SC-900 Mock Exam 72 — 25 Questions

Question 1

A company requires users to enter a password and then a temporary code from a mobile app to sign in. After signing in, a user attempts to open a confidential document but is denied because they are not a member of the 'Managers' group. Which two security concepts are primarily demonstrated in this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication and Authorization. The scenario demonstrates two security concepts: Authentication and Authorization. The user enters a password and a temporary code from a mobile app to sign in – this is multi-factor authentication (something you know and something you have), verifying the user's identity. After signing in, the attempt to open a confidential document is denied because the user is not a member of the 'Managers' group – this is authorization, controlling access based on group membership. Identification (claiming an identity) is not demonstrated because the scenario does not mention entering a username or similar identifier. Non-repudiation is not demonstrated because there is no evidence that the authentication method provides proof that cannot be denied; the temporary code is simply a second factor for authentication, not a non-repudiation mechanism.

Answer

Identification and Non-repudiation

Answer

Encryption and Hashing

Answer

Accounting and Auditing

Question 2

Refer to the exhibit. A Microsoft Purview retention policy is configured as shown. Which statement about this policy is accurate?

Accepted Answer

The policy will delete items 7 years after they were last modified.. The exhibit shows a retention policy configured with the action 'Delete items' and a period of '7 years' based on 'When items were last modified.' This means the policy will delete items 7 years after their last modification date, not from creation. Option C correctly states this behavior.

Answer

The policy will delete items after 7 years from the date they were created.

Answer

The policy will retain items for 7 years from the last modification date.

Answer

The policy will keep items for 7 years and then delete them.

Question 3

Your organization needs to control which users can access Microsoft Purview compliance portal. Which method should you use to grant access?

Accepted Answer

Assign users to the Compliance Administrator role group in Microsoft Purview. Access to the Microsoft Purview compliance portal is granted by assigning users to the appropriate role group within Purview itself, such as the Compliance Administrator role group. Option A is incorrect because Azure RBAC roles manage access to Azure resources, not to Purview. Option B is incorrect because Intune policies control device management and compliance, not user access to Purview. Option D is incorrect while Microsoft 365 E5 licenses are required to use Purview features, they do not by themselves grant access; explicit role assignment is necessary.

Answer

Add users to an Azure RBAC role

Answer

Configure Intune policy to allow access

Answer

Assign Microsoft 365 E5 licenses to users

Question 4

Your company uses Microsoft Purview to meet data privacy regulations. You need to discover and classify personal data stored in Azure SQL Database. Which THREE tools or features can you use?

Accepted Answer

Microsoft Purview Data Estate Insights. Microsoft Purview Data Estate Insights (C) provides a centralized dashboard to monitor data estate health, including scanning and classification of personal data across sources like Azure SQL Database. It integrates with the Purview Data Map to track data lineage and sensitivity labels, enabling compliance with data privacy regulations.

Answer

Microsoft 365 compliance center

Answer

Azure Information Protection

Question 5

You need to ensure that sensitive documents in Microsoft SharePoint Online are automatically classified and protected when they contain credit card numbers. What should you configure?

Accepted Answer

A sensitivity label with auto-labeling for Microsoft Purview Information Protection. A sensitivity label with auto-labeling for Microsoft Purview Information Protection is correct because it can automatically classify and protect documents based on sensitive content, such as credit card numbers, using built-in sensitive information types. This ensures that when a document in SharePoint Online contains credit card data, it is automatically labeled with encryption and usage restrictions without manual intervention.

Answer

A retention policy for SharePoint

Answer

A data loss prevention (DLP) policy

Answer

A retention label for regulatory compliance

Question 6

A compliance officer wants a central dashboard to assess the organization's compliance posture against regulatory standards such as GDPR and ISO 27001. They need actionable recommendations to improve their compliance score and track progress over time. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the correct solution because it provides a central dashboard that assesses an organization's compliance posture against regulatory standards like GDPR and ISO 27001, offers actionable recommendations to improve the compliance score, and tracks progress over time through continuous assessments and improvement actions.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Audit

Question 7

Your organization uses Microsoft Purview to label and protect sensitive data. The compliance team wants to automatically apply a 'Confidential' label to documents containing personally identifiable information (PII) stored in SharePoint Online. What should they create?

Accepted Answer

An auto-labeling policy for sensitivity labels. An auto-labeling policy for sensitivity labels in Microsoft Purview can automatically apply a 'Confidential' label to documents containing PII in SharePoint Online. This policy uses pattern-based detection (e.g., regex for PII like Social Security numbers) to classify and protect content at rest, aligning with the compliance team's requirement to label sensitive data automatically.

Answer

A DLP policy to detect PII

Answer

A trainable classifier for PII

Answer

A retention label policy for PII

Question 8

Which TWO of the following are features of Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Cloud Workload Protection Platform (CWPP). Microsoft Defender for Cloud is a Cloud Workload Protection Platform (CWPP) that provides unified security management and advanced threat protection for workloads running in Azure, on-premises, and other clouds. It also includes Cloud Security Posture Management (CSPM) capabilities, which continuously assess your environment against security benchmarks (e.g., CIS, NIST) and provide actionable recommendations to improve your security posture.

Answer

Data classification and labeling

Answer

Security Information and Event Management (SIEM)

Answer

Mobile Threat Defense (MTD)

Question 9

A company is subject to a legal investigation and must preserve all email communications related to the case for an indefinite period, even if users try to delete them. The compliance officer needs a solution that can place a hold on specific user mailboxes and prevent any permanent deletion of relevant content. Which Microsoft Purview feature should be used?

Accepted Answer

Litigation hold. Litigation hold is the correct feature because it places a hold on an entire mailbox, preserving all content including deleted items and versions, and prevents permanent deletion by users or automated processes. Unlike retention labels or policies, litigation hold applies to the entire mailbox and is designed specifically for legal investigations where indefinite preservation is required.

Answer

Retention labels

Answer

Data loss prevention

Answer

Compliance Manager

Question 10

A company uses Microsoft 365 and several third-party SaaS apps. The security team wants to detect when a user signs in from a remote location that is significantly far from their typical sign-in location within a very short time, indicating possible account compromise. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) provides the 'impossible travel' detection capability, which analyzes sign-in events across both Microsoft 365 and third-party SaaS apps. It uses machine learning to establish a baseline of a user's typical sign-in locations and then alerts when two sign-ins occur from geographically distant locations within a time frame that makes physical travel impossible, indicating a potential account compromise.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint

Question 11

You need to implement a solution that allows users to access cloud applications without entering a password, using Windows Hello for Business. Which Microsoft Entra feature integrates with Windows Hello for Business?

Accepted Answer

Microsoft Entra ID. Windows Hello for Business integrates with Microsoft Entra ID (formerly Azure AD) to enable passwordless authentication. When a user enrolls a device with Windows Hello for Business, the biometric or PIN credential is bound to the device's TPM and linked to the user's identity in Microsoft Entra ID, allowing seamless access to cloud applications without a password.

Answer

Conditional Access

Answer

FIDO2 security keys

Answer

Microsoft Authenticator

Question 12

Which TWO of the following are capabilities of Microsoft Entra ID?

Accepted Answer

Identity and access management for cloud applications.. Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management (IAM) service. It provides authentication and authorization for cloud applications, including support for single sign-on (SSO) to thousands of pre-integrated SaaS applications like Salesforce, Office 365, and Workday. These are core IAM capabilities, not security functions like email filtering or network firewall management.

Answer

Email filtering and anti-malware protection.

Answer

Encryption of data at rest in Azure Storage.

Answer

Network firewall management.

Question 13

Your company uses Microsoft Purview Information Protection to classify sensitive data. A user reports that when they try to share a document containing a credit card number via email, the email is blocked. Which Purview feature is most likely causing this behavior?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is specifically designed to detect and block sensitive data—such as credit card numbers—from being shared via email. When a user attempts to send a document containing a credit card number, the DLP policy scans the email content and attachments, matches the credit card pattern (e.g., using the predefined Sensitive Info Type for credit card numbers), and enforces an action like blocking the message. This is the most likely cause of the email being blocked.

Answer

Audit log

Answer

Sensitivity label

Answer

Retention label

Question 14

A multinational corporation wants to detect scenarios where employees in the finance department are accessing and downloading customer credit card data from a CRM system and then emailing that data to personal accounts. The security team needs to define policies that identify this pattern of activity, analyze user behavior over time (e.g., building a user's baseline), and automatically escalate high-risk incidents for investigation. Which Microsoft Purview solution should they deploy?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is designed to detect risky user activities that violate organizational policies, such as accessing sensitive data and exfiltrating it via email. It uses machine learning to establish user baselines over time and automatically escalates high-risk incidents for investigation, directly matching the scenario's requirements.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview eDiscovery (Premium)

Question 15

A company uses Microsoft Intune to manage devices. They want to ensure that only devices with a specific minimum operating system version can access corporate email. What should they configure?

Accepted Answer

Create a device compliance policy specifying minimum OS version. To enforce a minimum operating system version for accessing corporate email, you need a device compliance policy in Microsoft Intune. This policy evaluates device attributes like OS version and marks devices as compliant or non-compliant. When combined with a Conditional Access policy in Entra ID, non-compliant devices can be blocked from accessing corporate resources, including email.

Answer

Deploy an app protection policy for the email app

Answer

Create a device configuration profile for OS settings

Answer

Configure a conditional access policy in Entra ID to block non-compliant devices

Question 16

A company wants to prevent users from sharing files containing personally identifiable information (PII) with external recipients. They also need to notify users if they attempt to share such files. Which Microsoft Purview solution should be configured?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, prevent, and notify users about the sharing of sensitive data, such as personally identifiable information (PII), with external recipients. DLP policies can be configured to automatically block the sharing of files containing PII and display a policy tip notification to the user when they attempt to share such content.

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview eDiscovery

Question 17

Refer to the exhibit. A sensitivity label is configured as shown. Which statement about the label's behavior is accurate?

Accepted Answer

When applied, users can choose who can access the document and what permissions they have.. The exhibit shows a sensitivity label configured with 'Let users assign permissions' under 'User-defined permissions' in Azure Information Protection. This setting allows end users to define custom permissions (e.g., who can read, edit, or forward) when applying the label, rather than using a fixed template or automatic encryption.

Answer

The label disables encryption and only adds a header and footer.

Answer

The label automatically encrypts the document with a predefined template.

Answer

The label does not apply any protection; it only adds visual markings.

Question 18

Fabrikam Inc. is a global manufacturing company that uses Microsoft Entra ID for identity management. They have recently experienced a security incident where an attacker compromised a user account and accessed sensitive intellectual property. The security team wants to implement identity protection measures to detect and respond to such attacks in the future. They need a solution that can automatically detect suspicious sign-in behavior, such as impossible travel and anomalous token issuance, and then take action to block the sign-in or require additional verification. Additionally, they want to integrate threat intelligence feeds to improve detection. Which Microsoft security solution should they use to meet these requirements?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection uses machine learning to detect risks like impossible travel and anomalous token issuance, and can automatically enforce policies such as requiring MFA or blocking sign-ins. It also integrates with threat intelligence feeds. Option A is wrong because Microsoft Defender for Identity focuses on on-premises Active Directory, not cloud sign-ins. Option C is wrong because Microsoft Sentinel is a SIEM, not an automated response tool for sign-in risks. Option D is wrong because Microsoft Defender for Cloud Apps is for cloud app discovery and control, not primarily for sign-in risk detection.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 19

Which Microsoft cloud service provides a unified data governance solution that helps you manage and protect data across your entire data estate, including multi-cloud and on-premises?

Accepted Answer

Microsoft Purview. Microsoft Purview is the correct answer because it is a unified data governance service that provides visibility into data assets across on-premises, multi-cloud, and SaaS environments. It enables data classification, sensitive data discovery, and policy-based access control to manage and protect the entire data estate, aligning with the question's requirement for a comprehensive governance solution.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 20

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that when a user's on-premises account is disabled, their cloud account is automatically disabled within 5 minutes. Which configuration should you use?

Accepted Answer

Microsoft Entra Connect with directory sync configured for 5-minute sync interval. Microsoft Entra Connect with directory synchronization configured for a 5-minute sync interval ensures that changes made to on-premises Active Directory (such as disabling a user account) are replicated to Microsoft Entra ID within that interval. This meets the requirement of automatically disabling the cloud account within 5 minutes of the on-premises change.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Conditional Access with session controls

Answer

Microsoft Entra Connect Health