SC-900 Mock Exam 71 — 25 Questions

Question 1

Your organization uses Microsoft Intune and Microsoft Entra ID. You need to enforce that only compliant and managed devices can access corporate email in Microsoft 365. Additionally, if a device is jailbroken, access should be blocked. You also want to provide a seamless sign-in experience for compliant devices. You have Microsoft Entra ID P1 licenses. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance and use Intune compliance policies to block jailbroken devices, with seamless SSO.. To enforce that only compliant and managed devices access corporate email, and to block jailbroken devices, the correct approach is a Conditional Access policy in Microsoft Entra ID that requires device compliance, combined with Intune compliance policies that detect and block jailbroken devices. Enabling seamless SSO provides the desired sign-in experience for compliant devices. This combination satisfies all stated requirements with Entra ID P1 licensing.

Answer

Configure Mobile Application Management (MAM) policies to restrict access.

Answer

Configure Azure AD Join for all devices and enable device registration.

Answer

Configure Microsoft Defender for Endpoint to detect jailbroken devices.

Question 2

A company uses Azure virtual machines (IaaS) and on-premises Windows servers. The security team needs a single solution that provides a continuous assessment of security posture, a regulatory compliance dashboard for NIST SP 800-53, and integrated threat detection for hybrid workloads (e.g., brute force attacks on SSH). Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct choice because it provides continuous assessment of security posture (via the Secure Score), a regulatory compliance dashboard with built-in standards like NIST SP 800-53, and integrated threat detection for hybrid workloads, including brute force attacks on SSH for Azure VMs and on-premises servers. It unifies these capabilities across IaaS, on-premises, and other cloud environments, making it the single solution the security team needs.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Question 3

A company needs to allow external business partners to securely access internal SharePoint Online sites and Teams channels. The partners use various identity providers, including Microsoft Entra ID and Google. The company wants to manage these external users in their directory and assign access policies. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra External ID (B2B Collaboration). Microsoft Entra External ID (B2B Collaboration) is the correct capability because it allows the company to invite external business partners (B2B users) from any identity provider, including Microsoft Entra ID and Google, into their own Microsoft Entra directory. This enables the company to manage these external users in their directory, assign conditional access policies, and grant them secure access to internal SharePoint Online sites and Teams channels without requiring a separate application or customer-facing identity system.

Answer

Microsoft Entra B2C (Business to Customer)

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Identity Protection

Question 4

A multinational corporation must comply with several regulations including GDPR, ISO 27001, and NIST. They need a single solution that provides a compliance score, tracks their progress, and recommends specific improvement actions that can be assigned to different departments. Which Microsoft Purview solution meets these requirements?

Accepted Answer

A. Microsoft Purview Compliance Manager provides a unified compliance score, tracks progress over time, and offers recommended improvement actions that can be assigned to specific departments. It supports multiple regulations like GDPR, ISO 27001, and NIST by mapping controls to these frameworks, making it the correct solution for the multinational corporation's needs.

Answer

B

Answer

C

Answer

D

Question 5

Your organization is implementing a data loss prevention (DLP) policy to prevent sensitive data from being shared via email. Users in the finance department need to send financial reports to external auditors. What should you configure?

Accepted Answer

Configure a DLP policy with an override option allowing users to justify the sharing. A DLP policy with an override (user override / allow with justification) lets finance users send reports to external auditors while still enforcing the policy — the user must provide a business justification, which is logged for audit. This balances data protection with the legitimate business need, which is exactly what Microsoft Purview DLP user overrides are designed for.

Answer

Add the auditors' domains to a DLP allow list

Answer

Assign a sensitivity label that automatically encrypts the email

Answer

Configure a DLP policy with a block action for all external sharing

Question 6

A company uses Microsoft 365 and wants to automatically classify documents based on sensitive information types like Social Security numbers. Which Microsoft Purview feature should be used?

Accepted Answer

Microsoft Purview Data Classification. Microsoft Purview Data Classification is the correct feature because it automatically scans and classifies documents based on sensitive information types (e.g., Social Security numbers) using built-in or custom classifiers. This enables organizations to identify and label content without manual intervention, directly addressing the requirement for automatic classification.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Purview Sensitivity Labels

Question 7

A company uses Microsoft Purview to manage data compliance. They need to meet regulatory requirements that mandate retention of financial records for 7 years and deletion of personal data after 3 years. Which THREE capabilities should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (A) is correct because it enables classification and labeling of sensitive data, such as financial records and personal data, with retention and deletion policies. This ensures that data is retained for the required 7 years and deleted after 3 years, meeting regulatory mandates. It works by applying sensitivity labels that trigger retention or deletion actions based on the label's configured settings.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview eDiscovery

Question 8

Which THREE are capabilities of Microsoft Defender XDR?

Accepted Answer

Automated investigation and remediation. Option B is correct because Microsoft Defender XDR provides automated investigation and remediation (AIR) that uses playbooks to automatically investigate alerts and take remediation actions across affected assets. Option C is correct because Defender XDR correlates alerts into unified incidents spanning email (Defender for Office 365), endpoints (Defender for Endpoint), and identities (Defender for Identity), giving a single incident queue and management experience. Option D is correct because Defender XDR enables cross-domain threat hunting, allowing advanced hunting queries over unified data from endpoints, email, identities, and cloud apps in one schema. Option A is not correct because device compliance policy management is a Microsoft Intune/Endpoint Manager capability, not a Defender XDR function. Option E is not correct because data classification and labeling is handled by Microsoft Purview Information Protection, not Defender XDR.

Answer

Device compliance policy management

Answer

Data classification and labeling

Question 9

Refer to the exhibit. You are reviewing an ARM template for an Azure resource. Assuming the resource is a Key Vault, what is the effect of the networkAcls configuration?

Accepted Answer

The Key Vault is accessible only from the 10.0.0.0/24 subnet.. The networkAcls configuration in the ARM template defines IP firewall rules for the Key Vault. By specifying a defaultAction of 'Deny' and a single ipRule with a value of '10.0.0.0/24', the Key Vault is configured to allow traffic only from the 10.0.0.0/24 subnet. All other traffic, including traffic from other networks and Azure services, is denied by default.

Answer

The Key Vault is accessible from any network.

Answer

The Key Vault is accessible from all Azure services.

Answer

The Key Vault is not accessible from any network.

Question 10

Your company uses Microsoft Entra ID. You need to enforce that all users accessing the HR application must have a device that is compliant with company security policies. The device compliance is managed by Microsoft Intune. Which feature should you use to enforce this requirement?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it allows you to create policies that evaluate conditions such as device compliance before granting access to applications. By integrating with Microsoft Intune, Conditional Access can check the device compliance status reported by Intune and block or allow access to the HR application accordingly. This enforces the requirement that only compliant devices can access the app, without requiring users to authenticate differently.

Answer

Microsoft Intune device compliance policies

Answer

Microsoft Entra Multifactor Authentication

Answer

Microsoft Entra device registration

Question 11

An organization wants to provide a secure way for external partners to access specific SharePoint sites without creating new user accounts. What Microsoft Entra B2B feature should they use?

Accepted Answer

B2B collaboration. B2B collaboration is the correct Microsoft Entra B2B feature because it allows external partners to access specific SharePoint sites using their own identities (e.g., work or social accounts) without requiring new user accounts or passwords to be created in the organization's tenant. This is achieved through invitation-based redemption, where the partner user is represented as a guest user object in the directory, enabling fine-grained access control via SharePoint site sharing policies.

Answer

Azure AD B2C

Answer

Direct federation

Answer

Azure AD Domain Services

Question 12

An organization wants to detect and respond to threats across their cloud infrastructure, including Azure, AWS, and GCP. Which Microsoft security solution should they centralize their security monitoring in?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution designed to ingest logs and alerts from multiple cloud providers, including Azure, AWS, and GCP, via native connectors and industry-standard protocols like Syslog and CEF. It centralizes threat detection and response across heterogeneous cloud environments, whereas the other options focus on specific security domains or single-cloud protection.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Cloud Apps

Question 13

A company uses Microsoft Entra ID. They want to require multi-factor authentication (MFA) for users who sign in from locations with a high risk score, as determined by Microsoft's analysis of the sign-in's IP address and other behavioral signals. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Identity Protection. Identity Protection is the correct feature because it provides risk-based detection and remediation, including the ability to automatically enforce MFA when a sign-in is flagged with a high risk score. It uses machine learning models to analyze signals such as anonymized IP addresses, atypical travel, and leaked credentials to assign a risk level. This directly matches the requirement to require MFA based on Microsoft's analysis of the sign-in's IP address and behavioral signals.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Entitlement Management

Question 14

A company's security team discovers that several recent account compromises originated from attackers using legacy mail protocols (POP3, IMAP) which do not support multi-factor authentication. The team wants to immediately prevent any sign-in attempts using these protocols. Which Microsoft Entra ID feature should they configure to enforce this restriction?

Accepted Answer

Conditional Access. Conditional Access in Microsoft Entra ID allows administrators to create policies that control access based on conditions such as client apps. By configuring a policy to block authentication requests from legacy authentication protocols (POP3, IMAP, SMTP, etc.), the security team can immediately prevent sign-in attempts that do not support multi-factor authentication, effectively mitigating the risk of account compromise via these outdated protocols.

Answer

Identity Protection

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Entra Password Protection

Question 15

A company wants to offer a secure sign-in experience for external customers who may use personal accounts from Facebook, Google, or any OpenID Connect provider. They also need to customize the sign-in pages with their company logo and colors. Which Microsoft Entra capability should they use?

Accepted Answer

Microsoft Entra External ID (formerly Microsoft Entra ID B2C). Microsoft Entra External ID (formerly Azure AD B2C) is the correct choice because it is specifically designed for customer-facing identity scenarios, supporting social identity providers (Facebook, Google) and any OpenID Connect provider. It also provides full customization of sign-in pages, including company branding like logos and colors, which is not available in the free edition of Microsoft Entra ID.

Answer

Microsoft Entra ID (formerly Microsoft Entra ID) — free edition

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Permissions Management

Question 16

A company uses Microsoft Defender for Office 365 and wants to protect users from malicious attachments in email. They need a feature that scans email attachments in a sandbox environment before they are delivered to recipients. Which Defender for Office 365 feature should they use?

Accepted Answer

Safe Attachments. Safe Attachments is the correct feature because it specifically detonates email attachments in a sandbox environment before delivery, analyzing them for malicious behavior. This protects users from zero-day threats and advanced malware that signature-based detection might miss.

Answer

Safe Links

Answer

Anti-phishing policies

Answer

Anti-spam policies

Question 17

A financial institution is deploying Microsoft Sentinel to monitor security events across its hybrid cloud environment. They want to correlate alerts from multiple sources and automate incident response. Which Microsoft Sentinel feature should they use to create automated workflows?

Accepted Answer

Playbooks. Playbooks in Microsoft Sentinel are built on Azure Logic Apps and allow you to automate incident response by defining a series of actions triggered by alerts. They can orchestrate tasks such as blocking IPs, opening tickets, or notifying teams, making them the correct choice for creating automated workflows.

Answer

Workbooks

Answer

Analytics rules

Answer

Hunting queries

Question 18

Refer to the exhibit. A Microsoft Purview DLP policy is configured. When a user attempts to share a document containing a credit card number externally, what will happen?

Accepted Answer

The sharing attempt is blocked and the user receives a notification.. The exhibit shows a Microsoft Purview DLP policy configured with a 'Block' action for sharing documents containing credit card numbers externally. When the action is set to 'Block', the sharing attempt is prevented, and the user receives a notification explaining why the action was blocked. This aligns with the default behavior of DLP policies that enforce restrictive actions on sensitive data.

Answer

The document is shared but the user is notified.

Answer

The document is encrypted before sharing.

Answer

The policy has no effect because no severity level is set.

Question 19

What is the primary purpose of Microsoft Defender for Cloud Apps?

Accepted Answer

Secure cloud applications and data. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility, data controls, and threat protection for cloud applications and data. Its primary purpose is to secure cloud apps (like Microsoft 365, Salesforce, or Dropbox) by enforcing policies, detecting anomalous behavior, and preventing data exfiltration, not to manage network traffic, mobile devices, or on-premises servers.

Answer

Monitor network traffic

Answer

Manage mobile devices

Answer

Protect on-premises servers

Question 20

A user logs into a company's financial application using their Microsoft Entra ID credentials. After successful sign-in, the application displays a dashboard with data for only the regions the user is authorized to manage. Which two security concepts are demonstrated in this scenario? (Select all that apply.)

Accepted Answer

Authentication. Authentication is demonstrated because the user proves their identity by logging in with Microsoft Entra ID credentials, confirming they are who they claim to be. Authorization is demonstrated because after authentication, the application restricts the dashboard to show only data for regions the user is permitted to manage, enforcing access control based on assigned permissions.

Answer

Accounting

Answer

Non-repudiation