SC-900 Practice Test 8 — 10 Questions

Question 1

A security team uses Microsoft Defender XDR to respond to incidents. Which THREE components are part of Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR is a unified extended detection and response platform that natively integrates signals from Microsoft Defender for Office 365 (email and collaboration protection), Microsoft Defender for Endpoint (endpoint detection and response), and Microsoft Defender for Identity (on-premises identity threat detection). These three components share telemetry and automate incident correlation across domains, which is the core purpose of Defender XDR.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 2

Your organization is using Microsoft Sentinel as a SIEM. You want to automatically respond to a high-severity incident by opening a ticket in ServiceNow and notifying the security team via email. What should you create?

Accepted Answer

An automation rule. Automation rules in Microsoft Sentinel can be configured to trigger automated responses when an incident is created, such as running a playbook (a Logic App) that opens a ticket in ServiceNow and sends an email notification. Option B is wrong because workbooks are for visualization and reporting, not automation. Option C is wrong because analytics rules generate alerts/incidents based on data queries, but they do not directly perform response actions; instead, automation rules handle the response. Option D is wrong because watchlists are collections of data for correlation and enrichment, not for automated response.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 3

An organization adopts a security model that requires explicit verification of every access request, uses least privilege principles, and assumes that a breach has already occurred. Which security model does this describe?

Accepted Answer

Zero Trust. Zero Trust is the correct answer because the model explicitly requires verification of every access request, enforces least privilege, and assumes breach. This aligns with the core Zero Trust principles of 'never trust, always verify,' continuous validation, and micro-segmentation, as opposed to traditional perimeter-based models that implicitly trust internal traffic.

Answer

Perimeter-based security

Answer

Defense in depth

Answer

Shared responsibility

Question 4

As a compliance administrator for Contoso Ltd., you are responsible for implementing Microsoft Purview solutions to meet regulatory requirements. The organization operates in the healthcare sector and handles Protected Health Information (PHI). Your key objectives are: (1) Automatically detect PHI in documents stored in SharePoint Online and OneDrive for Business using built-in sensitive information types. (2) Apply a 'Highly Confidential - PHI' sensitivity label that encrypts the content and adds a custom header. (3) Ensure that the label is automatically applied when PHI is detected, with a policy that allows users to override the label with justification. (4) Audit all label application activities for compliance reporting. (5) Retain documents containing PHI for a minimum of 7 years. You have access to Microsoft Purview compliance portal. Which action should you take FIRST to achieve these objectives?

Accepted Answer

Create a sensitivity label named 'Highly Confidential - PHI' with encryption and header, and publish it to users and groups.. The first step is to create the sensitivity label with the required encryption and header settings and publish it so that it can be used in auto-labeling policies. Auto-labeling policies can then be configured to apply the label based on sensitive info types, with user override. Retention labels and policies are separate and can be configured later. Audit is enabled by default but should be verified. Therefore, option C is the correct first action.

Answer

Create an auto-labeling policy in Microsoft Purview that applies the sensitivity label to documents containing PHI.

Answer

Enable auditing in Microsoft Purview by turning on Audit logging.

Answer

Create a retention label and policy to retain documents containing PHI for 7 years.

Question 5

Your organization must ensure that financial reports are protected with encryption and cannot be forwarded. Which two Microsoft Purview features should you combine?

Accepted Answer

Sensitivity labels with encryption and Data Loss Prevention. Sensitivity labels with encryption allow you to apply persistent encryption to financial reports, ensuring they remain protected even when shared. Data Loss Prevention (DLP) policies can then block or warn users from forwarding these encrypted reports via email or other channels, providing a combined solution for encryption and forwarding prevention.

Answer

Data Lifecycle Management and Data Loss Prevention

Answer

Retention policies and Records Management

Answer

Information Barriers and Communication Compliance

Answer

eDiscovery (Premium) and Audit (Standard)

Question 6

Your organization uses Microsoft Purview to enforce retention policies. You need to retain all documents in a specific SharePoint site for 5 years after they are created, and then delete them permanently. What should you configure?

Accepted Answer

A retention policy set to retain for 5 years and then delete. A retention policy scoped to a SharePoint site can be configured to retain items for 5 years after creation and then delete them permanently. This applies automatically to all content in the site without requiring manual action or labels. Option A is incorrect because DLP policies are for preventing data loss, not retention. Option C is incorrect because a retention label is applied per item and requires explicit assignment or auto-application rules, whereas a policy applies broadly to a location. Option D is incorrect because sensitivity labels are for classification and protection, not retention.

Answer

A DLP policy with a retention rule

Answer

A retention label set to retain for 5 years and then delete

Answer

A sensitivity label with a retention setting

Question 7

Your organization is implementing Microsoft Purview to manage data compliance. They need to automatically detect and protect credit card numbers in emails and documents. Which Microsoft Purview feature should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) policies in Microsoft Purview can automatically detect sensitive information like credit card numbers and apply protective actions, such as blocking or encrypting the content. Information Protection refers to sensitivity labels and encryption, but DLP is the feature that uses policies to detect and protect data in transit and at rest. Data Lifecycle Management handles retention and deletion. Insider Risk Management focuses on user behavior.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

Information Protection

Question 8

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

Accepted Answer

Self-Service Password Reset (SSPR). Self-Service Password Reset (SSPR) allows users to reset their own passwords without administrator intervention. Option B, the Password reset admin portal, is intended for administrators to reset passwords for users, not for self-service. Option C, Identity Protection, is a feature that detects and responds to identity-based risks, not for password resets. Option D, Privileged Identity Management, manages and monitors privileged roles and access, not password recovery.

Answer

Password reset admin portal

Answer

Identity Protection

Answer

Privileged Identity Management

Question 9

Which three features are available in Microsoft Entra ID P2 but not in P1? (Choose three.)

Accepted Answer

Access reviews. Access reviews are a Microsoft Entra ID P2 feature that allows administrators to automate periodic reviews of group memberships, application access, and role assignments. This capability is not available in P1, which lacks the automated review workflows and attestation features that P2 provides for governance and compliance.

Answer

Conditional Access policies

Answer

Self-service password reset (SSPR) with writeback

Question 10

An organization uses Microsoft Purview to manage data compliance. They need to automatically detect and protect credit card numbers stored in SharePoint Online. Which Microsoft Purview solution should they implement?

Accepted Answer

Microsoft Purview Data Loss Prevention. Data Loss Prevention (DLP) policies can identify sensitive data like credit card numbers and apply protection actions such as blocking access. Information Protection (sensitivity labels) classifies data but does not automatically detect and protect specific patterns like credit card numbers without DLP integration.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management