SC-900 Mock Exam 74 — 25 Questions

Question 1

A company must implement data classification labels in Microsoft Purview to protect sensitive information. Which TWO actions are required to create and publish a sensitivity label?

Accepted Answer

Create the label in the Microsoft Purview compliance portal.. Option C is correct because every sensitivity label must first be created in the Microsoft Purview compliance portal (Solutions > Information protection > Labels), where you define its name, description, and encryption/content-marking settings. Option D is correct because a label only becomes available to users and services after it is published through a label policy, which defines the users/groups and the locations (workloads) where the label is applied. Options A, B, and E are not required: labels are not deployed via Intune configuration profiles, the label scope (SharePoint/OneDrive, Exchange, etc.) is selected inside the label policy rather than being a separate mandatory action, and auto-labeling rules are configured in Microsoft Purview (not Microsoft 365 Defender) and are optional for creating and publishing a label.

Answer

Deploy the label using Microsoft Intune configuration profiles.

Answer

Define the label scope to include SharePoint and OneDrive.

Answer

Configure auto-labeling rules in Microsoft 365 Defender.

Question 2

A company is implementing data classification in Microsoft Purview. Which THREE of the following are types of sensitive information that can be detected using built-in sensitive information types?

Accepted Answer

Passport numbers. Microsoft Purview ships with numerous built-in sensitive information types (SITs) that use pattern matching, checksums, and keyword evidence to detect common regulated data. Option A (Passport numbers) is correct because Purview includes built-in SITs for passport numbers of multiple countries (for example, U.S. and EU passport formats). Option B (Social security numbers) is correct because the U.S. Social Security Number (SSN) SIT is a core built-in type that matches the 3-2-4 digit pattern with additional validation. Option C (Credit card numbers) is correct because Purview provides built-in SITs for major card brands (Visa, Mastercard, American Express, Discover) that validate the number using the Luhn algorithm. Options D (Favorite color) and E (Project codenames) are not built-in SITs; these are arbitrary, organization-specific data elements that would require custom sensitive information types or trainable classifiers to detect.

Answer

Favorite color

Answer

Project codenames

Question 3

Your organization wants to automatically retain all customer emails for 7 years and then delete them. Which Microsoft Purview feature should you configure?

Accepted Answer

Data Lifecycle Management retention policy. Microsoft Purview Data Lifecycle Management retention policies are designed to automatically retain and then delete content (e.g., Exchange emails, SharePoint files, Teams messages) based on a specified retention period. Configuring a retention policy with a 7-year retention period and a delete action after that period meets the requirement to retain customer emails for 7 years and then delete them.

Answer

Information Protection sensitivity labels

Answer

Audit log retention

Answer

eDiscovery hold

Question 4

Your organization is implementing Microsoft Purview to manage data compliance. They need to automatically detect and protect credit card numbers in emails and documents. Which Microsoft Purview feature should they configure?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the feature designed to automatically detect sensitive information such as credit card numbers in emails, documents, and other workloads, and apply protective actions like blocking, warning, or encrypting. DLP uses sensitive information types (SITs) and trainable classifiers to identify patterns like PCI-DSS credit card numbers and enforce policies across Exchange, SharePoint, OneDrive, Teams, and endpoints.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

Information Protection

Question 5

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) in Microsoft Entra ID allows users to reset their own passwords without contacting the helpdesk, restoring access to Microsoft 365 services. When a user forgets their password and cannot sign in, SSPR is the designated self-service tool, provided the organization has enabled and configured it. It supports authentication methods like Microsoft Authenticator, email, or phone.

Answer

Password reset admin portal

Answer

Identity Protection

Answer

Privileged Identity Management

Question 6

Your organization uses Microsoft Entra ID P2 and wants to reduce the risk of identity compromise by requiring multifactor authentication (MFA) for all users, but excluding users when they are on the corporate network. Which policy type should you configure?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA based on conditions such as user group, location, device, and application. You can create a policy that requires MFA for all users but excludes trusted corporate network locations.

Answer

Self-service password reset (SSPR) policy

Answer

Identity Protection risk policy

Answer

Privileged Identity Management (PIM) activation policy

Question 7

A company deploys a web application on Azure virtual machines (VMs) in an Infrastructure-as-a-Service (IaaS) model. The company is responsible for managing the guest operating system, the application code, and the data stored on the VMs. According to the shared responsibility model, which of the following security responsibilities does Microsoft retain in this scenario?

Accepted Answer

Protecting the physical datacenter and the underlying hardware. In an IaaS model, Microsoft retains responsibility for the physical datacenter, including physical security, the network infrastructure, and the underlying hardware (servers, storage, networking). This is because the customer manages the guest OS, application, and data, while Microsoft manages the physical layer up to the hypervisor. Option A correctly identifies this retained responsibility.

Answer

Configuring the operating system firewall on each VM

Answer

Installing and patching the application software

Answer

Managing user access to the application

Question 8

An organization wants to enable passwordless authentication for its users by using a mobile app. Which Microsoft Entra ID authentication method should they implement?

Accepted Answer

Microsoft Authenticator (passwordless sign-in). Microsoft Authenticator's passwordless sign-in feature allows users to authenticate using their phone's biometric or PIN instead of a password, satisfying the requirement for passwordless authentication via a mobile app. It works by binding the user's account to the Authenticator app, which then receives push notifications or generates one-time codes for sign-in. This is the only option that specifically uses a mobile app as the authentication method.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Question 9

You are evaluating the Conditional Access policy JSON exhibit. The policy includes MFA for Exchange Online but excludes trusted locations. A user reports that they are prompted for MFA when accessing webmail from a trusted IP address. Which is the most likely cause?

Accepted Answer

The location condition is configured to include trusted locations. In Microsoft Entra Conditional Access, the 'Locations' condition has two mutually exclusive states: 'Include' or 'Exclude.' If trusted locations are placed in the Include list, the policy applies ONLY when the user signs in from those trusted IPs — the opposite of the intended 'skip MFA from trusted locations' behavior. To exempt trusted locations, they must be listed under Exclude, not Include.

Answer

The policy targets high sign-in risk

Answer

The policy does not apply to Exchange Online

Answer

The policy requires device compliance

Question 10

A multinational corporation must comply with the EU General Data Protection Regulation (GDPR). They need to respond to a data subject access request (DSAR) by searching for personal data across Exchange Online, SharePoint Online, and OneDrive for Business. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Premium). Microsoft Purview eDiscovery (Premium) provides the Content Search, case management, custodian, and review-set capabilities needed to locate and export personal data across Exchange Online, SharePoint Online, OneDrive for Business, and Teams for a DSAR response. It is the only Purview workload designed specifically for identifying and collecting responsive content across Microsoft 365 workloads at scale.

Answer

Data Lifecycle Management

Answer

Audit (Premium)

Answer

Data Loss Prevention (DLP)

Question 11

Which THREE are benefits of using Microsoft Purview Compliance Manager?

Accepted Answer

View a compliance score that indicates your overall compliance posture.. Option B is correct because Microsoft Purview Compliance Manager provides a compliance score that quantifies your organization's overall compliance posture against regulatory standards and Microsoft 365 baseline controls, updating as you complete improvement actions. Option C is correct because Compliance Manager lets you assign improvement actions and compliance tasks to other users in the organization, tracking who is responsible and the status of each task. Option D is correct because Compliance Manager surfaces recommended improvement actions, prioritized by impact on your compliance score, that guide you toward meeting specific regulations and standards. Option A is not correct because Data Loss Prevention policies are created and managed in the Microsoft Purview Data Loss Prevention solution, not as a benefit of Compliance Manager. Option E is not correct because automatic sensitivity label application is performed by Microsoft Purview Information Protection features such as auto-labeling policies, not by Compliance Manager.

Answer

Create Data Loss Prevention policies.

Answer

Automatically apply sensitivity labels to documents.

Question 12

A company wants to implement a Zero Trust security model. Which TWO of the following are core principles of Zero Trust?

Accepted Answer

Verify explicitly. Option B (Verify explicitly) is correct because Zero Trust requires every access request to be authenticated and authorized based on all available data points—user identity, device health, location, and workload—rather than assuming trust from network position. Option E (Least privilege access) is correct because Zero Trust limits user and workload access to only what is needed for the task, typically enforced through just-in-time and just-enough-access policies and micro-segmentation. Option A (Trust based on network location) is wrong because Zero Trust explicitly rejects the idea that being inside a corporate network grants trust. Option C (Perimeter-based security) is wrong because Zero Trust moves away from a castle-and-moat perimeter model toward identity-centric controls. Option D (Implicit trust for internal users) is wrong because Zero Trust assumes breach and requires continuous verification, never granting implicit trust to internal users.

Answer

Trust based on network location

Answer

Perimeter-based security

Answer

Implicit trust for internal users

Question 13

A company is implementing Microsoft Purview Communication Compliance to detect inappropriate messages. They need to monitor Microsoft Teams channel messages and chat messages for potential policy violations. Which configuration is required?

Accepted Answer

Configure a Communication Compliance policy that includes Teams messages as the supervised communication channel.. Communication Compliance in Microsoft Purview is configured by creating a policy that specifies the supervised communication channels, and Microsoft Teams chats and channel messages are selectable channels within that policy. Enabling Teams as a supervised channel is the required configuration to detect inappropriate messages in Teams. DLP, retention, and third-party archiving address different compliance goals.

Answer

Enable Microsoft Purview Data Loss Prevention (DLP) policies for Teams.

Answer

Set up an Exchange Online retention policy to retain Teams messages.

Answer

Deploy a third-party archiving solution for Teams messages.

Question 14

A company uses Microsoft Purview Compliance Manager to improve their compliance posture. They are preparing for a SOC 2 audit and need to score compliance with SOC 2 controls, track improvement actions, and assign tasks to responsible teams. Which component of Compliance Manager should they use to assign and track specific actions to improve their compliance score?

Accepted Answer

Improvement action. Improvement actions in Compliance Manager are the specific, actionable tasks that directly impact your compliance score. They represent the steps you need to take (e.g., configuring a policy, enabling logging) to satisfy a control. By assigning these actions to responsible teams and tracking their completion status, you can systematically improve your score and demonstrate progress during a SOC 2 audit.

Answer

Assessment

Answer

Control

Answer

Template

Question 15

A company implements a sign-in process where a user must provide their password and then enter a temporary code sent to their mobile phone. Which security principle is this process primarily enforcing?

Accepted Answer

Authentication. The process of verifying a user's identity by requiring both a password (something they know) and a temporary code sent to their mobile phone (something they have) is a classic implementation of multi-factor authentication (MFA). Authentication is the security principle that confirms the identity of a user, device, or system before granting access. This sign-in flow directly enforces authentication by combining two distinct factors to prove the user is who they claim to be.

Answer

Authorization

Answer

Accounting

Answer

Non-repudiation

Question 16

A company runs virtual machines in Azure and also maintains on-premises servers connected via Azure Arc. The security team needs a single dashboard to view security recommendations, detect misconfigurations, and track a secure score across both environments. They also want to enable advanced threat protection features such as just-in-time (JIT) VM access and file integrity monitoring for these workloads. Which Microsoft security solution should they implement?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a unified dashboard that displays security recommendations, misconfigurations, and a secure score across both Azure and on-premises workloads connected via Azure Arc. It also includes advanced threat protection features like just-in-time (JIT) VM access and file integrity monitoring, making it the correct choice for this scenario.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 17

A multinational corporation must comply with GDPR and requires that personal data of EU users be retained for a maximum of 90 days after account closure. After that, all personal data must be permanently deleted. Which combination of Microsoft Purview capabilities should be used?

Accepted Answer

Create a retention label with a retention period of 90 days and then delete the content automatically. A retention label with a retention period of 90 days and then automatic deletion is the correct combination. Retention labels in Microsoft Purview are designed to manage data lifecycle, including retention and deletion. You can configure a retention label to retain content for a specific period and then delete it automatically, which meets the GDPR requirement.

Answer

Configure an eDiscovery case to delete content after 90 days

Answer

Apply a sensitivity label that expires after 90 days

Answer

Use a Data Loss Prevention policy to block retention after 90 days

Question 18

Which Microsoft cloud service provides a unified data governance solution that helps you manage and protect data across your entire data estate, including multi-cloud and on-premises?

Accepted Answer

Microsoft Purview. Microsoft Purview is the correct answer because it is a unified data governance service that provides visibility into data assets across on-premises, multi-cloud, and SaaS environments. It enables data classification, sensitive data discovery, and policy-based access control to manage and protect the entire data estate, aligning with the question's requirement for a comprehensive governance solution.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 19

A healthcare organization uses Microsoft 365 and must comply with HIPAA regulations. They need to assess their current compliance posture, identify gaps, and implement improvement actions. They want a tool that provides a compliance score based on best practices and regulatory frameworks, and offers recommended actions to improve the score. Which Microsoft Purview solution should they use?

Accepted Answer

Compliance Manager. Microsoft Purview Compliance Manager provides a compliance score based on your configuration against best practices and regulatory frameworks like HIPAA. It offers a centralized dashboard to assess compliance posture, identify gaps, and provides recommended improvement actions with step-by-step guidance. This directly matches the requirement to assess, identify gaps, and implement improvements.

Answer

Insider Risk Management

Answer

Communication Compliance

Answer

Audit

Question 20

You are analyzing a Microsoft Purview Data Lifecycle Management retention policy scoped to the HR department. The policy has a retention period of 365 days and a deletion action at the end of the retention period. What is the outcome of this policy?

Accepted Answer

Content from the HR department in Exchange and SharePoint is retained for 365 days and then deleted. The policy is scoped to the HR department and has a retention period of 365 days with a deletion action at the end. Therefore, content from the HR department in Exchange and SharePoint is retained for 365 days and then deleted, matching option A.

Answer

Content from the HR department in Exchange and SharePoint is deleted after 90 days

Answer

Content from all employees in Exchange and SharePoint is retained for 365 days

Answer

Content from the HR department in Exchange and SharePoint is retained for 365 days