SC-900 Mock Exam 72 — 25 Questions

Question 1

Which THREE of the following are features of Microsoft Entra ID Governance? (Select three.)

Accepted Answer

Access reviews. Access reviews (A) are a core Microsoft Entra ID Governance capability that lets organizations periodically recertify users' group memberships, application access, and role assignments to ensure least privilege. Privileged Identity Management (B) is included in Entra ID Governance and provides just-in-time privileged role activation, approval workflows, access reviews, and audit history for privileged access. Entitlement management (C) is also a governance feature that automates access request workflows, access packages, and lifecycle policies for internal and external users. Self-service password reset (D) is an authentication/credential-management feature, not a governance capability, and multifactor authentication (E) is an authentication method for strengthening sign-in security, so neither belongs to Entra ID Governance.

Answer

Self-service password reset

Answer

Multifactor authentication

Question 2

Which TWO capabilities are provided by Microsoft Entra ID?

Accepted Answer

Multifactor authentication. Microsoft Entra ID (formerly Azure AD) is a cloud-based identity and access management service, and it provides Multifactor Authentication (A) by letting administrators enforce a second verification factor such as the Microsoft Authenticator app, SMS, or a FIDO2 key through Conditional Access policies. It also provides Single sign-on (D), allowing users to authenticate once with their Entra ID account and access federated applications via protocols like SAML 2.0, WS-Federation, or OpenID Connect. Device management (B) is not an Entra ID capability itself; it is delivered by Microsoft Intune (or Configuration Manager) through MDM/MAM, even though Entra ID can register or join devices for identity purposes. Security incident detection (C) belongs to Microsoft Defender XDR / Microsoft Sentinel, not Entra ID, which only surfaces identity-related signals like risky sign-ins. Data classification (E) is provided by Microsoft Purview (sensitivity labels, DLP), not by Entra ID.

Answer

Device management

Answer

Security incident detection

Answer

Data classification

Question 3

Which TWO are capabilities of Microsoft Defender for Office 365?

Accepted Answer

Safe Attachments. Safe Attachments (A) is a core Microsoft Defender for Office 365 capability that detonates email attachments in a sandbox to detect malicious content before delivery. Safe Links (D) is also a Defender for Office 365 feature that rewrites and checks URLs in email and Office documents at time-of-click to block phishing and malicious destinations. Attack surface reduction rules (B) belong to Microsoft Defender for Endpoint, not Defender for Office 365. Multi-factor authentication enforcement (C) is handled by Microsoft Entra ID (Azure AD) Conditional Access, not Defender for Office 365. Device compliance policies (E) are configured in Microsoft Intune, so they are outside Defender for Office 365's scope.

Answer

Attack surface reduction rules

Answer

Multi-factor authentication enforcement

Answer

Device compliance policies

Question 4

Which TWO of the following are supported identity types for Microsoft Entra External ID? (Select two.)

Accepted Answer

Social identities (e.g., Google, Facebook). Microsoft Entra External ID supports social identities such as Google and Facebook (option B), allowing consumers to sign in with existing accounts from these providers via built-in identity providers. It also supports enterprise identities from SAML/WS-Federation identity providers (option D), enabling federation with external organizations' IdPs for B2B collaboration scenarios. These two identity types are core to External ID's design for customer and partner access. OAuth 2.0 token identities (A) describe a protocol flow, not a supported identity type. X.509 certificate-based identities (C) are not a native External ID identity type. Biometric identities (E) are handled by the device/authenticator, not defined as an External ID identity type.

Answer

OAuth 2.0 token identities

Answer

X.509 certificate-based identities

Answer

Biometric identities (fingerprint, face)

Question 5

Which THREE are capabilities of Microsoft Defender for Cloud?

Accepted Answer

Just-in-time (JIT) VM access. Microsoft Defender for Cloud provides just-in-time (JIT) VM access (A), which locks down management ports (RDP/SSH) and grants time-limited, approved access on request, reducing the attack surface of Azure and non-Azure VMs. It also delivers vulnerability assessment for virtual machines (B), using integrated scanners such as Microsoft Defender for Endpoint or Qualys to surface OS and software CVEs and remediation guidance. Cloud Security Posture Management (CSPM) (C) is a core capability, continuously assessing configurations against benchmarks like Microsoft Cloud Security Benchmark and CIS, and providing secure score and regulatory compliance dashboards. DDoS protection (D) is not a Defender for Cloud capability; it is delivered by Azure DDoS Protection (Basic/Network Protection) as a separate service. SIEM and security orchestration (E) belong to Microsoft Sentinel, which is a distinct product, even though it can ingest Defender for Cloud alerts.

Answer

DDoS protection

Answer

SIEM and security orchestration

Question 6

Which TWO of the following are capabilities of Microsoft Defender XDR? (Choose two.)

Accepted Answer

Correlate alerts from multiple domains into a single incident. Option A is correct because Microsoft Defender XDR's core capability is incident correlation: it stitches together related alerts from the different Defender workloads (Defender for Endpoint, Identity, Office 365, Cloud Apps) into a single unified incident so analysts see the full attack story rather than isolated alerts. Option E is correct because Defender XDR provides automated investigation and response (AIR) that spans those domains, automatically investigating alerts, remediating threats, and allowing actions to be taken across endpoints, identities, and email. Option B is not a Defender XDR capability; data loss prevention for sensitive information is delivered by Microsoft Purview (e.g., DLP policies in Purview/Defender for Cloud Apps context), not as a Defender XDR function. Option C is not correct because centralized log analytics with custom KQL queries is the role of Microsoft Sentinel (or Log Analytics workspaces), not Defender XDR itself. Option D is not correct because identity governance and access reviews are capabilities of Microsoft Entra ID Governance, not Defender XDR.

Answer

Data loss prevention for sensitive information

Answer

Centralized log analytics for custom queries

Answer

Identity governance and access reviews

Question 7

A company uses Microsoft Defender for Cloud to secure its environment. Which TWO plans are available?

Accepted Answer

Cloud Security Posture Management (CSPM). Option A, Cloud Security Posture Management (CSPM), is correct because it is one of the Defender for Cloud plans, providing continuous assessment of misconfigurations and security posture across Azure, AWS, and GCP resources. Option B, Defender for Servers, is correct because it is a Defender for Cloud workload protection plan (offered in P1 and P2 tiers) that delivers threat detection, vulnerability assessment, and file integrity monitoring for Windows and Linux VMs. Option C, Microsoft Intune, is incorrect because it is a separate cloud-based endpoint management/MDM service for device and app management, not a Defender for Cloud plan. Option D, Microsoft Sentinel, is incorrect because it is a standalone cloud-native SIEM/SOAR solution that integrates with Defender for Cloud but is not itself one of its plans. Option E, Microsoft Defender for Identity, is incorrect because it is a distinct service for monitoring on-premises Active Directory signals to detect identity-based attacks, not a Defender for Cloud plan.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Question 8

Which THREE capabilities are provided by Microsoft Entra Identity Protection? (Choose three.)

Accepted Answer

Detect leaked credentials. Microsoft Entra Identity Protection includes leaked credential detection (A), which scans for compromised credentials exposed in breaches or dark web dumps and surfaces them as user risk detections. It also enables risk-based Conditional Access policies (B), allowing sign-in and user risk levels to drive access decisions such as requiring MFA or password change. Its risk investigation reports (E) give administrators visibility into risky users, risky sign-ins, and detections for triage and remediation. Self-service password reset (C) is a separate Microsoft Entra ID feature, and just-in-time privileged access (D) is provided by Privileged Identity Management, not Identity Protection.

Answer

Allow users to reset their own passwords

Answer

Provide just-in-time privileged access

Question 9

Which THREE features are part of Microsoft Entra Identity Governance?

Accepted Answer

Privileged Identity Management. Microsoft Entra Identity Governance is the suite that ensures the right people have the right access, and it specifically includes Privileged Identity Management (B), which provides just-in-time role activation, approval workflows, and time-bound assignments for privileged roles. Access reviews (C) are also a core Identity Governance capability, letting reviewers periodically recertify group memberships, application assignments, and role assignments to remove stale access. Entitlement management (E) is the third pillar, using access packages, catalogs, and connected organizations to automate the request, approval, and lifecycle of access for internal and external users. The unmarked options do not belong: Microsoft Entra Connect (A) is a synchronization tool for hybrid identity between on-premises AD and Entra ID, and ID Protection (D) is a separate risk-detection and remediation service for identity risk signals, neither of which is part of the Identity Governance feature set.

Answer

Microsoft Entra Connect

Answer

ID Protection

Question 10

Which TWO features are part of Microsoft Entra ID Governance? (Choose two.)

Accepted Answer

Entitlement Management. Entitlement Management (A) is a core Microsoft Entra ID Governance capability that lets organizations manage the lifecycle of access through access packages, catalogs, connected organizations, and policies for internal and external users, automating assignment and removal of resource access. Access Reviews (B) is also part of Entra ID Governance, enabling periodic recertification of group memberships, application assignments, and privileged role assignments so that access is reviewed and revoked when no longer needed. Conditional Access (C) is a Microsoft Entra ID access-control policy engine that enforces signals and conditions at sign-in, but it is not classified as an Entra ID Governance feature. Self-Service Password Reset (D) is an authentication/credential-management feature in Entra ID, not a governance workload. Identity Protection (E) is a risk-detection and remediation service for identity risk signals, and while related to security, it is not one of the Entra ID Governance features asked for here.

Answer

Conditional Access

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 11

Which THREE of the following are identity protection features in Microsoft Entra ID Protection?

Accepted Answer

Risk detections such as leaked credentials and anonymous IP address. Option B is correct because Microsoft Entra ID Protection natively generates risk detections such as leaked credentials, anonymous IP address, atypical travel, and unfamiliar sign-in properties, which are the core signals the service evaluates. Option D is correct because ID Protection provides investigation and remediation capabilities, including the Risky users, Risky sign-ins, and Risk detections reports, plus remediation actions like password reset, blocking sign-in, or dismissing risk. Option E is correct because ID Protection lets administrators configure risk policies for user risk and sign-in risk that automatically enforce remediation (for example, require password change or MFA) when a configured risk level is reached. Option A is not correct because self-service password reset is an authentication/credential-management feature of Microsoft Entra ID, not an ID Protection risk feature, even though it can be used as a remediation action. Option C is not correct because Conditional Access is a separate policy engine that can consume ID Protection risk signals as conditions, but the policies themselves are not an ID Protection feature.

Answer

Self-service password reset

Answer

Conditional access policies

Question 12

Which THREE components are part of Microsoft Entra ID's identity governance? (Choose three.)

Accepted Answer

Privileged Identity Management. Privileged Identity Management (B) is a core identity governance component in Microsoft Entra ID, providing just-in-time role activation, approval workflows, and time-bound privileged access to Microsoft Entra ID and Azure resources. Entitlement Management (C) is also part of identity governance, delivering access packages, catalogs, and automated access request/assignment workflows for internal and external users. Access Reviews (D) belongs to identity governance as well, enabling periodic recertification of group memberships, application assignments, and privileged role assignments to ensure least privilege. Self-Service Password Reset (A) is an authentication/credential management feature, not an identity governance component, and Conditional Access (E) is a policy-based access control engine for enforcing sign-in conditions, not part of identity governance.

Answer

Self-Service Password Reset

Answer

Conditional Access

Question 13

Which TWO of the following are capabilities of Microsoft Entra ID? (Choose two.)

Accepted Answer

Identity Protection. Microsoft Entra ID (formerly Azure AD) includes Identity Protection (option B), a risk-based service that detects and remediates risky sign-ins and compromised user credentials using signals like leaked credentials and atypical sign-in behavior. It also includes Privileged Identity Management (option D), which provides just-in-time privileged role activation, approval workflows, access reviews, and time-bound role assignments for administrative roles. These are both core Entra ID capabilities within the Entra suite. Device Management (option A) is primarily a Microsoft Intune capability, not Entra ID itself. Endpoint Detection and Response (option C) belongs to Microsoft Defender for Endpoint, and Information Protection (option E) is delivered by Microsoft Purview, so neither is an Entra ID capability.

Answer

Device Management

Answer

Endpoint Detection and Response

Answer

Information Protection

Question 14

Which TWO capabilities are provided by Microsoft Entra Identity Protection?

Accepted Answer

Detecting sign-in risks such as anonymous IP addresses. Microsoft Entra Identity Protection is a risk-detection and remediation service, so option C is correct: it detects sign-in risks such as anonymous IP addresses (along with other detections like atypical travel, malware-linked IPs, and leaked credentials) and surfaces them as risk detections and risky sign-ins. Option D is also correct because Identity Protection can automatically remediate risk by blocking sign-ins through risk-based Conditional Access policies (for example, requiring MFA or blocking when sign-in risk is Medium/High), and it can also require password changes for risky users. Option A is incorrect because session timeouts are enforced through Conditional Access session controls (such as sign-in frequency), not Identity Protection. Option B is incorrect because self-service password reset is a separate Microsoft Entra ID feature, not a capability of Identity Protection. Option E is incorrect because managing privileged role assignments is handled by Privileged Identity Management (PIM), not Identity Protection.

Answer

Enforcing session timeouts for applications

Answer

Self-service password reset

Answer

Managing privileged role assignments

Question 15

Which THREE of the following are capabilities of Microsoft Purview eDiscovery? (Choose three.)

Accepted Answer

Export search results to a PST file. Option B is correct because Microsoft Purview eDiscovery supports exporting search results, and one of the available export formats is a PST file for mailbox content. Option C is correct because eDiscovery allows administrators to place legal holds (e.g., via Litigation Hold or eDiscovery holds) on Exchange Online mailboxes and SharePoint/OneDrive sites to preserve content. Option E is correct because eDiscovery searches can span Microsoft 365 workloads including Exchange Online, SharePoint Online, OneDrive for Business, and other sources. Option A is not an eDiscovery capability; blocking sensitive-data sharing via email is handled by Data Loss Prevention (DLP) policies in Microsoft Purview. Option D is not an eDiscovery capability; automatic deletion of emails older than 7 years is achieved through retention policies or retention labels, not eDiscovery.

Answer

Block sharing of sensitive data via email

Answer

Automatically delete emails older than 7 years

Question 16

Which THREE of the following are valid components of Microsoft Entra Conditional Access? (Select THREE.)

Accepted Answer

Users and groups. In Microsoft Entra Conditional Access, a policy is built from assignments and access controls, and the assignment side includes Users and groups (A), which determines who the policy applies to (all users, specific users/groups, or directory roles). Conditions (C) is also a valid assignment component, letting you scope the policy by signals such as locations, device platforms, client apps, and sign-in risk. Cloud apps or actions (D) is the third valid assignment component, specifying which cloud applications or user actions (like registering security info) the policy protects. Session (B) and Grant (E) are not standalone assignment components; they are categories of access controls (Session controls and Grant controls) that are configured after assignments, so they are not counted among the three assignment components asked for here.

Answer

Session

Answer

Grant

Question 17

Which THREE of the following are capabilities of Microsoft Entra ID Governance?

Accepted Answer

Access reviews. Entitlement management (D) is a core Entra ID Governance capability that lets organizations manage the lifecycle of access through access packages, catalogs, and policies, automating granting, revoking, and expiration of access for internal and external users. Access reviews (B) are also part of Entra ID Governance, enabling periodic recertification of group memberships, application assignments, and privileged role assignments to ensure users retain only the access they need. Privileged Identity Management (C) is included in Entra ID Governance, providing just-in-time privileged access, approval workflows, access reviews, and audit history for Microsoft Entra roles, Azure resources, and other workloads. Self-service password reset (A) is an Entra ID authentication feature, not a governance capability, and Conditional Access (E) is an Entra ID access-control policy engine, so neither belongs to the Entra ID Governance feature set.

Answer

Self-service password reset

Answer

Conditional access

Question 18

Which THREE of the following are features of Microsoft Entra ID Protection?

Accepted Answer

User risk detection (e.g., leaked credentials). Option B is correct because Microsoft Entra ID Protection detects user risk, including leaked credentials found on the dark web or by Microsoft's threat intelligence, and flags the account as at risk. Option C is correct because ID Protection also detects sign-in risk, such as sign-ins from anonymous IP addresses (Tor browser or anonymizing VPNs), atypical travel, or unfamiliar locations. Option E is correct because ID Protection feeds its user and sign-in risk detections into Conditional Access, enabling risk-based policies that can require MFA or block access when risk is elevated. Options A and D are not features of ID Protection: access reviews and entitlement management are capabilities of Microsoft Entra ID Governance (part of Entra ID P2), used for reviewing access and managing the lifecycle of access packages, not for risk detection.

Answer

Access reviews

Answer

Entitlement management

Question 19

Which TWO of the following are capabilities of Microsoft Defender for Office 365?

Accepted Answer

Scan email attachments in a sandbox environment before delivery. Option A is correct because Microsoft Defender for Office 365 includes Safe Attachments, which detonates email attachments in a sandbox (virtual environment) to detect malicious behavior before delivering the message. Option B is correct because Defender for Office 365 provides anti-phishing policies with impersonation protection that detect spoofed or impersonated senders (e.g., executives, domains) to defend against spear-phishing. Option C is incorrect because device compliance policies for mobile devices are enforced by Microsoft Intune (part of Microsoft Endpoint Manager), not Defender for Office 365. Option D is incorrect because legal hold for eDiscovery is a Microsoft Purview (Exchange/Compliance) capability, not a Defender for Office 365 feature. Option E is incorrect because monitoring user behavior for compromised accounts is handled by Microsoft Defender for Identity (or Entra ID Protection), not Defender for Office 365.

Answer

Enforce device compliance policies for mobile devices

Answer

Place a legal hold on mailboxes for eDiscovery

Answer

Monitor user behavior for compromised accounts

Question 20

Which THREE of the following are capabilities of Microsoft Defender for Office 365?

Accepted Answer

Safe Links protection in email and Office documents. Safe Links (A) is a core Defender for Office 365 capability that rewrites and time-of-click verifies URLs in email messages and Office documents to block malicious redirects. Anti-phishing policies (B) are also native to Defender for Office 365, providing impersonation protection for users, domains, and mailbox intelligence to defend against phishing and spoofing. Safe Attachments (E) is likewise a Defender for Office 365 feature that detonates attachments in a sandbox to detect zero-day malware before delivery. Cloud discovery of unsanctioned SaaS apps (C) belongs to Microsoft Defender for Cloud Apps (formerly MCAS), not Defender for Office 365. Device compliance policies for mobile devices (D) are handled by Microsoft Intune and conditional access, not by Defender for Office 365.

Answer

Cloud discovery of unsanctioned SaaS apps

Answer

Device compliance policies for mobile devices