SC-900 Practice Exam 70 — 20 Questions

Question 1

You are reviewing a conditional access policy in Microsoft Entra ID. The policy is enabled, applies to all cloud apps, and is configured to include users assigned to the Global Administrator or Exchange Administrator roles. Which users are affected by this policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

All users who are members of the Global Administrator or Exchange Administrator role. The conditional access policy specifies 'includeRoles' with the Global Administrator and Exchange Administrator roles, meaning only users assigned to either of those roles are affected. Option A is incorrect because the policy does not apply to all administrative roles, only the two specified. Option B is incorrect because it applies to both Global Administrator and Exchange Administrator, not just Global Administrator. Option D is incorrect because the policy does not apply to all users in the organization.

Answer

All users who are members of any Azure AD administrative role

Answer

All users who are members of the Global Administrator role only

Answer

All users in the organization

Question 2

A user reports that they are repeatedly prompted for multifactor authentication when accessing Microsoft 365 apps from the same trusted device. What should you do to reduce the number of prompts?

Accepted Answer

Configure 'Remember MFA' settings in Conditional Access. The 'Remember MFA' setting in Conditional Access allows administrators to configure the session lifetime for MFA prompts on trusted devices. By extending the 'MFA reauthentication frequency' or enabling 'Remember Multifactor Authentication' for a longer period (e.g., 30 days), users will not be repeatedly challenged on the same device, reducing friction while maintaining security.

Answer

Disable MFA for the user

Answer

Change the user's MFA method to text message

Answer

Reset the user's MFA registration

Question 3

Your organization implements a Microsoft Entra ID tenant with a custom domain (contoso.com). You need to ensure that all users are assigned a unique user principal name (UPN) based on their email address. What should you do?

Accepted Answer

Configure the user naming attribute to use the email address as the UPN. To ensure users are assigned a UPN based on their email address in Microsoft Entra ID, administrators must manually set the UPN during user creation or modification. For new users, this involves entering the desired email address (or its prefix) as the 'User name' and selecting the appropriate custom domain suffix. For existing users, their UPNs can be updated in bulk using PowerShell or the Microsoft Entra admin center's bulk operations feature to match their email addresses. While there isn't a single 'user naming attribute' setting that automates this process globally, the action of configuring the UPN for each user to match their email address is the necessary step.

Answer

Verify the custom domain in Microsoft Entra ID

Answer

Enable Microsoft Entra ID Domain Services

Answer

Use Microsoft Entra ID Connect to sync UPNs from on-premises

Question 4

A company wants to detect and respond to advanced attacks targeting their on-premises Active Directory infrastructure, such as Kerberos Golden Ticket attacks, pass-the-hash, and brute-force attempts. The solution should integrate with Microsoft Sentinel and Microsoft 365 Defender for cross-domain investigations. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is specifically designed to protect on-premises Active Directory by monitoring for advanced attacks like Kerberos Golden Ticket, pass-the-hash, and brute-force attempts. It integrates natively with Microsoft Sentinel and Microsoft 365 Defender to enable cross-domain investigations, correlating identity signals with endpoint and cloud data.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Question 5

An organization has deployed Microsoft Entra ID Governance and wants to automate the process of revoking access to a critical application when an employee leaves the company. Which feature should they configure?

Accepted Answer

Microsoft Entra ID Governance Lifecycle Workflows. Microsoft Entra ID Governance Lifecycle Workflows enable automated workflows triggered by HR events like employee termination. When an employee leaves, a lifecycle workflow can be configured to automatically remove the user from the application's access group or disable their account, ensuring immediate revocation of access without manual intervention.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Access Reviews

Answer

Microsoft Entra Terms of Use

Question 6

Your organization uses Microsoft Sentinel. You need to create an automation rule that automatically closes a low-severity incident after 24 hours of inactivity. Which action should you include in the rule?

Accepted Answer

Change status to Closed. Changing the status to 'Closed' is the direct action needed to automatically resolve a low-severity incident after a period of inactivity in Microsoft Sentinel. Automation rules can trigger status changes based on conditions like time elapsed, and closing the incident removes it from the active queue without manual intervention.

Answer

Run playbook

Answer

Create incident

Answer

Add comment

Question 7

Refer to the exhibit. The KQL query is run in Microsoft Defender for Endpoint. What is the purpose of this query?

Accepted Answer

To find devices with a high number of operations on potentially sensitive files.. The KQL query filters for `DeviceFileEvents` where `SensitivityLabel` is not empty, indicating files with sensitivity labels applied (e.g., confidential, internal). It then summarizes the count of operations per device and orders by the highest count. This identifies devices with a high number of operations on potentially sensitive files, aligning with data loss prevention (DLP) monitoring.

Answer

To list all devices that have files named confidential.

Answer

To detect malware on devices.

Answer

To list all file creation events.

Question 8

Which TWO Microsoft Entra ID capabilities help detect and remediate identity risks? (Select two.)

Accepted Answer

Identity Protection. Identity Protection (A) is correct because it uses machine learning and heuristics to detect identity-based risks such as leaked credentials, impossible travel, and anomalous sign-in behavior. It provides automated remediation actions like requiring password reset or blocking sign-in, directly addressing risk detection and remediation.

Answer

Identity Governance

Answer

Password protection

Answer

Privileged Identity Management

Question 9

An organization wants to automatically retain all financial documents for seven years and then delete them. Which Microsoft Purview solution should be used to create the retention policy?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it provides retention and deletion policies that can automatically retain data for a specified period (e.g., seven years) and then permanently delete it. This solution is designed specifically for managing the lifecycle of content across Exchange, SharePoint, OneDrive, and Teams, making it ideal for regulatory compliance requirements like financial document retention.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Communication Compliance

Question 10

Your organization uses Microsoft Purview to manage records. For legal reasons, you need to preserve all documents related to a specific litigation case and prevent any modification or deletion. Which feature should you use?

Accepted Answer

eDiscovery (Premium) legal hold. eDiscovery (Premium) legal hold is the correct feature because it preserves content in-place by placing a hold on data sources (e.g., Exchange mailboxes, SharePoint sites, OneDrive accounts) associated with a specific litigation case. This prevents any modification or deletion of documents while the hold is active, ensuring compliance with legal preservation requirements. Unlike retention labels, which manage lifecycle policies, legal hold is designed specifically for litigation scenarios to freeze data immutably.

Answer

Retention labels

Answer

Data Loss Prevention

Answer

Audit logs

Question 11

A healthcare organization stores patient records in SharePoint Online. The compliance officer needs to ensure that records containing Protected Health Information (PHI) are retained for 7 years per regulatory requirements. Which Microsoft Purview solution should they implement?

Accepted Answer

Microsoft Purview Records Management. Microsoft Purview Records Management is the correct solution because it enables organizations to apply retention labels and policies that enforce mandatory retention periods for regulatory compliance. For patient records containing PHI, a retention label can be configured to retain the data for exactly 7 years and then trigger a disposition review or automatic deletion, ensuring the organization meets healthcare regulatory requirements.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Lifecycle Management

Question 12

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive credit card numbers via email. The DLP policy must trigger automatically when a user attempts to send an email containing a credit card number. Which DLP configuration should you use?

Accepted Answer

Create a DLP policy with a condition that matches the Credit Card Number sensitive info type and an action to block the email. Microsoft Purview DLP policies can be configured to detect sensitive information types, such as the Credit Card Number (defined by regex and checksum validation per PCI DSS), and automatically apply an action to block the email from being sent. This meets the requirement for automatic, policy-driven prevention of sharing credit card numbers via email.

Answer

Configure Double Key Encryption for the Exchange Online mailbox

Answer

Configure a Safe Links policy in Microsoft Defender for Office 365

Answer

Use Microsoft Purview Customer Key for encryption

Question 13

A company uses Microsoft 365 and needs to automatically detect documents in SharePoint Online that contain personally identifiable information (PII) such as social security numbers. When such documents are detected, they want to apply a sensitivity label that encrypts the document and restricts access to only the compliance team. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically scan documents in SharePoint Online for sensitive information types (e.g., social security numbers) using built-in or custom sensitive info types. When a match is found, DLP policies can trigger an action to apply a sensitivity label that encrypts the document and restricts access, such as limiting it to the compliance team. This combines content detection with automated protection, which is exactly the scenario described.

Answer

Data Lifecycle Management

Answer

Records Management

Answer

Communication Compliance

Question 14

A company has enabled Microsoft Defender for Cloud. They want to assess their Azure resources for compliance with security benchmarks like CIS and Azure Security Benchmark, and view a secure score. Which feature of Defender for Cloud provides this capability?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is the Defender for Cloud feature specifically designed to assess Azure resources against industry security benchmarks such as CIS and the Azure Security Benchmark. It continuously evaluates your environment, provides a secure score based on compliance findings, and offers actionable recommendations to improve your security posture. This directly matches the scenario's requirement for benchmark compliance assessment and secure score visibility.

Answer

Microsoft Defender for Servers

Answer

Microsoft Defender for App Service

Answer

Just-in-time (JIT) VM access

Question 15

Your organization needs to automatically detect and prevent accidental sharing of sensitive data in Microsoft Teams messages. Which Microsoft Purview solution should you use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct solution because it is specifically designed to automatically detect and prevent accidental sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), in Microsoft Teams messages. DLP policies can scan messages in real time, apply actions like blocking the message or sending a policy tip to the user, and integrate with Microsoft Teams' chat and channel infrastructure. This directly addresses the requirement for automatic detection and prevention of accidental data sharing.

Answer

Retention policies

Answer

eDiscovery

Answer

Sensitivity labels

Question 16

An organization wants to allow users to reset their own passwords without help desk intervention. They also need to enforce multifactor authentication during the reset process. Which Microsoft Entra feature should they configure?

Accepted Answer

Microsoft Entra Self-Service Password Reset. Microsoft Entra Self-Service Password Reset (SSPR) allows users to reset their own passwords without help desk intervention. By integrating with Microsoft Entra Multifactor Authentication, SSPR can enforce MFA during the reset process, satisfying both requirements.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Multifactor Authentication

Question 17

A compliance officer is tasked with continuously assessing the organization's compliance posture against GDPR and ISO 27001. The solution should generate a compliance score based on implemented controls, provide recommended improvement actions, and track remediation progress over time. Which Microsoft Purview solution should they use?

Accepted Answer

Compliance Manager. Compliance Manager is the correct solution because it provides a continuous compliance score based on implemented controls, offers recommended improvement actions, and tracks remediation progress over time. It supports frameworks like GDPR and ISO 27001 by mapping controls to assessments and generating a dynamic score that reflects the organization's compliance posture.

Answer

Audit (Premium)

Answer

Communication Compliance

Answer

Data Lifecycle Management

Question 18

A security architect is designing a system where user access rights are reviewed and certified on a regular basis by data owners. The goal is to ensure that users continue to have only the permissions necessary to perform their job functions and that no excessive permissions exist. Which security principle is primarily being implemented through these regular reviews?

Accepted Answer

Least privilege. Regular access reviews directly enforce the principle of least privilege by ensuring users retain only the permissions necessary for their current job functions. This process identifies and removes excessive permissions that may have accumulated over time, aligning with the core goal of minimizing the attack surface. In Microsoft 365, this is often implemented through Azure AD access reviews, where data owners certify or revoke user access.

Answer

Defense in depth

Answer

Zero trust

Answer

Separation of duties

Question 19

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy JSON snippet. The policy is enabled and contains one rule. What is the effect of this rule?

Accepted Answer

Blocks access to content containing a credit card number in Exchange and SharePoint, without user notification.. The JSON snippet shows a DLP rule with an action of 'BlockAccess' and 'NotifyUser' set to 'False', meaning the rule blocks access to content containing a credit card number in both Exchange and SharePoint (the locations are not restricted to a single workload). Since 'NotifyUser' is false, no policy tip or email notification is sent to the user. Therefore, the correct effect is that access is blocked without user notification, matching option D.

Answer

Applies only to SharePoint, not Exchange.

Answer

Only audits the activity, does not block.

Answer

Blocks access and sends a policy tip to users.

Question 20

Your organization wants to use Microsoft Entra Verified ID to issue digital credentials to employees. Which Microsoft Entra service provides the ability to issue and verify verifiable credentials?

Accepted Answer

Microsoft Entra Verified ID. Microsoft Entra Verified ID is the specific service designed to issue and verify verifiable credentials based on decentralized identity standards such as W3C Verifiable Credentials and Decentralized Identifiers (DIDs). It enables organizations to create, issue, and cryptographically verify digital credentials without relying on a central authority, aligning with the scenario described.

Answer

Microsoft Entra Entitlement Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management