SC-900 Mock Exam 73 — 25 Questions

Question 1

Your organization uses Microsoft Purview Insider Risk Management. You need to create a policy that detects users exfiltrating sensitive data via email to external recipients. Which policy type should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data leaks. Data leaks policy type in Microsoft Purview Insider Risk Management is specifically designed to detect and alert on the unauthorized transmission of sensitive data to external recipients, including via email. This policy type analyzes email headers, attachments, and body content against defined sensitive information types (e.g., credit card numbers, PII) and triggers when data is sent outside the organization, matching the scenario described.

Answer

Offensive language

Answer

Data theft

Answer

Security policy violations

Question 2

A company's security team has adopted a strategy that assumes a breach has already occurred. They implement network segmentation, apply strict least privilege access, continuously verify all access requests, and never trust users or devices solely because they are inside the network perimeter. This approach best describes which security model?

Accepted Answer

Zero Trust. The scenario explicitly describes the core tenets of the Zero Trust model: assume breach, enforce least privilege, segment networks, and never trust any user or device based solely on network location. Zero Trust, as defined by NIST SP 800-207, mandates continuous verification of every access request, treating every request as if it originates from an untrusted network, which directly matches the company's strategy.

Answer

Shared responsibility model

Answer

Defense in depth

Answer

Identity and Access Management (IAM)

Question 3

A company uses Microsoft Entra ID Privileged Identity Management (PIM) to manage elevated access to Microsoft Entra ID roles. They want to ensure that a user who activates a privileged role must provide a justification and receive approval from their manager before activation is complete. Which PIM configuration should be used?

Accepted Answer

Configure role settings to require approval on activation. Microsoft Entra ID Privileged Identity Management (PIM) allows administrators to configure role settings that require approval before a role is activated. By enabling the 'Require approval to activate' setting, a designated approver (such as the user's manager) must review and approve the activation request, ensuring that the justification is validated before access is granted.

Answer

Configure role settings to require multi-factor authentication on activation

Answer

Configure role settings to assign the user as permanently active

Answer

Configure role settings to require an Microsoft Entra ID compliant device

Question 4

Your company is using Microsoft Entra ID to manage identities. You want to allow users to reset their own passwords without help desk intervention, but only if they have registered for self-service password reset (SSPR). What should you configure?

Accepted Answer

Enable Self-Service Password Reset (SSPR) in Microsoft Entra ID.. Enabling Self-Service Password Reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords without help desk intervention, provided they have registered for the feature. This directly meets the requirement of allowing password resets only for registered users, as SSPR requires prior registration to verify identity before a reset is permitted.

Answer

Require all users to register for Microsoft Entra MFA.

Answer

Configure Microsoft Entra password protection.

Answer

Implement Privileged Identity Management (PIM).

Question 5

You are an identity consultant for a mid-sized company with 5,000 employees. They use Microsoft Entra ID P1 and Microsoft Intune for device management. The company wants to implement passwordless authentication for all employees to improve security and user experience. Currently, users sign in with username and password plus MFA via the Microsoft Authenticator app. The company has a mix of Windows 10/11 devices (both domain-joined and Microsoft Entra joined) and iOS/Android mobile devices. They want to support passwordless sign-in on all platforms. The CTO is concerned about cost and wants to minimize additional licensing. Which passwordless method should you recommend?

Accepted Answer

Use the Microsoft Authenticator app for passwordless sign-in. The Microsoft Authenticator app supports passwordless sign-in using phone-based authentication, which works on both iOS and Android devices and can be used to sign into Windows 10/11 devices via the 'Sign in with phone' feature. This method leverages existing Microsoft Entra ID P1 licensing without requiring additional costs, as it is included with the current P1 license. It provides a seamless user experience by eliminating the need for hardware tokens or additional infrastructure, aligning with the CTO's cost-minimization goal.

Answer

Enable Windows Hello for Business for all devices

Answer

Deploy FIDO2 security keys to all employees

Answer

Implement SMS-based one-time passcodes

Question 6

A user reports frequent password reset requests. You suspect password spray attacks. Which Microsoft Entra ID feature should you use to investigate?

Accepted Answer

Identity Protection risk detections. Identity Protection risk detections are the correct feature because they specifically analyze sign-in patterns and flag suspicious activities such as password spray attacks. A password spray attack involves an attacker trying a small number of common passwords against many accounts, and Identity Protection uses machine learning to detect this anomalous behavior and generate risk detections like 'Unfamiliar sign-in properties' or 'Malicious IP address'.

Answer

Audit logs

Answer

Conditional Access policies

Answer

Multifactor authentication

Question 7

Your organization uses Microsoft Defender XDR. You need to investigate a potential lateral movement attack where a compromised user account is used to access multiple workstations. Which feature should you use to visualize the attack path?

Accepted Answer

Attack graph. Attack graph in Microsoft Defender XDR is the correct feature because it automatically maps and visualizes the potential paths an attacker could take to move laterally across devices using compromised credentials. It correlates alerts and incidents to show the sequence of events, such as a user account authenticating to multiple workstations, enabling security teams to identify the scope and entry point of the attack.

Answer

Microsoft Sentinel workbooks

Answer

Threat analytics in Microsoft 365 Defender

Answer

Incident queue

Question 8

A security analyst runs the above KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Identify users with more than 5 MFA failure anomalies in the last 7 days. The KQL query uses `summarize` with `count()` on MFA failure anomalies, then filters with `where count_ > 5` and `where TimeGenerated > ago(7d)`. This explicitly returns only users whose anomaly count exceeds 5 in the last 7 days, making option D correct. The query does not correlate with other events, list all users with any anomaly, or check block status.

Answer

Correlate MFA failures with other security events

Answer

Identify all users who had an MFA failure anomaly in the last 7 days

Answer

Identify users who have been blocked due to MFA failures

Question 9

A security operations center (SOC) team needs a centralized platform to collect logs from firewalls, servers, and cloud applications. They want to analyze these logs to detect threats, create custom alerts, and automate response actions using playbooks. The solution should also provide threat intelligence feeds and allow for advanced hunting with Kusto Query Language (KQL). Which Microsoft security solution should the team implement?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. It provides a centralized platform for collecting logs from diverse sources (firewalls, servers, cloud apps), enables custom alert creation, automates response via playbooks (Azure Logic Apps), integrates threat intelligence feeds, and supports advanced hunting using Kusto Query Language (KQL).

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Purview Compliance Manager

Question 10

Your organization uses Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from their CEO asking for a wire transfer. The email passed through the spam filter. What additional protection should be enabled to detect such attacks?

Accepted Answer

Impersonation protection in anti-phishing policy. The attack described is a business email compromise (BEC) or CEO fraud, which relies on impersonation rather than malicious links or attachments. Microsoft Defender for Office 365's anti-phishing policy includes impersonation protection that specifically detects and mitigates attempts where a sender spoofs a high-profile user (like the CEO) or domain. Enabling impersonation protection in the anti-phishing policy is the correct additional safeguard because the email passed the spam filter, indicating it was not a bulk or malware-based threat.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Safe Links policy

Question 11

An organization uses Microsoft Purview Information Protection to classify and protect data. Which TWO methods can be used to apply sensitivity labels automatically?

Accepted Answer

Auto-labeling policies in Microsoft 365 compliance center. Auto-labeling policies can apply labels based on conditions. Client-side labeling via the Azure Information Protection unified labeling client also supports automatic classification. Manual labeling is not automatic. Labeling in Microsoft 365 Apps is default but not automatic. PowerShell cannot directly apply labels automatically without scripts.

Answer

Default labeling policy for Microsoft 365 Apps

Answer

Manual labeling by end users

Answer

PowerShell scripts to apply labels on export

Question 12

A company wants to use Microsoft Intune to enforce that mobile devices have a PIN of at least 6 characters to access corporate resources. What should they configure?

Accepted Answer

Device compliance policy. A device compliance policy in Microsoft Intune defines the rules that devices must meet to be considered compliant, such as requiring a PIN of at least 6 characters. When a device is marked non-compliant, Conditional Access can block access to corporate resources. This is the correct mechanism to enforce the PIN requirement at the device level before granting access.

Answer

Conditional access policy

Answer

App protection policy

Answer

Device configuration profile

Question 13

Your organization is deploying Microsoft Defender XDR to detect and respond to advanced threats. You need to ensure that security alerts from Microsoft Defender for Endpoint are automatically correlated with alerts from Microsoft Defender for Office 365. What should you configure?

Accepted Answer

Ensure that all Microsoft Defender services are onboarded to the same tenant and that the incidents feature is enabled. Microsoft Defender XDR automatically correlates alerts from different Microsoft Defender services (e.g., Defender for Endpoint and Defender for Office 365) when they are onboarded to the same tenant and the incidents feature is enabled. This built-in correlation uses the Microsoft 365 Defender backend to fuse related alerts into a single incident, providing a unified view of the attack chain without additional configuration.

Answer

Configure a custom detection rule in Microsoft 365 Defender

Answer

Create an advanced hunting query to join alerts from different data sources

Answer

Enable Microsoft Sentinel and configure incident creation rules

Question 14

A compliance administrator creates a retention policy as shown in the exhibit. What is the overall effect of this policy on content in SharePoint Online?

Accepted Answer

Content is retained for 7 years and then automatically deleted.. The retention policy in the exhibit is configured to retain content for 7 years and then delete it. This means content in SharePoint Online will be kept for the specified duration and automatically purged at the end of the retention period, which matches option D.

Answer

Content is deleted immediately after 7 years from creation.

Answer

Content is automatically labeled after 7 years.

Answer

Content is retained indefinitely after 7 years.

Question 15

A company wants to automatically detect and remediate compliance issues such as sharing sensitive data externally. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect, alert, and automatically remediate when sensitive data (e.g., credit card numbers, personally identifiable information) is shared externally via email, Teams, or cloud apps. DLP policies can enforce actions like blocking the transmission or applying encryption, directly addressing the requirement to prevent unauthorized external sharing of sensitive data.

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Audit

Question 16

An organization wants to allow users to sign in using their mobile phone number and a verification code. Which Microsoft Entra ID feature enables this?

Accepted Answer

SMS-based authentication. SMS-based authentication allows users to sign in to Microsoft Entra ID by entering their mobile phone number and receiving a verification code via text message. This is a form of passwordless authentication that leverages the user's phone number as the primary identifier and the SMS-delivered code as the second factor, meeting the organization's requirement for phone number and verification code sign-in.

Answer

FIDO2 security keys

Answer

App passwords

Answer

Password hash synchronization

Question 17

Your organization wants to ensure that all external emails are automatically tagged with a disclaimer at the top of the email body. Which Microsoft Exchange Online feature should you configure?

Accepted Answer

Mail flow rule (transport rule). Mail flow rules (also known as transport rules) in Exchange Online allow you to inspect messages and take actions such as adding a disclaimer to the top of the email body. This rule can be scoped to apply only to external emails by using the condition 'The sender is located outside the organization'. The action 'Prepend a disclaimer' inserts the text at the beginning of the message body, meeting the requirement precisely.

Answer

Journal rule

Answer

Data loss prevention (DLP) policy

Answer

Safe Links policy

Question 18

Which THREE capabilities are included in Microsoft Purview Audit (Premium)?

Accepted Answer

Access to high-value critical events. Microsoft Purview Audit (Premium) provides access to high-value critical events, such as when mailbox items are accessed or when administrative actions are performed on sensitive data. These events are not logged in Audit (Standard) and require Premium licensing to capture, enabling deeper forensic investigation.

Answer

Trainable classifiers

Answer

Custom alert policies

Question 19

Your organization uses Microsoft Purview to manage data lifecycle. You need to ensure that after a project ends, all related files are automatically deleted after 3 years. What should you configure?

Accepted Answer

Create a retention label with a retention period of 3 years and a disposition action of deletion. A retention label in Microsoft Purview allows you to define a retention period and then automatically trigger a disposition action—such as permanent deletion—when that period expires. By creating a label with a 3-year retention period and setting the disposition action to 'Delete', all files tagged with that label will be automatically removed after three years, meeting the requirement without manual intervention.

Answer

Configure a DLP policy to delete files after 3 years

Answer

Create an eDiscovery case and manually delete the files

Answer

Apply a sensitivity label marked 'Project' and configure auto-deletion

Question 20

A company uses a hybrid environment with Azure virtual machines (IaaS) and on-premises Windows servers. The security team needs a single solution that continuously assesses the security posture of these workloads, provides a regulatory compliance dashboard with actionable recommendations, and enables threat detection. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct answer because it provides a unified security management platform that continuously assesses the security posture of both Azure VMs (IaaS) and on-premises Windows servers via Azure Arc. It offers a regulatory compliance dashboard with actionable recommendations based on built-in standards like CIS, NIST, and Azure Security Benchmark, and integrates with Microsoft Defender for Cloud's workload protection plans to enable threat detection for these hybrid workloads.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel