SC-900 Mock Exam 71 — 25 Questions

Question 1

A company uses Microsoft 365 and needs to automatically apply a retention label to documents that contain personally identifiable information (PII) in SharePoint Online. The label should retain the documents for 5 years and then delete them. Which Microsoft Purview solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly known as Microsoft 365 Records Management) is the solution specifically designed to apply retention labels and policies that automatically retain content for a specified period and then delete it. In this scenario, the requirement to automatically apply a retention label to documents containing PII in SharePoint Online and then retain them for 5 years before deletion is a core capability of Data Lifecycle Management, which uses auto-labeling policies based on sensitive information types.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery

Question 2

Your organization, Contoso, uses Microsoft Entra ID P2. You have a Microsoft Entra tenant with several privileged roles including Global Administrator, Exchange Administrator, and SharePoint Administrator. The security team wants to enforce just-in-time (JIT) access for these roles, requiring users to request activation and get approval before they can use the role. Additionally, all activations must be logged and reviewed monthly. What should you configure?

Accepted Answer

Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for role activation and enable access reviews.. Microsoft Entra Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by requiring users to activate their role assignments with approval from designated approvers. It also includes access reviews that can be scheduled to audit and confirm active role assignments, meeting the logging and monthly review requirements. This directly addresses the need for activation approval and periodic review of privileged role usage.

Answer

Configure Conditional Access policies to require MFA for privileged roles.

Answer

Use Microsoft Entra Entitlement Management to create access packages for roles.

Answer

Create an Identity Protection risk policy to block risky sign-ins for privileged users.

Question 3

A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team wants to detect when a user downloads a large number of files from a cloud storage app after hours, which may indicate data exfiltration. Which Microsoft security solution should be used to detect such anomalous behavior in cloud apps?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it provides Cloud Access Security Broker (CASB) functionality, including anomaly detection policies that can identify unusual user behavior such as downloading a large number of files from a cloud storage app after hours. MDCA uses machine learning to establish a baseline of normal user activity and then triggers alerts when deviations like high-volume downloads occur, which is a classic indicator of data exfiltration.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud

Question 4

A security administrator at an organization using Microsoft Entra ID needs to automatically detect user sign-ins that exhibit risky behavior, such as signing in from a suspicious IP address or using leaked credentials. The administrator also wants the system to automatically calculate a risk level for each user and take actions like requiring a password reset when risk is high. Which Microsoft Entra ID feature should the administrator use?

Accepted Answer

Identity Protection. Microsoft Entra ID Protection is the correct feature because it automatically detects risky sign-in behaviors—such as sign-ins from suspicious IP addresses, anonymous IP addresses, or leaked credentials—and calculates a user risk level. It can then automatically trigger remediation actions like requiring a password reset when the risk level is high, directly matching the administrator's requirements.

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Answer

Identity Governance

Question 5

A company subscribes to a cloud-based email service that is delivered as Software-as-a-Service (SaaS). According to the shared responsibility model, who is primarily responsible for the physical security of the data centers where the email data is stored?

Accepted Answer

The cloud provider. In the shared responsibility model for SaaS, the cloud provider is responsible for the physical security of the data centers, including hardware, network infrastructure, and physical access controls. The customer is responsible for securing their own data, user access, and compliance within the service, but not the underlying physical infrastructure.

Answer

The customer

Answer

Both the customer and the cloud provider equally

Answer

Neither the customer nor the cloud provider

Question 6

A company uses Microsoft Entra ID and requires that all guest users from a partner organization must sign in using Microsoft Authenticator for MFA. The partner organization manages their own identities. What should you configure?

Accepted Answer

Configure cross-tenant access settings to trust MFA from the partner's Microsoft Entra ID tenant. Cross-tenant access settings in Microsoft Entra ID allow you to trust MFA claims from an external partner's tenant. Since the partner manages their own identities, trusting their MFA ensures that guest users from that partner organization can satisfy MFA requirements using their own Microsoft Authenticator without needing to register again in your tenant.

Answer

Enable Microsoft Entra ID Protection and configure MFA registration policy for guests

Answer

Use Microsoft Entra ID Governance to require access reviews for guests

Answer

Create a Conditional Access policy that requires MFA for guest users

Question 7

A company wants to block users from accessing phishing websites via Microsoft Edge. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender SmartScreen. Microsoft Defender SmartScreen is the correct solution because it is specifically designed to protect users from phishing and malicious websites directly within Microsoft Edge. It operates by comparing visited URLs against a dynamic list of reported phishing sites and analyzing site behavior in real time, blocking access before the user can interact with the page.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 8

A company wants to gain visibility into the use of unsanctioned cloud applications (shadow IT) within their organization. The security team has access to network proxy logs that show traffic to various cloud services. They want to use a Microsoft security solution to analyze these logs and identify which cloud apps are being used, by whom, and how much data is being consumed. Which capability of Microsoft Defender for Cloud Apps should they use?

Accepted Answer

Cloud Discovery. Cloud Discovery in Microsoft Defender for Cloud Apps analyzes network proxy logs (or traffic logs from firewalls and proxies) to identify unsanctioned cloud app usage (shadow IT). It provides visibility into which cloud apps are being used, by which users, and how much data is consumed, directly matching the company's requirement to analyze logs for shadow IT detection.

Answer

App governance

Answer

Conditional Access App Control

Answer

App Connectors

Question 9

A company subscribes to a SaaS human resources application hosted by an external provider. The provider is responsible for maintaining the physical data centers, network infrastructure, and the underlying application software. The company is responsible for managing user accounts, configuring user permissions, and classifying the data they upload. Which security model does this arrangement primarily describe?

Accepted Answer

Shared responsibility model. The scenario explicitly describes a division of security responsibilities between the SaaS provider and the customer. The provider handles physical security, network infrastructure, and application software (security *of* the cloud), while the company manages user accounts, permissions, and data classification (security *in* the cloud). This is the core definition of the shared responsibility model, which is foundational to cloud computing and directly tested in SC-900.

Answer

Defense in depth

Answer

Zero Trust

Answer

CIA triad

Question 10

An organization's security team needs to investigate a security incident that occurred two months ago. They need to search the unified audit log for specific activities performed by a user, such as file access, email actions, and sign-in events, to understand the scope of the compromise. Which Microsoft Purview solution provides these audit log search capabilities?

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) provides the ability to search the unified audit log for activities like file access, email actions, and sign-in events. This solution is designed for forensic investigation of user and admin activity within Microsoft 365, making it the correct choice for investigating a security incident that occurred two months ago.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Question 11

You are reviewing a Microsoft Purview sensitivity label configuration. Based on the exhibit, what will happen when this label is applied to a document?

Accepted Answer

The document will be encrypted with AES256, watermarked with 'CONFIDENTIAL', and sharing will be blocked.. The exhibit shows a Microsoft Purview sensitivity label configured with both encryption (AES256) and content marking (a 'CONFIDENTIAL' watermark), and the sharing permissions are explicitly set to 'Block sharing'. This combination of settings ensures that when the label is applied, the document is encrypted, watermarked, and sharing is prevented.

Answer

The document will be watermarked only.

Answer

The document will be encrypted and will expire after a set period.

Answer

The document will display a warning before sharing.

Question 12

Your company is implementing a passwordless authentication strategy. You want users to be able to sign in using the Microsoft Authenticator app on their mobile devices. Which Microsoft Entra feature should you enable?

Accepted Answer

Passwordless phone sign-in with Microsoft Authenticator. Passwordless phone sign-in with Microsoft Authenticator allows users to sign in without entering a password by approving a notification or entering a number displayed on the screen. This directly aligns with the requirement to use the Microsoft Authenticator app on mobile devices for a passwordless authentication strategy.

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Answer

Temporary Access Pass

Question 13

A company wants to collect security logs from on-premises servers, cloud applications, and network devices into a central repository, and then use advanced analytics detect threats and automate incident response. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution. It collects security logs from diverse sources like on-premises servers, cloud apps, and network devices into a central Log Analytics workspace, then uses built-in analytics and machine learning to detect threats and automate incident response via playbooks.

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 Defender

Answer

Azure Firewall

Question 14

A company uses Microsoft Entra ID (Microsoft Entra ID) and wants to allow users to sign in using biometrics (fingerprint or face) on their mobile devices instead of passwords. They want this to work for both iOS and Android devices. Which Microsoft Entra ID feature should they enable?

Accepted Answer

Passwordless authentication using Microsoft Authenticator. Microsoft Authenticator supports passwordless authentication using FIDO2-based biometric verification on mobile devices. This feature allows users to sign in with a fingerprint or face on both iOS and Android, eliminating the need for a password while leveraging the device's built-in biometric capabilities.

Answer

Microsoft Entra Connect Sync Health

Answer

Microsoft Entra ID Protection

Answer

Self-Service Password Reset (SSPR)

Question 15

Your organization uses Microsoft Purview Records Management to manage high-value records that must not be deleted. You need to apply a label that marks content as a regulatory record. What label type should you use?

Accepted Answer

Retention label configured for regulatory records. A retention label configured for regulatory records is the correct choice because it locks the label so that no user, including an administrator, can remove it or reduce the retention period. This meets the requirement to mark content as a regulatory record that must not be deleted, as regulatory records provide the highest level of immutability in Microsoft Purview Records Management.

Answer

Data loss prevention policy

Answer

Retention label configured for record

Answer

Sensitivity label

Question 16

An organization has a Microsoft Purview Data Lifecycle Management policy that retains all documents for 5 years. However, legal requires that documents related to a specific lawsuit be preserved indefinitely. What should you do?

Accepted Answer

Place the relevant sites on litigation hold. Litigation hold (now called legal hold in Microsoft Purview) preserves all content in a SharePoint site or OneDrive account indefinitely, overriding any retention policy. This ensures documents related to the lawsuit are not deleted or altered, even if a Data Lifecycle Management policy would otherwise remove them after 5 years. The hold applies at the site level, not to individual items, and prevents both deletion and modification.

Answer

Configure information barriers

Answer

Apply a retention label with indefinite retention

Answer

Create a DLP policy to block deletion

Question 17

An organization uses Microsoft Purview Information Protection. They want to ensure that when a user manually applies a 'Highly Confidential' sensitivity label to a document, the label is automatically applied to any new content pasted from that document into another app. Which configuration should they enable?

Accepted Answer

Marking content as sensitive. Microsoft Purview Information Protection's 'marking content as sensitive' feature (also known as content marking) ensures that when a user manually applies a sensitivity label, the label is automatically applied to any new content pasted from that document into another app. This is achieved through automatic marking that tracks the label even when content is copied. Option B (Data Loss Prevention policies) is incorrect because DLP policies enforce rules to prevent data loss but do not automatically apply labels to copied content. Option C (Encryption with rights management) is incorrect because encryption protects content but does not propagate labels across copy-paste. Option D (Auto-labeling policies) is incorrect because auto-labeling automatically classifies content based on conditions, not manual application.

Answer

Data Loss Prevention policies

Answer

Encryption with rights management

Answer

Auto-labeling policies

Question 18

A company wants to automatically classify and protect sensitive documents stored in SharePoint Online. The compliance administrator needs to create a policy that detects credit card numbers and applies encryption. Which Microsoft Purview solution should the administrator use?

Accepted Answer

Sensitivity labels with auto-labeling. Sensitivity labels with auto-labeling (Option B) is the correct Microsoft Purview solution because it allows the compliance administrator to create a policy that automatically detects sensitive data types, such as credit card numbers, and applies encryption to documents in SharePoint Online. This feature uses trainable classifiers or sensitive information types to scan content at rest and automatically assign a label that enforces protection actions like encryption, meeting the requirement without manual user intervention.

Answer

Communication Compliance

Answer

Microsoft Entra ID

Answer

Data Lifecycle Management

Question 19

A law firm needs to retain client documents for 10 years after case closure, but automatically delete drafts after 30 days. Which two Microsoft Purview solutions should be combined?

Accepted Answer

Microsoft Purview Records Management and Data Lifecycle Management. Microsoft Purview Records Management enables the firm to mark client documents as records and enforce a 10-year retention period after case closure, while Data Lifecycle Management allows automatic deletion of drafts after 30 days. Together, they provide both long-term retention for compliance and short-term cleanup for non-record content, aligning with the firm's specific requirements.

Answer

Microsoft Purview Data Loss Prevention and eDiscovery

Answer

Microsoft Purview eDiscovery and Audit

Answer

Microsoft Purview Audit and Data Loss Prevention

Question 20

A security administrator is explaining the shared responsibility model to a new team member. The company uses a Software-as-a-Service (SaaS) application such as Microsoft 365. For which of the following items is the customer primarily responsible under this model?

Accepted Answer

Managing user access and classifying data stored in the service. In the shared responsibility model for SaaS like Microsoft 365, the customer is responsible for managing user access (e.g., configuring Azure AD roles, conditional access policies, and multi-factor authentication) and classifying data stored in the service (e.g., applying sensitivity labels via Microsoft Purview Information Protection). The provider manages the underlying infrastructure, including physical security, hypervisor patching, and application updates.

Answer

Physical security of the data center hosting the SaaS application

Answer

Patching the hypervisor that runs the SaaS infrastructure

Answer

Applying security updates to the SaaS application itself