defaults in Microsoft Entra ID. Security defaults are a pre-configured set of security policies that include MFA based on risk, specifically prompting for MFA when users sign in from unfamiliar locations or devices, and are available without additional licensing. Option A is incorrect because while Conditional Access policies are available with Microsoft 365 Business Premium (which includes Microsoft Entra ID P1), a simple policy requiring MFA for *all* cloud apps would prompt for MFA every time, not specifically when signing in from unfamiliar locations or devices. To achieve risk-based MFA with Conditional Access that specifically targets unfamiliar locations/devices, more advanced configurations or potentially Microsoft Entra ID P2 features (for advanced sign-in risk detection) might be needed, which would go against the 'easy to deploy' and 'no additional licensing' constraints if P2 is implied. Security defaults provide this risk-based MFA out-of-the-box without complex configuration or P2 licensing. Option C is incorrect because deploying the Microsoft Authenticator app alone does not enforce MFA; a policy such as security defaults or conditional access is needed to prompt for MFA based on location or device. Option D is incorrect because identity protection risk-based MFA requires Azure AD Premium P2 licensing, which is not included in Business Premium.

Answer

Create a conditional access policy in Microsoft Entra ID that requires MFA for all cloud apps

Answer

Deploy the Microsoft Authenticator app and instruct users to enable it

Answer

Configure identity protection to enable risk-based MFA

Question 3

You are the security administrator for a large healthcare organization that uses Microsoft 365 E5. The organization must comply with HIPAA and GDPR regulations. You have implemented Microsoft Purview Information Protection with sensitivity labels to classify and protect patient data. Recently, the compliance team identified that some documents containing Protected Health Information (PHI) are being shared externally without protection. You need to prevent users from sharing documents classified as 'Highly Confidential' with external users unless the document is encrypted and labeled. Additionally, you must ensure that any external sharing of such documents is automatically blocked. You have the following options available. Which action should you take?

Accepted Answer

Create a data loss prevention (DLP) policy in Microsoft Purview that detects the 'Highly Confidential' label and blocks sharing with external users. The correct action is to create a DLP policy in Microsoft Purview that detects the 'Highly Confidential' label and blocks sharing with external users. DLP policies are designed to inspect content and labels on documents, then take protective actions such as blocking external sharing, sending notifications, or applying restrictions. Auto-labeling (option A) applies labels automatically but does not enforce sharing restrictions. Conditional access policies (option C) control access at the authentication level, not based on document labels. Retention policies (option D) manage data lifecycle, not sharing permissions.

Answer

Configure auto-labeling for SharePoint to automatically apply the 'Highly Confidential' label to all documents containing PHI

Answer

Configure a conditional access policy in Microsoft Entra ID to block external access to SharePoint sites containing PHI

Answer

Create a retention policy for SharePoint that prevents deletion of documents with the 'Highly Confidential' label

Question 4

Your organization, Northwind Traders, uses Microsoft Intune to manage Windows 10 devices. You have created a compliance policy that requires devices to have BitLocker enabled. After assigning the policy, you notice that some devices are reporting as non-compliant due to BitLocker not being enabled. You have verified that the devices support BitLocker and that the policy is correctly assigned. You need to ensure that BitLocker is enabled on these devices automatically. What should you do?

Accepted Answer

Create an endpoint protection configuration profile to enable BitLocker. An endpoint protection configuration profile in Microsoft Intune can be used to enforce BitLocker settings on Windows 10 devices automatically. This profile applies the necessary encryption policies without manual intervention. Option A is wrong because modifying the compliance policy to allow non-compliant devices does not enable BitLocker; it only accepts the non-compliant status. Option C is wrong because Windows update ring policies control update deployment, not BitLocker configuration. Option D is wrong while a PowerShell script could enable BitLocker, it is not the standard or recommended method within Intune; configuration profiles provide a managed, scalable solution.

Answer

Modify the compliance policy to allow non-compliant devices

Answer

Create a Windows update ring policy

Answer

Use a PowerShell script to enable BitLocker manually

Question 5

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a compliant antivirus solution can access corporate email. Which policy type should be configured?

Accepted Answer

Conditional Access policy in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID evaluate signals such as device compliance status before granting access to cloud apps like corporate email. By integrating with Intune device compliance policies, they can block access from devices that lack a compliant antivirus solution. This is the correct mechanism because Conditional Access enforces the access decision at the authentication layer, not just at the device management layer.

Answer

App protection policy in Microsoft 365

Answer

Device compliance policy in Intune

Answer

Security baseline in Microsoft Defender for Cloud

Question 6

Tailspin Toys is a toy manufacturer with headquarters in the US and subsidiaries in Europe and Asia. You are the compliance administrator. The company must comply with the EU General Data Protection Regulation (GDPR). Requirements: 1) Personal data of EU residents must be retained only for as long as necessary (max 5 years after last interaction). 2) If a user tries to share personal data outside the EU, the action must be blocked. 3) Users must be able to manually mark documents as 'GDPR High Risk' which will encrypt them and add a watermark 'GDPR PROTECTED'. 4) All access to personal data must be audited. You have Microsoft Purview with E5 compliance licenses. What is the most efficient solution?

Accepted Answer

Create an auto-labeling policy to apply a 'Personal Data' sensitivity label; create a retention label 'GDPR Retention' to auto-apply to personal data and retain for 5 years; create a DLP policy to block sharing of labeled personal data outside EU; create a separate sensitivity label 'GDPR High Risk' for manual application with encryption and watermark; enable audit logging. The most efficient because it uses a retention label 'GDPR Retention' with auto-labeling to automatically retain personal data for 5 years, precisely meeting requirement 1. It creates a DLP policy to block sharing of labeled personal data outside the EU, satisfying requirement 2. It provides a separate sensitivity label 'GDPR High Risk' for manual application with encryption and watermark, meeting requirement 3. Audit logging is enabled for requirement 4. Option A uses a retention policy on all content, which is too broad and not specific to personal data. Option C lacks a manual sensitivity label for high-risk documents. Option D attempts to use a single sensitivity label for both automatic and manual scenarios, which is less flexible and may not apply encryption/watermark correctly for manual labeling.

Answer

Use a retention policy to delete all content after 5 years; create a DLP policy to block sharing of personal data outside EU; create a sensitivity label for manual application with encryption and watermark; enable audit logging

Answer

Use a retention policy to delete personal data after 5 years; create a DLP policy to block cross-border sharing; use a sensitivity label with auto-labeling for personal data; enable audit logging

Answer

Create a DLP policy to block sharing of personal data outside EU; use a retention label for 5 years; use a single sensitivity label for both automatic and manual scenarios; enable audit logging

Question 7

Your organization is adopting a Zero Trust security model. You are tasked with implementing identity protection. The requirements are: enforce multi-factor authentication (MFA) for all users when accessing cloud applications, ensure that risky sign-ins are detected and blocked automatically, and provide administrators with a dashboard showing user risk levels. You have Microsoft Entra ID P2 licenses. What should you configure?

Accepted Answer

Configure a Conditional Access policy to require MFA for all cloud apps, enable Identity Protection to detect and automatically block risky sign-ins, and use the Identity Protection dashboard.. A Conditional Access policy enforces MFA for all cloud apps, Identity Protection detects and automatically blocks risky sign-ins, and the Identity Protection dashboard provides a view of user risk levels. Option A is incorrect because Microsoft Sentinel is a SIEM for security information and event management, not for identity protection. Option C is incorrect because Privileged Identity Management (PIM) manages privileged access roles, not general MFA or risk detection. Option D is incorrect because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) for cloud app security, not for identity risk detection.

Answer

Configure Microsoft Sentinel to collect sign-in logs and create custom alerts for risky sign-ins.

Answer

Configure Privileged Identity Management for all users and enable MFA.

Answer

Configure Microsoft Defender for Cloud Apps to require MFA and detect risky sign-ins.

Question 8

You are a compliance officer for a law firm that uses Microsoft 365 E5 licenses. The firm must comply with GDPR. You need to implement a solution that automatically identifies personal data (e.g., email addresses) in SharePoint Online documents and applies a 'GDPR-Protected' sensitivity label. Additionally, you need to ensure that if a user attempts to share a labeled document externally, they receive a policy tip warning about GDPR compliance, but the share is not blocked. You have Microsoft Purview. What should you configure?

Accepted Answer

Create an auto-labeling policy to apply the 'GDPR-Protected' label to documents containing email addresses, and create a DLP policy for labeled documents that shows a policy tip when shared externally.. An auto-labeling policy can automatically detect personal data (e.g., email addresses) and apply the 'GDPR-Protected' sensitivity label. Then, a separate DLP policy configured for labeled documents can show a policy tip when users attempt to share them externally, warning about GDPR compliance without blocking the share. Option B is incorrect because a retention policy does not apply sensitivity labels or provide DLP policy tips. Option C is incorrect; publishing a sensitivity label only allows manual application by users, not automatic labeling, and it does not include DLP policy tips. Option D is incorrect because without applying the label, the DLP policy would not target only the labeled documents as required, and the policy tip would not be associated with the specific 'GDPR-Protected' label context.

Answer

Create a retention policy to tag documents containing email addresses.

Answer

Create a sensitivity label policy that publishes the 'GDPR-Protected' label to users and train them to apply it manually.

Answer

Create a DLP policy that detects email addresses and shows a policy tip, but do not apply a label.

Question 9

Contoso Ltd. is a financial services company that must comply with strict regulatory requirements. They use Microsoft 365 E5, Microsoft Entra ID P2, Microsoft Purview, and Microsoft Defender for Cloud Apps. The compliance team needs to implement a data loss prevention (DLP) policy that detects and prevents the sharing of credit card numbers in Microsoft Teams messages. Additionally, they want to ensure that only users with a specific custom sensitivity label can access documents containing credit card numbers. The sensitivity label is named 'Financial-Confidential' and is applied automatically via auto-labeling. The DLP policy should block sharing of credit card numbers in Teams but allow users to override the block with a business justification. Which combination of actions should you configure in the Microsoft Purview DLP policy to meet these requirements?

Accepted Answer

Create a DLP policy in Microsoft Purview that blocks sharing of credit card numbers in Teams and allows overrides with business justification. Configure the policy to apply to content containing the 'Financial-Confidential' sensitivity label.. It creates a DLP policy in Microsoft Purview that blocks sharing of credit card numbers in Teams and allows overrides with business justification, and it scopes the policy to content containing the 'Financial-Confidential' sensitivity label, meeting all requirements. Option A is incorrect because it does not allow overrides, so users cannot provide business justification. Option B is incorrect because a session policy in Microsoft Defender for Cloud Apps is not the appropriate method; DLP policies for Teams content should be configured in Microsoft Purview. Option D is incorrect because using the built-in DLP template for financial data may not allow integration with the custom sensitivity label 'Financial-Confidential', and the requirement is to apply the policy specifically to content with that label.

Answer

Create a DLP policy in Microsoft Purview that blocks sharing of credit card numbers in Teams and does not allow overrides. Configure the policy to apply to all content.

Answer

Configure a session policy in Microsoft Defender for Cloud Apps that monitors Teams for credit card numbers and blocks sharing. Use the 'Block with override' action.

Answer

Use the built-in DLP template for financial data in Microsoft Purview and enable the 'Block with override' action. Set the scope to Teams.

Question 10

Which TWO are capabilities of Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Session control to monitor user activity in cloud apps. Microsoft Defender for Cloud Apps includes session control capabilities, which allow administrators to monitor and control user activity in real time within cloud applications. This is achieved through reverse proxy integration, enabling granular access policies and data loss prevention (DLP) actions during active sessions.

Answer

Endpoint detection and response (EDR)

Answer

Identity protection for user accounts

Answer

Data classification of on-premises files

Question 11

A company uses Microsoft Entra ID. The security team wants to enforce multifactor authentication (MFA) only when users sign in from devices that are not compliant with company security policies. They also want to block sign-ins from unknown geographic locations. Which Microsoft Entra feature should they configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it allows administrators to create policies that evaluate signals such as device compliance and geographic location before granting access. By configuring a policy that requires MFA for non-compliant devices and blocks sign-ins from unknown locations, the security team can enforce these specific conditions. This granular control is unique to Conditional Access, which integrates with Microsoft Entra ID to enforce access decisions based on real-time risk and context.

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Self-Service Password Reset (SSPR)

Question 12

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to receive alerts when a user attempts to share a file containing personally identifiable information (PII) via email. Which DLP rule component is used to define the notification action?

Accepted Answer

Actions. In Microsoft Purview DLP, the 'Actions' component defines what happens when a DLP rule is triggered, including sending notifications or alerts to administrators. For the scenario of receiving alerts when a user attempts to share PII via email, the notification action is configured within the rule's Actions section. Conditions define what data to match, Locations specify where to monitor, and Exceptions refine rule scope, but only Actions contain the notification settings.

Answer

Conditions

Answer

Location

Answer

Exceptions

Question 13

A company implements a security policy where employees must use a smart card to log into their workstations. After logging in, they can only access file shares that correspond to their department. Which two security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The smart card login verifies the user's identity, which is authentication. The subsequent restriction to department-specific file shares controls what resources the user can access, which is authorization. Non-repudiation is not demonstrated because the scenario lacks any mechanism (such as audit logs or digital signatures) that would prevent the user from denying the login action. Therefore, only authentication and authorization are demonstrated, making Option A the sole correct answer.

Answer

Identification and accounting

Answer

Authorization and non-repudiation

Answer

Confidentiality and integrity

Question 14

Which THREE of the following are capabilities of Microsoft Defender for Office 365?

Accepted Answer

Safe Links protection in email and Office documents. Safe Links is a core capability of Microsoft Defender for Office 365 that proactively scans URLs in email messages and Office documents (like Word, Excel, and PowerPoint) at the time of click. Safe Attachments scans email attachments in a detonation chamber before delivery to detect malicious content. Anti-phishing policies protect users from impersonation attacks by analyzing sender identity and email patterns. Together, these three features provide multi-layered protection against email-borne threats.

Answer

Cloud discovery of unsanctioned SaaS apps

Answer

Device compliance policies for mobile devices

Question 15

You are deploying Microsoft Entra Verified ID to issue verifiable credentials for employee onboarding. Which component is required to issue credentials?

Accepted Answer

A decentralized identifier (DID) for your organization. Microsoft Entra Verified ID requires a decentralized identifier (DID) for your organization to issue verifiable credentials. The DID serves as the cryptographic anchor that proves your organization's authority to issue credentials, as it is registered on a decentralized ledger (ION) and linked to your public keys. Without a DID, the verifiable credentials cannot be cryptographically signed and verified by relying parties.

Answer

A public key infrastructure (PKI) certificate

Answer

A custom application registered in Microsoft Entra ID

Answer

A blockchain node for the decentralized ledger

Question 16

A company uses Azure resources, on-premises servers, and third-party cloud apps. The security team wants a single solution to collect security logs from all these sources, detect threats using advanced analytics, and automate responses to incidents. Which Microsoft security solution should they use?

Accepted Answer

C. A cloud-native SIEM and SOAR solution that can ingest logs from Azure resources, on-premises servers, and third-party cloud apps. It uses advanced analytics with built-in machine learning to detect threats and supports automated incident response. The other options represent different Microsoft security tools that lack the full SIEM/SOAR capabilities required for this scenario.

Answer

A

Answer

B

Answer

D

Question 17

You are a security analyst using Microsoft Sentinel. You run the following Kusto query:

SecurityAlert
| where TimeGenerated > ago(7d)
| where AlertName contains "MFA"
| summarize Count = count() by bin(TimeGenerated, 1d)
| render timechart

What does this query do?

Accepted Answer

Counts security alerts containing 'MFA' per day for the last 7 days. The Kusto query filters security alerts containing 'MFA' in the alert name over the last 7 days, counts the number of alerts per day, and renders a timechart. Option B is incorrect because the query counts alerts, not identities. Option C is incorrect because it counts alerts, not distinct users. Option D is incorrect because the query does not filter by severity.

Answer

Lists all identities that triggered MFA alerts

Answer

Counts distinct users with MFA alerts per day

Answer

Counts alerts by severity over the last week

Question 18

A company uses Microsoft Purview Information Protection to classify and label sensitive documents. The compliance team wants to automatically apply a 'Confidential' label to documents containing an employee's passport number. Which method should they use?

Accepted Answer

Auto-labeling policy. An auto-labeling policy in Microsoft Purview Information Protection automatically applies sensitivity labels to documents and emails based on sensitive information types (e.g., passport numbers) without user intervention. This method uses content scanning to detect patterns and enforce labeling rules, making it the correct choice for the compliance team's requirement.

Answer

Manual labeling by users

Answer

Trainable classifiers

Answer

DLP policy

Question 19

An organization wants to protect its fleet of Windows 10 laptops from advanced malware and ransomware. The solution must detect suspicious behavior (e.g., a process encrypting files) and provide security teams with the ability to isolate an infected device from the network for investigation. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities, including behavioral-based detection of advanced malware and ransomware (e.g., detecting a process encrypting files via machine learning and behavioral analytics). It also includes automated investigation and remediation features, such as the ability to isolate an infected device from the network (device isolation) to prevent lateral movement while allowing security teams to investigate.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Question 20

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to assess compliance with the CIS benchmark. What should you enable?

Accepted Answer

Regulatory compliance standards in Microsoft Defender for Cloud. To assess compliance with the CIS benchmark in Microsoft Defender for Cloud, you must enable the appropriate regulatory compliance standard. Defender for Cloud includes built-in support for industry standards like CIS, and by adding the CIS benchmark as a regulatory compliance standard, the service continuously assesses your Azure resources against the CIS controls and displays compliance status in the dashboard.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Firewall