SC-900 Practice Exam 70 — 20 Questions

Question 1

A company with Microsoft 365 wants employees to access corporate applications from their personal Android and iOS devices. The security team requires that these devices be enrolled in mobile device management (MDM) for compliance policies, and that company data can be selectively wiped from the device without affecting personal data. Which Microsoft Entra device identity type should they configure for these personal devices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra registered. Microsoft Entra registered is the correct device identity type for personal (BYOD) devices because it supports enrollment in MDM for compliance policies and enables selective wipe of company data without affecting personal data. This identity type registers the device with Entra ID without requiring organizational ownership, allowing users to access corporate applications while maintaining personal data separation.

Answer

Microsoft Entra joined

Answer

Microsoft Entra hybrid joined

Answer

Microsoft Entra managed

Question 2

A company has multiple Azure virtual machines running various workloads. They want a central solution that continuously assesses their security posture, identifies vulnerabilities, and provides recommendations to harden the environment. Which Azure service should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct service because it provides continuous security posture assessment, vulnerability identification, and actionable hardening recommendations across Azure, on-premises, and multi-cloud environments. It integrates with Azure Policy and uses the Secure Score to quantify security posture, making it the central solution described in the scenario.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Microsoft Sentinel

Question 3

A company uses Microsoft Defender for Endpoint to secure its devices, Microsoft Defender for Office 365 for email security, and Microsoft Defender for Identity for on-premises Active Directory. The security team wants a single console to view correlated incidents across these domains, where an incident might combine a suspicious email, a malicious file download, and a compromised account. Which Microsoft solution provides this unified incident view and automatic correlation?

Accepted Answer

Microsoft 365 Defender (now Microsoft Defender XDR). Microsoft 365 Defender (now Microsoft Defender XDR) is the correct answer because it provides a unified incident view across Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity. It automatically correlates alerts from these domains—such as a suspicious email, a malicious file download, and a compromised account—into a single incident, enabling security teams to investigate and respond from one console.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft Purview Compliance Portal

Question 4

A company runs workloads in Azure and Amazon Web Services (AWS). The security team wants a single, unified dashboard to assess the security posture of all cloud resources, get prioritized recommendations for misconfigurations, and enable just-in-time (JIT) virtual machine access across both cloud environments. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct solution because it provides a unified dashboard for assessing security posture across multi-cloud environments, including Azure and AWS. It delivers prioritized recommendations for misconfigurations using the Microsoft cloud security benchmark and supports just-in-time (JIT) VM access to reduce attack surfaces by controlling inbound traffic on demand.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Azure Policy

Question 5

A security analyst needs to investigate a potential malware outbreak that started on an on-premises Windows server several days ago. They want to trace the attack timeline, see which files were modified, and understand how the attacker moved laterally across the network. Which Microsoft solution provides advanced endpoint detection and response (EDR) for on-premises servers?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) provides advanced endpoint detection and response (EDR) capabilities, including behavioral-based detection, automated investigation, and threat analytics. For on-premises Windows servers, MDE can be deployed via Microsoft Defender for Cloud (formerly Azure Security Center) or directly, enabling full attack timeline reconstruction, file modification tracking, and lateral movement path analysis through its rich telemetry and incident graph.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Question 6

A security team manages a hybrid environment with on-premises Windows servers and Azure VMs. They need a solution that can detect lateral movement attacks, pass-the-hash attempts, and anomalous service account behavior on the on-premises Active Directory environment. They also want these alerts to be integrated into Microsoft Defender for Cloud for centralized monitoring. Which Microsoft security solution should they deploy on their on-premises domain controllers?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory traffic and detect advanced threats like lateral movement, pass-the-hash, and anomalous service account behavior. It integrates directly with Microsoft Defender for Cloud to provide centralized alerting and investigation across hybrid environments.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Intune

Question 7

A company uses Microsoft 365 and wants to protect its users from clicking malicious links in phishing emails. The security team needs a solution that rewrites URLs in email messages to check the link at the time of click, and blocks access if the link is malicious. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Links, a feature specifically designed to protect users from malicious URLs in email messages. Safe Links rewrites URLs at the time of delivery, and when a user clicks a link, it checks the destination in real time against threat intelligence; if the link is malicious, access is blocked. This directly matches the requirement to rewrite URLs and perform click-time verification.

Answer

Azure Firewall

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Question 8

A security administrator is using Microsoft Defender for Cloud to improve the security posture of Azure resources. The administrator wants to view a consolidated assessment of compliance with industry standards such as CIS and NIST. Which feature should be used?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a consolidated view of compliance with industry standards like CIS and NIST. It continuously assesses Azure resources against built-in compliance frameworks and displays the results in a dashboard, showing which controls are passing or failing. This directly meets the administrator's need to view a consolidated assessment of compliance with those specific standards.

Answer

Secure Score

Answer

Azure Policy

Answer

Microsoft Sentinel

Question 9

A security operations center (SOC) team needs to ingest security logs from on-premises servers, Azure virtual machines, and SaaS applications like Salesforce. They want a cloud-native solution that uses machine learning to detect threats, provides a unified query language for hunting, and supports automated incident response through playbooks. Which Microsoft solution should they deploy?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution that ingests logs from on-premises servers, Azure VMs, and SaaS applications like Salesforce. It uses built-in machine learning to detect threats, offers the Kusto Query Language (KQL) for unified hunting, and supports automated incident response via playbooks built on Azure Logic Apps.

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Endpoint

Question 10

A security operations center (SOC) receives a high volume of low-fidelity alerts from various security tools. They need a solution that can automatically correlate alerts into incidents, use built-in machine learning to reduce false positives, and provide a unified console for investigation and response across Azure, on-premises, and Microsoft 365. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that ingests high-volume, low-fidelity alerts from multiple sources, correlates them into incidents using built-in analytics and machine learning, and provides a unified console for investigation and response across Azure, on-premises, and Microsoft 365. Its fusion and anomaly detection rules specifically reduce false positives by learning normal behavior patterns, making it the correct choice for this scenario.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 11

A security operations center (SOC) wants to enrich their detection capabilities by automatically correlating internal network logs with external threat intelligence feeds containing known malicious IP addresses and domains. They need to ingest, normalize, and prioritize these indicators and generate alerts when matches are found. Which Microsoft security solution provides built-in capabilities for this purpose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides built-in capabilities to ingest logs from internal network sources, normalize them using common data models, and automatically correlate them with external threat intelligence feeds (e.g., STIX/TAXII). It can prioritize indicators based on severity and generate real-time alerts when matches are found, making it the correct choice for this SOC requirement.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft 365 Defender

Question 12

A company uses Microsoft 365 and stores many business documents in SharePoint Online and OneDrive. The security team wants to automatically detect and block malicious files (e.g., those containing ransomware or other malware) that are uploaded to these document libraries. Files should be scanned and held until proven safe. Which Microsoft security solution should they enable to provide this protection?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Attachments for SharePoint, OneDrive, and Microsoft Teams, which automatically scans files uploaded to these document libraries. If a file is detected as malicious (e.g., ransomware or malware), it is blocked and held in quarantine until it is proven safe, providing the exact protection described in the scenario.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud

Question 13

Which TWO Microsoft Purview compliance solutions are used to manage data retention and deletion?

Accepted Answer

Data Lifecycle Management. Data Lifecycle Management (A) is correct because it enables organizations to apply retention and deletion policies to content based on its age or classification, automatically managing data across SharePoint, OneDrive, Exchange, and Teams. Records Management (C) is correct because it provides a solution for declaring records, applying retention labels that lock content to prevent modification or deletion, and managing disposition reviews for permanent deletion. Both solutions are part of Microsoft Purview's information governance capabilities, specifically designed to control data retention and deletion.

Answer

Data Loss Prevention

Answer

Communication Compliance

Answer

Audit

Question 14

A security analyst receives an alert about a suspicious process on a device. The security solution automatically investigates the device, gathers evidence, and determines that a known malware variant was detected. It then presents an action plan to the analyst for remediation. Which Microsoft security solution provides this automated investigation and response capability?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint provides automated investigation and response (AIR) capabilities that automatically investigate alerts, gather evidence, and determine remediation actions. When a suspicious process is detected, Defender for Endpoint's AIR engine analyzes the device, identifies known malware variants, and presents an action plan to the security analyst for approval or execution.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Question 15

An organization is subject to regulatory requirements that mandate retention of employee records for 5 years after termination. After the retention period, the records must be permanently deleted. The compliance team wants to automatically enforce this process across all Microsoft 365 locations (Exchange, SharePoint, Teams). Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it allows organizations to define retention and deletion policies that apply automatically across Exchange, SharePoint, and Teams. This solution enforces the 5-year retention period after termination and then permanently deletes the records, meeting the regulatory requirement without manual intervention.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Communication Compliance

Question 16

Your organization uses Microsoft Purview Records Management to manage high-value records that must not be deleted. You need to apply a label that marks content as a regulatory record. What label type should you use?

Accepted Answer

Retention label configured for regulatory records. A retention label configured for regulatory records is the correct choice because it locks the label so that no user, including an administrator, can remove it or reduce the retention period. This meets the requirement to mark content as a regulatory record that must not be deleted, as regulatory records provide the highest level of immutability in Microsoft Purview Records Management.

Answer

Data loss prevention policy

Answer

Retention label configured for record

Answer

Sensitivity label

Question 17

Refer to the exhibit. You are reviewing Microsoft Entra sign-in logs. Which statement is true?

Accepted Answer

asmith's sign-in was likely from an application or service principal.. The sign-in log entry for asmith shows an 'Application' sign-in type, which indicates the authentication was performed by an application or service principal rather than a user. In Microsoft Entra ID, sign-ins from applications or service principals are logged with a distinct sign-in type, and the exhibit displays 'Application' for asmith's entry, confirming this.

Answer

jdoe's sign-in had no risk detected.

Answer

jdoe's sign-in failed Conditional Access.

Answer

asmith's sign-in had a high risk level.

Question 18

A company wants to automatically prevent users from sharing files containing personal data (e.g., passport numbers) via email. Which Microsoft Purview solution should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect and automatically block the sharing of sensitive information, such as passport numbers, via email. DLP policies use deep content analysis (e.g., regular expressions, keyword matching, and data classification) to inspect email attachments and body text in transit, and can enforce actions like blocking the message or sending a policy tip to the user. This aligns directly with the requirement to prevent users from sharing files containing personal data through email.

Answer

Communication Compliance

Answer

Sensitivity labels

Answer

eDiscovery

Question 19

A company manages Azure resources for multiple departments. The security team needs to grant IT administrators temporary, just-in-time access to high-privilege roles (e.g., Contributor, Owner) only when needed, with approval workflows. Which Microsoft Entra ID capability should they configure?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is the correct Microsoft Entra ID capability because it provides just-in-time (JIT) activation of high-privilege roles like Contributor and Owner, with time-bound approvals and approval workflows. PIM allows administrators to request temporary elevation to a role, which must be approved by designated approvers, and the access automatically expires after the specified duration. This directly addresses the requirement for temporary, approval-based access to privileged roles.

Answer

Conditional Access

Answer

Identity Protection

Answer

Entitlement Management (Identity Governance)

Question 20

Refer to the exhibit. A Microsoft Purview DLP policy is configured in Test mode. An administrator notices that a user is still able to share a document containing a credit card number. What is the most likely reason?

Accepted Answer

The policy is in Test mode, so actions are not enforced. When a Microsoft Purview DLP policy is configured in Test mode, it logs policy matches and generates alerts but does not enforce any restrictive actions such as blocking access or sharing. The administrator observed that the user could still share the document because Test mode explicitly disables action enforcement, allowing the organization to evaluate the policy's impact before moving to Enforce mode.

Answer

The credit card number is not detected because low confidence threshold

Answer

The BlockAccess action is not supported for SharePoint Online

Answer

The policy requires an administrator to approve the action