SC-900 Mock Exam 76 — 25 Questions

Question 1

Your organization uses Microsoft Purview to manage compliance. You need to ensure that financial documents are automatically labeled as 'Financial' and retained for 7 years. Additionally, if a user tries to share a financial document externally, they must see a policy tip warning them and be blocked if they proceed. You also need to audit all access to financial documents. Which configuration should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an auto-labeling policy to apply a sensitivity label 'Financial' with encryption; create a retention policy to retain all labeled content for 7 years; create a DLP policy to block external sharing of 'Financial' labeled content with a policy tip; enable audit logging. It combines auto-labeling to automatically apply the 'Financial' sensitivity label with encryption, a retention policy to retain labeled content for 7 years, a DLP policy to block external sharing with a policy tip, and audit logging (enabled by default) to track access. Option A lacks labeling and retention. Option B uses manual labeling, which is not automatic, and the DLP only warns, not blocks. Option C uses a retention label instead of a sensitivity label, so it does not provide encryption or protection, and the DLP policy does not include a policy tip.

Answer

Create a DLP policy to detect financial data and block external sharing; use default audit logging

Answer

Create a manual labeling policy for users to apply 'Financial' label; create a retention label for 7 years; create a DLP policy to warn on external sharing

Answer

Create a retention label 'Financial' with auto-apply based on sensitive info type; create a DLP policy to block external sharing

Question 2

A healthcare organization uses digital signatures on electronic medical records to ensure that the records have not been tampered with during transmission. Which security goal is primarily being addressed by this practice?

Accepted Answer

Integrity. Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the electronic medical record, which is then encrypted with the signer's private key. Any tampering with the record during transmission will cause the hash verification to fail, directly ensuring data integrity. This practice does not primarily address confidentiality (which requires encryption) or availability (which focuses on uptime).

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 3

A company uses Microsoft Entra ID. The security team needs to ensure that when users sign in to a critical financial application from an untrusted network, they must first complete multi-factor authentication (MFA). Additionally, the team wants to block the sign-in if the device is not marked as compliant by Microsoft Intune. Which conditional access grant control should they configure to meet both requirements?

Accepted Answer

Require multi-factor authentication AND Require device to be marked as compliant. Conditional Access grant controls allow you to require multiple conditions to be met simultaneously. By selecting 'Require multi-factor authentication' AND 'Require device to be marked as compliant', the policy ensures that both MFA and device compliance are enforced for the sign-in, meeting the security team's requirements.

Answer

Require multi-factor authentication only

Answer

Require one of the selected controls

Answer

Require device to be marked as compliant only

Question 4

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive credit card numbers via email. The DLP policy must trigger automatically when a user attempts to send an email containing a credit card number. Which DLP configuration should you use?

Accepted Answer

Create a DLP policy with a condition that matches the Credit Card Number sensitive info type and an action to block the email. Microsoft Purview DLP policies can be configured to detect sensitive information types, such as the Credit Card Number (defined by regex and checksum validation per PCI DSS), and automatically apply an action to block the email from being sent. This meets the requirement for automatic, policy-driven prevention of sharing credit card numbers via email.

Answer

Configure Double Key Encryption for the Exchange Online mailbox

Answer

Configure a Safe Links policy in Microsoft Defender for Office 365

Answer

Use Microsoft Purview Customer Key for encryption

Question 5

A company is moving its on-premises infrastructure to Azure. The CISO wants to understand the division of security responsibilities between the cloud provider and the customer. Which of the following models defines this division?

Accepted Answer

Shared Responsibility Model. The Shared Responsibility Model defines the division of security responsibilities between the cloud provider (Microsoft) and the customer. Microsoft is responsible for the security of the cloud (physical hosts, network, datacenters), while the customer is responsible for security in the cloud (data, identities, access management, and configurations). This model is foundational for understanding compliance and security ownership in Azure.

Answer

CIA triad (Confidentiality, Integrity, Availability)

Answer

Zero Trust Model

Answer

Defense-in-Depth

Question 6

Refer to the exhibit. An administrator runs the PowerShell command against Microsoft Defender for Endpoint. The output shows an alert with Severity 'High' and Status 'New'. What should the administrator do next to investigate the alert?

Accepted Answer

Investigate the alert details in the Microsoft Defender XDR portal. The alert has a severity of 'High' and status 'New', indicating a potentially critical threat that requires immediate investigation. The correct next step is to use the Microsoft Defender XDR portal to examine the alert details, including the affected devices, user accounts, and related events, to determine the scope and impact of the threat. Changing severity or resolving the alert without investigation would risk missing a real security incident.

Answer

Change the severity to Medium to reduce false positives

Answer

Resolve the alert as a false positive

Answer

Create a Microsoft Sentinel analytics rule from the alert

Question 7

Refer to the exhibit. You are reviewing a risk detection in Microsoft Entra Identity Protection. The risk event indicates 'unfamiliarFeatures' with medium risk level for user John Doe from IP 203.0.113.5. What is the most likely cause of this risk detection?

Accepted Answer

The sign-in was from an unfamiliar location or device.. The 'unfamiliarFeatures' risk detection in Microsoft Entra Identity Protection specifically identifies sign-ins that exhibit properties unfamiliar to the user's typical behavior, such as a new device, browser, or geographic location. The detection is based on machine learning models that compare the current sign-in against the user's historical sign-in patterns, and a medium risk level indicates a moderate likelihood that the sign-in is not legitimate. This matches option D, as the risk event is triggered by a sign-in from an unfamiliar location or device, not by impossible travel, leaked credentials, or anonymous IP.

Answer

There was an impossible travel event detected.

Answer

John Doe's credentials were leaked on the dark web.

Answer

The sign-in originated from an anonymous IP address.

Question 8

Which TWO Microsoft Security Copilot capabilities can help security analysts during incident response?

Accepted Answer

Provide guided response steps. Option A is correct because Microsoft Security Copilot's guided response capability walks analysts through recommended remediation and investigation steps during incident response, using natural-language prompts and contextual threat intelligence to suggest next actions. Option B is correct because Security Copilot can generate incident summary reports, condensing alerts, evidence, and timelines into readable summaries that speed up triage and handoff. Options C, D, and E are not Security Copilot capabilities: provisioning user accounts is handled by identity tools such as Microsoft Entra ID, configuring firewall rules is done in network security services like Azure Firewall or Defender for Cloud, and automatically blocking malicious emails is performed by Exchange Online Protection or Defender for Office 365, not by Security Copilot itself.

Answer

Provision user accounts

Answer

Configure firewall rules

Answer

Automatically block malicious emails

Question 9

Which TWO of the following are capabilities of Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Cloud Workload Protection (CWP). Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and cloud workload protection platform, so option E is correct: it continuously assesses Azure, AWS, GCP, and on-premises resources against security benchmarks (e.g., Microsoft Cloud Security Benchmark) and surfaces secure score recommendations. Option D is also correct: Defender for Cloud provides Cloud Workload Protection (CWP) through plans such as Defender for Servers, Containers, Storage, SQL, App Service, and Key Vault, delivering threat detection and advanced protection for those workloads. Option A is not correct because email security is handled by Microsoft Defender for Office 365 (part of Microsoft 365 Defender), not Defender for Cloud. Option B is not correct because identity protection is provided by Microsoft Entra ID Protection and Defender for Identity, not Defender for Cloud. Option C is not correct because endpoint detection and response (EDR) is delivered by Microsoft Defender for Endpoint, which Defender for Cloud can integrate with but does not itself provide as a native capability.

Answer

Email security

Answer

Identity protection

Answer

Endpoint detection and response (EDR)

Question 10

Your organization uses Microsoft Entra ID and needs to block sign-ins from legacy authentication protocols to reduce risk. Which feature should you use?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID allow you to block sign-ins from legacy authentication protocols by targeting client apps that use protocols like POP3, IMAP, SMTP, or older Office clients that do not support modern authentication. This is the correct feature because it provides granular, policy-based control to explicitly deny authentication requests that use legacy protocols, directly addressing the requirement to reduce risk from these less secure methods.

Answer

Security defaults

Answer

Privileged Identity Management

Answer

Identity Protection

Question 11

Which TWO capabilities are part of Microsoft Entra ID? (Choose two.)

Accepted Answer

Application management. Application management (A) is a core Microsoft Entra ID capability, allowing administrators to register, configure, and assign enterprise applications and manage app roles, permissions, and provisioning. Single sign-on (B) is also a native Entra ID feature, enabling users to authenticate once and access integrated SaaS and on-premises applications via protocols such as SAML, OAuth 2.0, and OpenID Connect. Cloud security posture management (C) belongs to Microsoft Defender for Cloud, not Entra ID. Mobile device management (D) is provided by Microsoft Intune, and security information and event management (E) is delivered by Microsoft Sentinel, so neither is an Entra ID capability.

Answer

Cloud security posture management

Answer

Mobile device management (MDM)

Answer

Security information and event management (SIEM)

Question 12

You are the identity administrator for a company that uses Microsoft Entra ID. The security team wants to ensure that any user who is assigned the Privileged Role Administrator role must activate the role only after providing a justification and passing an MFA challenge. They also want to require approval from a designated approver before the role becomes active. What should you configure?

Accepted Answer

Configure Privileged Identity Management (PIM) with role settings that require multi-factor authentication on activation, require justification, and require approval.. Privileged Identity Management (PIM) is the Microsoft Entra feature that provides just-in-time role activation with activation-time controls such as MFA, justification, and approval. Unlike Conditional Access or access reviews, PIM governs the role assignment lifecycle itself, ensuring privileged roles are not permanently active and that activation is auditable and gated by the required conditions. This directly satisfies the security team's requirements.

Answer

Create an access review for the Privileged Role Administrator role and require reviewers to approve the user's continued assignment.

Answer

Set the user's per-user MFA status to Enabled and create a Conditional Access policy requiring MFA for the Privileged Role Administrator role.

Answer

Assign the user the Privileged Role Administrator role as a permanent active assignment and enable Azure AD Identity Protection risk policies.

Question 13

A company uses Microsoft Entra ID. The security team wants to allow users to sign in only from devices that are known and managed by the organization, and to block sign-ins from personal devices. They need to enforce this for all users accessing Microsoft 365 apps. What should they configure?

Accepted Answer

A Conditional Access policy that requires the device to be marked as compliant or Microsoft Entra hybrid joined.. Conditional Access is the policy engine in Microsoft Entra ID that evaluates signals such as user, device, location, and app to make access decisions. Requiring the device to be compliant or Microsoft Entra hybrid joined ensures that only devices managed by the organization are granted access. This directly satisfies the need to block personal devices while allowing corporate-managed devices.

Answer

Multi-factor authentication (MFA) registration for all users, enforced through Security Defaults.

Answer

A named location in Microsoft Entra ID that includes only the corporate network IP ranges, and a Conditional Access policy that blocks all other locations.

Answer

A Microsoft Entra ID Protection risk policy that blocks sign-ins with a high sign-in risk.

Question 14

A company uses Microsoft Entra ID. They have a critical internal web application that uses SAML 2.0 for authentication. They want to integrate this application with Microsoft Entra ID to enable single sign-on (SSO) and automate user provisioning. They also want to assign access based on group membership. Which Microsoft Entra ID feature should they use?

Accepted Answer

Microsoft Entra Enterprise Applications with SAML-based single sign-on and provisioning. Microsoft Entra Enterprise Applications is the correct feature for integrating SAML 2.0 applications. It provides a gallery of pre-integrated apps and supports custom SAML apps. You can configure SAML-based SSO, automate user provisioning via SCIM, and assign access through groups. This satisfies all the stated requirements: SSO, provisioning, and group-based assignment.

Answer

Microsoft Entra ID B2B collaboration

Answer

Microsoft Entra ID Application Proxy

Answer

Microsoft Entra ID Conditional Access

Question 15

You are a security engineer for a company that uses Microsoft Defender for Cloud. The company has Azure subscriptions and on-premises servers. The security team wants to ensure that all supported machines are automatically provisioned with the Log Analytics agent to collect security-related data. You need to configure the auto-provisioning setting in Defender for Cloud. Which setting should you enable?

Accepted Answer

Auto-provisioning of the Log Analytics agent for all supported machines. Defender for Cloud's auto-provisioning setting for the Log Analytics agent across all supported machines ensures that both Azure VMs and on-premises servers connected through Azure Arc automatically receive the agent. This is the correct configuration to collect security data from all machines without manual intervention.

Answer

Log Analytics agent for Azure VMs

Answer

Auto-provisioning of the Microsoft Dependency Agent

Answer

Log Analytics agent for Azure Arc-connected machines

Question 16

A security administrator for a company using Microsoft 365 needs to protect against phishing and malware delivered through email attachments and links. They want a cloud-based service that provides this protection automatically without on-premises infrastructure. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Defender for Office 365 is the correct solution because it is specifically designed to protect Microsoft 365 email and collaboration workloads from phishing, malware, and malicious links. It provides Safe Attachments and Safe Links that automatically inspect and block threats, fulfilling the requirement for a cloud-based, infrastructure-free email security service.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 17

A company uses Microsoft Entra ID. The IT team wants to provide external partners with access to internal applications. The partners will use their own email addresses to sign in, and the company wants to minimize administrative overhead by not creating guest accounts manually. The company also wants to allow partners to use their existing social identities, such as Google or Facebook, to access resources. Which TWO Microsoft Entra features should the company implement? (Choose two.)

Accepted Answer

Configure Google and Facebook as identity providers in Microsoft Entra ID. B2B collaboration with self-service sign-up lets external partners sign up using their own email addresses, reducing administrative overhead. Configuring Google and Facebook as identity providers in Microsoft Entra ID enables partners to use their existing social identities. Together, these features meet the requirements for partner access without manual guest account creation and with social identity support.

Answer

External Identities cross-tenant access settings

Answer

Microsoft Entra Connect Sync

Answer

B2C tenant

Question 18

A company uses Microsoft Defender for Cloud to protect its Azure resources. The security team wants to receive a prioritized list of the most significant security risks across their environment, including misconfigurations and vulnerabilities. They need to see which issues, if remediated, would improve their secure score the most. Which Defender for Cloud feature provides this?

Accepted Answer

Secure score. Microsoft Defender for Cloud's secure score evaluates your security posture and provides a prioritized list of recommendations. By remediating the highest-impact recommendations, you can improve your secure score and reduce risk. The other features serve different purposes: compliance dashboard for regulatory adherence, workflow automation for response, and security alerts for threat detection.

Answer

Workflow automation

Answer

Security alerts

Answer

Regulatory compliance dashboard

Question 19

A new security administrator is learning about core security concepts. They ask you to explain the difference between authentication and authorization. Which statement best describes authorization?

Accepted Answer

It is the process of determining what resources an authenticated user is permitted to access.. Authorization is the process of determining what an authenticated user is allowed to do. After authentication verifies identity, authorization checks permissions and policies to grant or deny access to resources. The other options describe authentication, encryption, and auditing, which are distinct security concepts. Understanding this distinction is fundamental in Microsoft identity and access management.

Answer

It is the process of verifying a user's identity by checking their credentials.

Answer

It is the process of auditing and logging user activity for compliance purposes.

Answer

It is the process of encrypting data both at rest and in transit.

Question 20

A compliance officer at Contoso needs to review all user and admin activities across Exchange Online, SharePoint Online, and Microsoft Entra ID for the past 90 days to investigate a potential data leak. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit is the correct solution because it aggregates and retains user and administrator activity logs from Microsoft 365 services, including Exchange Online, SharePoint Online, and Entra ID. Compliance officers can search these logs to trace actions such as file accesses, permission changes, and sign-ins. The other solutions address different needs: DLP prevents sharing, Information Barriers restrict communication, and eDiscovery collects content for legal matters.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview Data Loss Prevention