SC-900 Mock Exam 71 — 25 Questions

Question 1

A security team wants to discover which cloud applications (such as Dropbox, Salesforce, or unsanctioned file-sharing apps) are being used by employees, even if those apps are not sanctioned by IT. They need to analyze usage patterns, risk levels, and identify potential shadow IT. Which feature of Microsoft Defender for Cloud Apps should they enable?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs from firewalls and proxies to identify cloud app usage, including unsanctioned apps like Dropbox or Salesforce, without requiring API integration. It provides risk scores, usage patterns, and shadow IT detection by comparing discovered apps against Microsoft's cloud app catalog of over 31,000 apps.

Answer

App Connectors (API connectors)

Answer

Conditional Access App Control

Answer

Microsoft Defender for Endpoint

Question 2

Which of the following is a primary purpose of Microsoft Entra ID Identity Protection?

Accepted Answer

Detect and remediate identity risks. Option C is correct because Identity Protection detects and remediates identity-based risks. Option A is wrong because device management is Intune. Option B is wrong because privileged access is PIM. Option D is wrong because data classification is Purview.

Answer

Manage privileged roles

Answer

Classify and protect sensitive data

Answer

Manage device compliance policies

Question 3

Which TWO of the following are components of the Microsoft Entra product family? (Choose two.)

Accepted Answer

Microsoft Entra Permissions Management. Option A and Option D are correct. Microsoft Entra ID is the identity service. Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution. Option B is wrong because Microsoft Defender for Identity is part of Microsoft Defender XDR. Option C is wrong because Microsoft Purview is a separate governance service.

Answer

Microsoft Defender for Identity

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 4

Which TWO of the following are identity-related security best practices recommended by Microsoft? (Choose two.)

Accepted Answer

Implement Conditional Access policies. Options A and C are correct. Using Conditional Access policies and enabling MFA are key identity security best practices. Option B is wrong because sharing passwords is never recommended. Option D is wrong because SSO reduces password use but is not a standalone best practice without MFA. Option E is wrong because disabling auditing reduces visibility.

Answer

Share passwords with team members for critical accounts

Answer

Use single sign-on (SSO) without MFA

Answer

Disable sign-in logs to reduce storage costs

Question 5

Which THREE of the following are capabilities of Microsoft Purview Compliance Manager? (Choose three.)

Accepted Answer

Automated testing of controls. Correct answers are A, C, and E: Compliance Manager provides a compliance score, automated testing of controls, and improvement actions. Option B is incorrect because creating DLP policies is not a Compliance Manager capability. Option D is incorrect because managing user identities is in Microsoft Entra ID.

Answer

Manage user identities

Answer

Create data loss prevention policies

Question 6

Refer to the exhibit. You are configuring a sensitivity label in Microsoft Purview. The label is set to automatically apply when credit card numbers are detected. However, users report that the label is not being applied to documents containing credit card numbers. What is the most likely cause?

Accepted Answer

The label is not published to a label policy. Option B is correct because the auto-labeling rule requires a condition, but the label may not be published to users. However, the exhibit shows no policy assignment. The most likely cause is that the label is not published to a label policy (option B). Option A is incorrect because encryption is configured. Option C is incorrect because the condition is valid. Option D is incorrect because user permissions are defined.

Answer

The encryption is misconfigured

Answer

The auto-labeling condition is incorrect

Answer

The user permissions are missing

Question 7

Which TWO of the following are features of Microsoft Purview Audit?

Accepted Answer

Records user and admin activities in the unified audit log. Microsoft Purview Audit provides detailed logging of user and admin activities, and allows searching the audit log for security investigations. It does not automatically block malicious activities (that's DLP or Defender), and it does not manage sensitivity labels (that's Information Protection). It does not provide real-time threat detection (that's Sentinel or Defender).

Answer

Manages sensitivity labels for documents

Answer

Provides real-time threat detection

Answer

Automatically blocks malicious activities

Question 8

A company is planning to use Copilot for Microsoft 365. To ensure that Copilot responses are based only on data accessible to the user, which principle must be enforced?

Accepted Answer

User permissions and access controls are respected. Option B is correct because Copilot for Microsoft 365 uses the user's existing permissions to determine which content it can access. Option A is incorrect because Copilot does not universally index all data. Option C is incorrect because Copilot does not automatically grant access. Option D is incorrect because Copilot does not bypass permissions.

Answer

Copilot automatically grants access to all data

Answer

All organizational data is indexed and available to Copilot

Answer

Data must be stored in a specific location

Question 9

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to prevent users from sharing credit card numbers via email. Which type of sensitive information type should you use in the DLP rule?

Accepted Answer

Built-in sensitive information type. Option B is correct because a built-in sensitive information type for credit card numbers is available. Option A is incorrect because an exact data match (EDM) is for custom databases. Option C is incorrect because a custom keyword list would be inefficient. Option D is incorrect because a trainable classifier is for custom classification.

Answer

Custom keyword list

Answer

Trainable classifier

Answer

Exact data match (EDM) based classification

Question 10

Refer to the exhibit. You have a Data Loss Prevention (DLP) policy in Microsoft Purview. What will happen when a user tries to share a document containing a credit card number via email?

Accepted Answer

The email is blocked and the user receives a notification. Option B is correct because the rule blocks access and notifies the user. Option A is incorrect because the user is notified. Option C is incorrect because the document is blocked, not allowed with warning. Option D is incorrect because the rule applies to all users.

Answer

The email is blocked only if the recipient is external

Answer

The email is sent with a warning to the recipient

Answer

The email is sent but the user is not notified

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You need to discover shadow IT usage. Which feature should you enable?

Accepted Answer

Cloud Discovery. Option C is correct because Cloud Discovery analyzes traffic logs to identify shadow IT. Option A is incorrect because Conditional Access App Control is for enforcing policies on sanctioned apps. Option B is incorrect because the app catalog lists known cloud apps. Option D is incorrect because file policies are for data protection.

Answer

File policies

Answer

Conditional Access App Control

Answer

App catalog

Question 12

A company wants to ensure that only authorized users can access sensitive financial data stored in Microsoft SharePoint Online. Which identity feature should they use to require a second form of verification?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) is the correct answer because it requires a second form of verification, such as a phone call or app notification, in addition to a password. Conditional Access is a policy engine that can enforce MFA but is not itself a verification method. Self-service password reset and Microsoft Authenticator are features that support MFA but are not the overarching concept.

Answer

Microsoft Authenticator

Answer

Self-service password reset

Answer

Conditional Access

Question 13

Which TWO components are part of the 'Zero Trust' security model? (Choose two.)

Accepted Answer

Least privilege. Correct answers are B and C: Verify explicitly assumes every access request is a potential threat, and Least privilege ensures users have only the minimum access needed. Option A is incorrect because perimeter security is a traditional model. Option D is incorrect because password complexity is a single factor. Option E is incorrect because VPNs are network access methods, not Zero Trust principles.

Answer

VPN access

Answer

Password complexity

Answer

Perimeter-based security

Question 14

Which TWO of the following are benefits of using Microsoft Entra ID for identity management? (Choose two.)

Accepted Answer

Conditional Access policies. Correct answers are B and D: Single sign-on (SSO) allows users to access multiple apps with one login, and Conditional Access provides policy-based access controls. Option A is incorrect because on-premises only is not a benefit. Option C is incorrect because storing passwords in plaintext is not a benefit. Option E is incorrect because local authentication is not a benefit of cloud identity.

Answer

Storing passwords in plaintext

Answer

Local authentication for all apps

Answer

On-premises authentication only

Question 15

Which TWO are principles of the Zero Trust security model?

Accepted Answer

Verify explicitly. Options A and C are correct. Zero Trust principles include 'verify explicitly' and 'assume breach'. Option B is a traditional perimeter security approach. Option D is a principle of defense in depth, not Zero Trust. Option E describes a traditional VPN-based approach.

Answer

Trust everything inside the network

Answer

Use a VPN for remote access

Answer

Layer defenses

Question 16

Which TWO are features of Microsoft Entra ID?

Accepted Answer

Single sign-on (SSO). Options A and D are correct. Microsoft Entra ID provides single sign-on (SSO) and self-service password reset (SSPR). Option B is a feature of Microsoft Purview. Option C is part of Microsoft Intune. Option E is a feature of Microsoft Defender for Cloud Apps.

Answer

Data loss prevention (DLP)

Answer

Cloud app discovery

Answer

Mobile device management (MDM)

Question 17

Refer to the exhibit. A security analyst runs this Kusto Query Language (KQL) query in Microsoft Sentinel. What is being identified?

Accepted Answer

Sign-in attempts by disabled user accounts.. The query filters sign-in logs from the last day with ResultType 50057, which indicates that the user account is disabled. Option B is wrong because ResultType 50057 is specifically for disabled accounts. Option C is wrong because successful sign-ins have ResultType 0. Option D is wrong because MFA failure has different result types.

Answer

Multi-factor authentication failures.

Answer

Successful sign-ins in the last day.

Answer

Sign-in attempts from unknown IP addresses.

Question 18

You run the above PowerShell command in your Microsoft Entra ID environment. What is the command retrieving?

Accepted Answer

Token lifetime policies. Option C is correct because the command gets all policies of type 'TokenLifetimePolicy', which are used to define token lifetimes. Option A is wrong because conditional access policies use a different type. Option B is wrong because named locations are not policies. Option D is wrong because role assignments are not policies.

Answer

Conditional access policies

Answer

Named locations

Answer

Role assignments

Question 19

Which TWO of the following are benefits of using Microsoft Entra ID for identity management?

Accepted Answer

Single sign-on (SSO) to cloud applications. Single sign-on (SSO) and multi-factor authentication (MFA) are key benefits of Entra ID. Password hash synchronization is a feature of Entra Connect, not a direct benefit. On-premises Active Directory is a separate service. Security incident detection is more aligned with Microsoft Sentinel or Defender.

Answer

Password hash synchronization

Answer

Automated security incident detection

Answer

Replacement of on-premises Active Directory

Question 20

An organization wants to use a cloud-based SIEM to collect security data from multiple sources, including on-premises servers and cloud applications. Which Microsoft solution should they choose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM that can ingest data from various sources. Defender for Cloud is for cloud security posture management. Microsoft 365 Defender is for detection and response across Microsoft 365. Intune is for device management.

Answer

Microsoft Intune

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Cloud