SC-900 Mock Exam 75 — 25 Questions

Question 1

A healthcare organization must comply with HIPAA regulations regarding the protection of patient health information (PHI). Which cloud compliance concept ensures that the organization has controls in place to meet regulatory requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compliance management. Compliance management is the cloud compliance concept focused on ensuring an organization has the controls, policies, and evidence in place to satisfy regulatory frameworks such as HIPAA. It maps cloud controls to regulatory requirements and provides audit-ready reporting. Privacy management focuses on handling personal data subject rights, while security management addresses technical safeguards rather than regulatory alignment.

Answer

Privacy management

Answer

Identity management

Answer

Security management

Question 2

A company stores customer data in Microsoft 365 and needs to identify which data is subject to GDPR. Which Microsoft Purview solution should be used?

Accepted Answer

Data Classification. Microsoft Purview Data Classification uses sensitive information types (SITs) and trainable classifiers to automatically identify and label data matching regulatory patterns such as GDPR. It provides the discovery and classification layer that reveals which content is subject to GDPR obligations. Without classification, an organization cannot know where GDPR-relevant data resides across Microsoft 365 workloads.

Answer

Data Lifecycle Management

Answer

Data Loss Prevention

Answer

Audit

Question 3

A company uses Microsoft 365 and is concerned about phishing attacks targeting employees. They want to deploy a solution that can automatically analyze email messages for malicious links and attachments, and also provide click-time protection by rewriting URLs. Which Microsoft 365 Defender component should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) is the correct component because it is specifically designed to protect against email-borne threats such as phishing. It includes Safe Links and Safe Attachments features that automatically scan email messages for malicious links and attachments, and it rewrites URLs to provide click-time protection by checking the link against a dynamic threat intelligence feed at the moment of the click.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 4

You are analyzing a PIM activation request. The roleDefinitionId corresponds to the Global Administrator role. What is the duration of the activation?

Accepted Answer

4 hours. By default, the activation duration for a PIM role is 4 hours. While the maximum allowed activation duration for any role, including Global Administrator, is 8 hours, the system's default setting is 4 hours if no custom configuration is applied. Highly privileged roles like Global Administrator are often configured with an 8-hour maximum by organizations, but the system default is 4 hours.

Answer

8 hours

Answer

8 minutes

Answer

8 days

Question 5

Your organization uses Microsoft Entra ID. You want to provide external partners with access to a SharePoint site using their own identity providers (e.g., Google, Facebook). Which feature should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration allows you to invite external users (guests) to your Microsoft Entra ID tenant and grant them access to your organization's resources, such as SharePoint sites. B2B supports various identity providers for guest users, including other Microsoft Entra ID tenants, Microsoft accounts, email one-time passcodes, and crucially, social identity providers like Google and Facebook. By configuring federation with these social providers, external partners can use their existing Google or Facebook accounts to sign in as guests and access the SharePoint site. Microsoft Entra External ID (B2C) is primarily designed for customer-facing applications and managing consumer identities in a separate tenant, not for directly granting partners access to internal resources like SharePoint within the main Entra ID tenant.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra External ID (B2C)

Answer

Conditional Access policies

Question 6

Refer to the exhibit. A user accesses a web app from a device that is Microsoft Entra joined but not Intune compliant. Which condition will be satisfied?

Accepted Answer

Neither condition. The exhibit shows a Conditional Access policy that requires both 'Domain joined' and 'Compliant device' conditions. The device is Microsoft Entra joined. In Conditional Access, the 'Domain joined' condition specifically refers to devices that are *Hybrid Microsoft Entra ID joined* (joined to an on-premises Active Directory and registered with Microsoft Entra ID). A device that is *only* Microsoft Entra joined does not satisfy the 'Domain joined' condition. Additionally, the device is stated as 'not Intune compliant', so it fails the 'Compliant device' condition. Therefore, neither the 'Domain joined' nor the 'Compliant device' condition is satisfied, making option B correct.

Answer

Domain joined

Answer

Compliant device

Answer

Both conditions

Question 7

Contoso uses Microsoft Sentinel. They want to automate response to a high-severity incident by blocking the source IP in Azure Firewall and sending a notification to the SOC team via email. Which feature should they use?

Accepted Answer

Create an automation rule.. Microsoft Sentinel automation rules allow you to define triggers and actions based on incident creation or updates. They can automatically run playbooks (Logic Apps) to perform response actions like blocking an IP in Azure Firewall and sending email notifications. Automation rules are designed for orchestration and response, making them the correct choice for automating incident response.

Answer

Create a hunting query.

Answer

Enable Fusion.

Answer

Create a workbook.

Question 8

Your company uses Microsoft Purview to govern data across on-premises and cloud sources. You need to classify sensitive data such as credit card numbers and social security numbers automatically. What should you create?

Accepted Answer

Sensitive information types. Sensitive information types (SITs) in Microsoft Purview are pattern-based classifiers that detect specific data formats such as credit card numbers, SSNs, and passport numbers using regex, checksums, and keyword proximity. They are the foundational building block used by DLP policies, sensitivity labels, and auto-labeling to identify sensitive content. Creating a SIT is the correct step to enable automatic classification of regulated data.

Answer

Data loss prevention policies

Answer

Sensitivity labels

Answer

Retention labels

Question 9

A user reports that they cannot access a sensitive document in SharePoint. The document has a sensitivity label of 'Highly Confidential' applied. The user is a member of the 'Finance' group, which has the label permission. However, the user is located in a country that is blocked by a conditional access policy. What is the most likely reason the user cannot access the document?

Accepted Answer

A conditional access policy is blocking access based on the user's location. The user is a member of the Finance group, which has the necessary sensitivity label permission, so lack of permission is not the issue. The most likely reason is that a conditional access policy is blocking access based on the user's location, as the user is in a blocked country. Conditional access policies in Microsoft Entra ID can restrict access based on location, and this would override other permissions.

Answer

The user does not have the required sensitivity label permission

Answer

The user does not have a Microsoft 365 E5 license

Answer

The document does not have a sensitivity label applied

Question 10

A company uses Microsoft Entra ID. The security team wants to automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel between geographically distant locations within an unrealistic time frame. They need a solution that can automatically trigger actions like forcing a password reset or blocking sign-in for users identified as high risk. Which Microsoft Entra ID capability should they configure?

Accepted Answer

Microsoft Entra Identity Protection. Microsoft Entra Identity Protection is the correct capability because it is specifically designed to detect and automatically respond to risky user behaviors, such as sign-ins from anonymous IP addresses or impossible travel. It uses machine learning to assign risk levels and can trigger automated actions like forcing a password reset or blocking sign-in for high-risk users, aligning directly with the security team's requirements.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Governance

Question 11

A company uses Microsoft 365 and needs to classify and protect sensitive documents by applying encryption and visual markings (headers/footers) based on the content's sensitivity. They also want to automatically revoke access to documents that leave the organization. Which Microsoft Purview solution should they configure?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (B) is the correct solution because it provides the capabilities to classify and protect sensitive documents using sensitivity labels. These labels can enforce encryption and apply visual markings like headers and footers based on content sensitivity. Additionally, Information Protection supports automatic revocation of access to documents that leave the organization through features like rights management and conditional access policies.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit

Question 12

A legal department is preparing for litigation. They need to preserve all potentially relevant content in Exchange Online, SharePoint Online, and Teams to prevent deletion or modification. Additionally, they must search across these locations for specific keywords and export the results for external review. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Standard). eDiscovery (Standard) is the correct solution because it provides the capabilities to place Exchange Online, SharePoint Online, and Teams content on legal hold to preserve it from deletion or modification, and it includes built-in search and export functions for litigation. This solution directly addresses the requirements for preservation, keyword search across multiple workloads, and export for external review.

Answer

Audit (Standard)

Answer

Data Lifecycle Management

Answer

Communication Compliance

Question 13

A company uses Microsoft Entra ID. They have a critical application that requires additional security. The security team wants to enforce multifactor authentication (MFA) for every access to the application, but they also want users to reauthenticate with MFA if a session lasts longer than 60 minutes, regardless of device compliance. Which Conditional Access control should the administrator configure?

Accepted Answer

Session control: Sign-in frequency. The requirement to force reauthentication with MFA after a specific time period (60 minutes) is a session-level control, not a grant control. The 'Sign-in frequency' session control in Conditional Access allows administrators to define how often a user must reauthenticate, including re-prompting for MFA, regardless of device compliance. This directly meets the scenario's need for a time-based reauthentication policy.

Answer

Grant control: Require multifactor authentication

Answer

Session control: Application enforced restrictions

Answer

Grant control: Require device to be marked as compliant

Question 14

A security administrator at an organization using Microsoft Entra ID needs to automatically detect user sign-ins that exhibit risky behavior, such as signing in from a suspicious IP address or using leaked credentials. The administrator also wants the system to automatically calculate a risk level for each user and take actions like requiring a password reset when risk is high. Which Microsoft Entra ID feature should the administrator use?

Accepted Answer

Identity Protection. Microsoft Entra ID Protection is the correct feature because it automatically detects risky sign-in behaviors—such as sign-ins from suspicious IP addresses, anonymous IP addresses, or leaked credentials—and calculates a user risk level. It can then automatically trigger remediation actions like requiring a password reset when the risk level is high, directly matching the administrator's requirements.

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access

Answer

Identity Governance

Question 15

Which THREE of the following are capabilities of Microsoft Purview Information Protection?

Accepted Answer

Auto-labeling for sensitive data. Microsoft Purview Information Protection provides auto-labeling for sensitive data (A), which uses trainable classifiers and sensitive information types to automatically apply labels to content in services like SharePoint, OneDrive, and Exchange. It also provides sensitivity labels (C), the core classification mechanism that lets organizations tag and classify data by sensitivity level across Microsoft 365 apps and services. Encryption and rights protection (D) is another core capability, as sensitivity labels can apply Azure Rights Management (Azure RMS) encryption and usage rights so that only authorized users can access protected content. The unmarked options do not belong: communication monitoring (B) is a capability of Microsoft Purview Communication Compliance, and retention policies (E) fall under Microsoft Purview Data Lifecycle Management rather than Information Protection.

Answer

Communication monitoring

Answer

Retention policies

Question 16

Which TWO of the following are benefits of using Microsoft Entra ID for identity management? (Choose two.)

Accepted Answer

Conditional Access policies. Option B (Conditional Access policies) is correct because Microsoft Entra ID provides a policy engine that evaluates signals such as user/group membership, device compliance, location, and risk to grant, block, or require MFA for access to cloud and integrated apps. Option C (Single sign-on, SSO) is correct because Entra ID acts as a centralized identity provider using protocols like SAML 2.0, WS-Federation, OpenID Connect, and OAuth 2.0, letting users authenticate once and access multiple applications without re-entering credentials. Option A is wrong because storing passwords in plaintext is a severe security anti-pattern and Entra ID stores credentials as salted hashes, not plaintext. Option D is wrong because Entra ID is a cloud-based identity service, not a mechanism for local authentication of every app. Option E is wrong because Entra ID is a cloud identity provider and does not restrict authentication to on-premises only; it can integrate with on-premises AD via Entra Connect or Entra Cloud Sync.

Answer

Storing passwords in plaintext

Answer

Local authentication for all apps

Answer

On-premises authentication only

Question 17

Which TWO of the following are principles of the Zero Trust security model? (Select two.)

Accepted Answer

Verify explicitly. Option A, "Verify explicitly," is a core Zero Trust principle: every access request must be authenticated and authorized based on all available data points (identity, device health, location, workload, data classification) rather than assumed from network location. Option E, "Least privilege access," is also a foundational Zero Trust principle, requiring just-in-time and just-enough-access (JIT/JEA), risk-based adaptive policies, and data protection to limit each user's exposure. The unmarked options do not belong because B, "Perimeter-based security," reflects the traditional castle-and-moat model that Zero Trust explicitly replaces; C, "Implicit trust," is the assumption Zero Trust eliminates by treating every session as untrusted until verified; and D, "Trust but verify," is a Cold War-era adage (and a contrasting posture) rather than a Zero Trust principle, since Zero Trust never grants trust in the first place.

Answer

Perimeter-based security

Answer

Implicit trust

Answer

Trust but verify

Question 18

Which TWO of the following are identity-related security best practices recommended by Microsoft? (Choose two.)

Accepted Answer

Implement Conditional Access policies. Option B is correct because Microsoft recommends Conditional Access policies in Microsoft Entra ID to evaluate signals such as user, device, location, and risk, and then enforce appropriate access controls (for example, requiring MFA or compliant devices) before granting access to resources. Option E is correct because enabling multi-factor authentication (MFA) is a core Microsoft identity best practice that adds a second verification factor beyond a password, dramatically reducing the risk of credential compromise and account takeover. Options A, C, and D are not best practices: sharing passwords for critical accounts violates the principle of individual accountability and non-repudiation, using SSO without MFA still leaves accounts protected only by a single factor, and disabling sign-in logs removes the audit and monitoring data needed to detect and investigate suspicious authentication activity.

Answer

Share passwords with team members for critical accounts

Answer

Use single sign-on (SSO) without MFA

Answer

Disable sign-in logs to reduce storage costs

Question 19

Which TWO components are part of the 'Zero Trust' security model? (Choose two.)

Accepted Answer

Least privilege. Option A (Least privilege) is correct because Zero Trust requires granting users and workloads only the minimum access needed for a specific task, typically enforced through just-in-time and just-enough-access policies, which limits lateral movement if an identity is compromised. Option D (Verify explicitly) is correct because Zero Trust mandates authenticating and authorizing every request based on all available signals—identity, device health, location, and data sensitivity—rather than trusting anything implicitly based on network location. Options B (VPN access), C (Password complexity), and E (Perimeter-based security) do not belong: a VPN is a legacy network-centric tunneling control that grants broad internal access once connected, password complexity is a single authentication hygiene rule rather than a Zero Trust principle, and perimeter-based security is the traditional castle-and-moat model that Zero Trust explicitly replaces with 'never trust, always verify.'

Answer

VPN access

Answer

Password complexity

Answer

Perimeter-based security

Question 20

Which TWO of the following are purposes of the 'Zero Trust' security model?

Accepted Answer

Explicitly verify every access request. Option A is correct because Zero Trust requires that every access request be explicitly verified based on identity, device health, and context before granting access, rather than trusting anything based on network location. Option B is correct because the Zero Trust model operates on the assumption that the network is hostile and open, so no implicit trust is granted to traffic regardless of its origin. Option C is incorrect because relying on a single perimeter firewall reflects the traditional castle-and-moat model, which Zero Trust explicitly moves away from. Option D is incorrect because implicitly trusting internal traffic is the opposite of Zero Trust's core principle of never trusting by default. Option E is incorrect because assuming the network is always safe contradicts Zero Trust's foundational assumption that networks should be treated as compromised.

Answer

Rely on a single perimeter firewall

Answer

Trust internal traffic implicitly

Answer

Assume that the network is always safe