SC-900 Mock Exam 81 — 25 Questions

Question 1

You are a security administrator for Contoso Ltd. The company uses Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Entra ID. Recently, several users reported receiving phishing emails that bypassed the existing anti-phishing policies. The security team suspects that attackers are using sophisticated techniques to evade detection. You need to enhance the email security posture by implementing a solution that uses AI and machine learning to detect advanced phishing attempts, including those using social engineering and impersonation. Which Microsoft solution should you use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes advanced anti-phishing capabilities with AI and machine learning, such as impersonation protection and spoof intelligence. Microsoft Sentinel is a SIEM/SOAR, not an email security solution. Defender for Cloud Apps is a CASB. Defender for Identity identifies threats via on-premises AD signals. Microsoft Purview focuses on compliance and data governance.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 2

Your company, Fabrikam, uses Microsoft 365 and has Microsoft Purview Information Protection deployed. You need to protect sensitive documents labeled as 'Confidential' so that they cannot be printed or copied when opened in Microsoft Word. You have created a sensitivity label with the appropriate encryption settings. However, users report that they can still print and copy content from these documents. You verify that the label is published and assigned to the correct users. What should you configure to enforce the protection?

Accepted Answer

Configure the sensitivity label to apply an Azure Rights Management template that restricts printing and copying. Option B is correct because rights management (RMS) templates define user rights like printing and copying. The label must be configured with an RMS template that denies these permissions. Option A is wrong because DLP policies detect and block actions but do not enforce rights within documents. Option C is wrong because auto-labeling applies labels but does not enforce rights. Option D is wrong because conditional access policies control access, not usage rights.

Answer

Implement conditional access policies to block access from unmanaged devices

Answer

Configure auto-labeling policies to apply the label automatically

Answer

Create a data loss prevention policy that blocks printing and copying

Question 3

Your organization, Fabrikam Inc., uses Microsoft 365 E5 licenses. The security team is deploying Microsoft Purview to protect sensitive data. They need to ensure that when a user attempts to share a document containing credit card numbers with an external partner, the action is blocked and the user receives a policy tip. Additionally, the incident should be logged for investigation. You have already created a sensitivity label for credit card data and auto-labeled documents. Which Microsoft Purview feature should you configure to meet these requirements?

Accepted Answer

Create a Data Loss Prevention (DLP) policy that applies to documents containing credit card numbers, with an action to block sharing and notify users via policy tip.. Data Loss Prevention (DLP) policies in Microsoft Purview can detect sensitive information (e.g., credit card numbers) in documents and emails, block sharing, display policy tips, and generate incident reports. Sensitivity labels alone do not enforce restrictions on sharing. Records management handles retention. Insider risk management detects risky user activities. Audit logs record events but do not block actions.

Answer

Enable Microsoft Purview Insider Risk Management to detect the sharing activity.

Answer

Implement Microsoft Purview Records Management with a retention label that prevents sharing.

Answer

Configure a sensitivity label policy that blocks external sharing when the label is applied.

Question 4

Your company is adopting Microsoft Copilot for Microsoft 365 to improve productivity. The security team is concerned about data leakage, as Copilot can access emails, documents, and other content. You need to ensure that sensitive data, such as credit card numbers and social security numbers, is not inadvertently exposed by Copilot. The organization uses Microsoft Purview sensitivity labels and DLP. You need to configure a solution that automatically detects and prevents Copilot from accessing or generating content containing these sensitive data types. What should you do?

Accepted Answer

Create a DLP policy in Microsoft Purview that detects sensitive data types and blocks Copilot actions. Option C is correct because Microsoft Purview Data Loss Prevention policies can be configured to monitor Copilot interactions and block or warn when sensitive data is detected. Option A is wrong because sensitivity labels help but do not prevent Copilot from accessing data; DLP is needed. Option B is wrong because disabling Copilot is not a targeted solution. Option D is wrong because Microsoft Defender for Cloud Apps is for cloud apps, not specifically for Copilot in Microsoft 365.

Answer

Configure Microsoft Defender for Cloud Apps to control Copilot

Answer

Disable Copilot for users who handle sensitive data

Answer

Apply sensitivity labels to all documents containing sensitive data

Question 5

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Microsoft 365 resources. You have configured a Conditional Access policy in Microsoft Entra ID that requires devices to be marked as compliant. However, some users report that they can still access email on their non-compliant Android devices. You need to troubleshoot and resolve the issue. What should you do?

Accepted Answer

Check the Conditional Access policy is enabled and includes 'Office 365 Exchange Online' as a cloud app, and that the users have the appropriate licenses for Intune.. Option D is correct because the Conditional Access policy must be scoped to include all cloud apps, and the user must have the Intune license assigned. Option A is wrong because the device must be enrolled in Intune for compliance to be evaluated. Option B is wrong because the user must be in scope. Option C is wrong because the policy should grant access only if compliant, not block non-compliant.

Answer

Change the Conditional Access policy to block access for non-compliant devices instead of requiring compliance.

Answer

Ensure that the Android devices are enrolled in Microsoft Intune and have a compliance policy assigned.

Answer

Verify that the Conditional Access policy includes the users who are accessing email.

Question 6

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. You have discovered a new cloud app that employees are using to store corporate data. The app is not sanctioned. You need to sanction the app but also ensure that users cannot upload sensitive data to it. You have configured a session policy to monitor the app. What additional step should you take?

Accepted Answer

Create a file policy in Microsoft Defender for Cloud Apps that detects sensitive data and blocks uploads.. Option C is correct because you need to create a file policy in Defender for Cloud Apps to block uploads of sensitive data. Option A is wrong because blocking the app is too restrictive. Option B is wrong because the session policy only monitors, not blocks. Option D is wrong because blocking all uploads is too broad.

Answer

Block the app entirely by adding it to the blocked list.

Answer

Configure a Conditional Access policy to require device compliance for the app.

Answer

Use the session policy to block all uploads to the app.

Question 7

Your organization uses Microsoft Purview Information Protection to classify and protect documents. You have created a sensitivity label that applies encryption to documents marked as 'Confidential'. Users are able to apply the label manually. However, you need to ensure that all documents containing personally identifiable information (PII) are automatically labeled as 'Confidential' when they are saved to SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that scans for PII sensitive info types and applies the 'Confidential' label.. Option D is correct because auto-labeling policies in Microsoft Purview can scan documents for sensitive info types and apply labels automatically. Option A is wrong because manual labeling doesn't meet the automatic requirement. Option B is wrong because DLP policies block but do not apply labels. Option C is wrong because default labeling applies to new documents but does not scan existing content.

Answer

Configure a default label for SharePoint libraries so that all documents are labeled 'Confidential'.

Answer

Create a Data Loss Prevention (DLP) policy that blocks sharing of PII.

Answer

Train users to apply the 'Confidential' label manually when they create documents with PII.

Question 8

Your company uses Microsoft Defender for Identity to monitor on-premises Active Directory. You receive an alert about a potential lateral movement attack involving a service account. The alert indicates that the account was used to log in to multiple servers from a non-domain-joined machine. You need to investigate the alert and determine if the account is compromised. What should you do first?

Accepted Answer

Review the account’s activity timeline in Microsoft Defender for Identity to see all logins and accessed resources.. Option B is correct because checking the account’s recent activity in Microsoft Defender for Identity will show the timeline of events. Option A is wrong because resetting the password may lock out a legitimate user. Option C is wrong because checking group membership is not immediate. Option D is wrong because the alert is about lateral movement, not a user report.

Answer

Check if the account is a member of any privileged groups.

Answer

Immediately reset the service account password.

Answer

Contact the user to verify if they performed the logins.

Question 9

You are the security architect for a financial services company that uses Microsoft 365 E5. The company has recently deployed Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. The security team wants to detect when users are accessing corporate data from personal devices that are not managed by Microsoft Intune. You need to implement a solution that alerts the security team when a user accesses Microsoft 365 resources from an unmanaged device. The solution should also allow the user to continue working but with limited capabilities, such as preventing download of files. Which of the following should you configure?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps that monitors and controls access based on device compliance. Option A is correct because session policies in Microsoft Defender for Cloud Apps can control actions based on device management status. Option B is incorrect because conditional access policies can block access but do not provide granular control like preventing downloads. Option C is incorrect because compliance policies define compliance but do not enforce access restrictions. Option D is incorrect because app protection policies apply to mobile apps, not browser sessions.

Answer

Create a device compliance policy in Microsoft Intune that marks unmanaged devices as non-compliant

Answer

Create an app protection policy in Microsoft Intune that prevents data transfer from managed apps

Answer

Create a conditional access policy in Microsoft Entra ID that blocks access from unmanaged devices

Question 10

You are the security administrator for a small business that uses Microsoft 365 Business Premium. The company wants to enable multi-factor authentication (MFA) for all users. You need to ensure that users are prompted for MFA when they sign in from unfamiliar locations or devices. The solution should be easy to deploy without additional licensing. Which of the following should you configure?

Accepted Answer

Enable security defaults in Microsoft Entra ID. Option B is correct because security defaults are a pre-configured set of security policies that include MFA based on risk. Option A is incorrect because conditional access policies require Azure AD Premium licenses, which are not included in Business Premium. Option C is incorrect because risk-based policies require Azure AD Premium P2. Option D is incorrect because the Microsoft Authenticator app alone does not enforce MFA.

Answer

Create a conditional access policy in Microsoft Entra ID that requires MFA for all cloud apps

Answer

Deploy the Microsoft Authenticator app and instruct users to enable it

Answer

Configure identity protection to enable risk-based MFA

Question 11

Contoso Pharmaceuticals is implementing Microsoft Purview to meet regulatory compliance (HIPAA and GDPR). They need to: (1) automatically classify and protect patient health information (PHI) and personally identifiable information (PII) in Exchange Online, SharePoint Online, and OneDrive for Business; (2) detect and prevent unauthorized sharing of sensitive data; (3) retain audit logs for 7 years; and (4) allow users to manually apply classification labels to documents. The company has 5,000 users and uses Microsoft 365 E5 licenses. The security team wants to minimize manual effort and ensure consistent protection. What should the compliance administrator configure first?

Accepted Answer

Create sensitivity labels with auto-labeling policies configured to detect PHI and PII, and publish them via label policies.. Option A is correct because sensitivity labels with auto-labeling for file types containing PHI/PII provide consistent automated classification and protection across the specified workloads. Option B is wrong because DLP policies can block sharing but do not classify or protect data inherently. Option C is wrong because retention policies handle retention, not classification or protection. Option D is wrong because auditing is for logging, not classification.

Answer

Configure Data Loss Prevention (DLP) policies to block sharing of content containing PHI and PII.

Answer

Set up retention policies for Exchange, SharePoint, and OneDrive to retain data for 7 years.

Answer

Enable auditing for all workloads and configure alert policies for unauthorized access.

Question 12

Fabrikam Inc., a global financial services company, uses Microsoft Purview to manage compliance. They have the following requirements: (1) Prevent users from sending emails containing credit card numbers (CCN) to external recipients; (2) automatically encrypt emails containing CCN; (3) notify users when an email is blocked; (4) allow users to override the block for business justifications; (5) generate incident reports for compliance teams. The company uses Microsoft 365 E5 licenses and has Exchange Online configured. The compliance team wants to implement a solution with minimal administrative overhead. What should the administrator configure?

Accepted Answer

Create a Data Loss Prevention (DLP) policy in the Microsoft Purview compliance portal with conditions for CCN, and configure actions to block, encrypt, notify, and allow override.. Option B is correct because a DLP policy can block, encrypt, notify, and allow override, with incident reports. Option A is wrong because sensitivity labels with auto-labeling classify but do not prevent sending. Option C is wrong because information barriers prevent communication between groups, not data exfiltration. Option D is wrong because message encryption without DLP does not block or provide override.

Answer

Configure information barriers between the finance department and external recipients.

Answer

Create a sensitivity label that automatically classifies emails with CCN and configure a label policy to encrypt them.

Answer

Enable Microsoft Purview Message Encryption and create a mail flow rule in Exchange to encrypt emails with CCN.

Question 13

Your organization is using Microsoft Entra ID with P2 licenses. You need to enforce a policy that requires administrators to request approval before activating their privileged roles, and approvals must expire after 8 hours. Additionally, you need to ensure that all privileged role activations are logged for auditing. Which combination of Microsoft Entra capabilities should you use?

Accepted Answer

Configure Privileged Identity Management (PIM) for role activation with approval and expiration, and use PIM audit logs.. Privileged Identity Management (PIM) in Microsoft Entra ID provides just-in-time role activation with configurable approval workflows and expiration durations, meeting the requirement for administrators to request approval and for approvals to expire after 8 hours. PIM audit logs capture all activation events, including who approved, when, and for which role, fulfilling the auditing requirement. This combination directly addresses the policy needs without relying on unrelated capabilities like user risk policies or access reviews.

Answer

Implement Identity Protection user risk policy to block high-risk admins, and use sign-in logs.

Answer

Create a Conditional Access policy requiring multi-factor authentication for admins, and use activity logs.

Answer

Set up Azure AD Access Reviews to require monthly review of privileged roles, and enable diagnostic settings.

Question 14

Your organization uses Microsoft Entra ID and has deployed Microsoft Entra ID Governance for entitlement management. You need to allow external partners to request access to a specific application, but only if they have a valid email address from an approved domain. Once approved, their access should automatically expire after 30 days. You also need to ensure that the partner's access is reviewed quarterly by the application owner. What should you configure?

Accepted Answer

Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, set expiration to 30 days, and add a quarterly access review.. Option A is correct because it combines all required components: a connected organization restricts access to approved partner domains, the access package includes the application as a resource, approval ensures authorization, a 30-day expiration enforces automatic access removal, and a quarterly access review satisfies ongoing compliance. Microsoft Entra ID Governance entitlement management uses access packages to bundle resources, policies, and reviews for external collaboration.

Answer

Create an access package with a connected organization for the partner's domain, add the application as a resource, configure approval, and set expiration to 30 days.

Answer

Create a dynamic group based on partner email domain and assign the application to the group with a 30-day expiration policy.

Answer

Add the partner as a guest user manually and assign the application directly with an expiration date.

Question 15

Your company has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to ensure that users can use the same password on-premises and in the cloud without having to sync password hashes. Additionally, you want to prevent accounts from being locked out after a few bad password attempts in the cloud. Which Microsoft Entra feature should you implement?

Accepted Answer

Deploy password writeback and enable Microsoft Entra smart lockout.. Option B is correct because password writeback enables password changes made in the cloud to be written back to on-premises Active Directory, ensuring the same password is used without syncing password hashes. Microsoft Entra smart lockout prevents accounts from being locked out after a few bad password attempts in the cloud by intelligently recognizing and blocking malicious sign-in attempts while allowing legitimate users to continue, without locking the on-premises account.

Answer

Use password hash synchronization and set up custom lockout policies.

Answer

Implement federation with Active Directory Federation Services (AD FS).

Answer

Implement pass-through authentication and configure on-premises lockout thresholds.

Question 16

You are the identity administrator for a large enterprise using Microsoft Entra ID. The company has 50,000 users and recently acquired a smaller company with 2,000 users that uses a third-party identity provider (IdP) based on SAML 2.0. The acquisition must be fully integrated within 30 days. The CISO mandates that all users must use MFA for any access to cloud applications. The acquired company's users currently do not use MFA. You need to choose an approach that minimizes changes to the acquired company's current authentication infrastructure while meeting the MFA requirement. The solution must also allow the acquired company's users to access resources in the parent tenant using their existing credentials. What should you do?

Accepted Answer

Configure B2B collaboration with the acquired company's IdP and enable MFA trust. In the parent tenant, create a Conditional Access policy that requires MFA for guest users.. Option A is correct because B2B collaboration allows the acquired company's users to authenticate against their existing SAML 2.0 IdP using their current credentials, minimizing infrastructure changes. By enabling MFA trust, the parent tenant can rely on the MFA claims already issued by the third-party IdP if it supports MFA, but since it does not, you can enforce MFA in the parent tenant via a Conditional Access policy that requires MFA for guest users. This approach meets the CISO's mandate without requiring the acquired company to deploy MFA on their own IdP or migrate users.

Answer

Set up password hash synchronization from the acquired company's IdP to the parent tenant and enable MFA for all sync'ed users.

Answer

Create new user accounts in the parent tenant for the acquired company's users and assign them Microsoft Entra ID P2 licenses to enable MFA via Conditional Access.

Answer

Migrate all acquired company users to the parent tenant's on-premises Active Directory and sync them to Microsoft Entra ID. Enable MFA via Conditional Access.

Question 17

You are the identity architect for a global organization with 100,000 users across 50 countries. The company uses Microsoft Entra ID P2 and Microsoft Defender for Cloud Apps. Recently, the security team identified that several compromised user accounts were used to exfiltrate data from a cloud storage app. The CISO wants to implement a solution that detects anomalous behavior (e.g., impossible travel, mass download) and automatically blocks the user session when such behavior is detected. The solution must also provide the ability to investigate and remediate after the fact. Which Microsoft Entra feature should you use in conjunction with Defender for Cloud Apps to meet these requirements?

Accepted Answer

Microsoft Entra Conditional Access session controls with Defender for Cloud Apps integration. Microsoft Entra Conditional Access session controls integrate directly with Defender for Cloud Apps to enable real-time session monitoring and blocking. When anomalous behaviors like impossible travel or mass downloads are detected by Defender for Cloud Apps, the session control can automatically block the user session, while also providing full investigation and remediation capabilities through the Defender for Cloud Apps portal. This meets the CISO's requirement for both automated blocking and post-incident analysis.

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra access reviews

Question 18

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to implement a solution that ensures only compliant devices can access corporate applications. Devices must be enrolled in Intune and meet compliance policies (e.g., disk encryption enabled, antivirus running). Additionally, you require that users must authenticate with multi-factor authentication (MFA) when accessing sensitive applications from non-compliant devices, even if the user is compliant. The solution must use a single policy where possible. What should you configure?

Accepted Answer

Configure Intune compliance policies and enforce them via conditional access by requiring compliant device. For sensitive apps, add MFA requirement in the same conditional access policy.. Option C is correct because it uses a single Conditional Access policy to enforce both device compliance (via Intune) and MFA for sensitive applications, meeting the requirement for a unified policy. Conditional Access policies can combine multiple conditions (e.g., device compliance status, application sensitivity) and grant controls (e.g., require compliant device, require MFA) in one policy, allowing granular access decisions based on device state and user authentication.

Answer

Create two conditional access policies: one to require device compliance for all users, and another to require MFA for sensitive applications.

Answer

Create a conditional access policy that blocks access from non-compliant devices, and configure MFA for all users.

Answer

Use Microsoft Entra ID Protection to enforce MFA based on risk, and Intune for device compliance.

Question 19

Your company, Wingtip Toys, uses Microsoft Entra ID with a free license. You have a third-party SaaS application that supports Security Assertion Markup Language (SAML) 2.0. You need to enable single sign-on (SSO) for users to access this application. However, the app requires attributes like department and employee ID in the SAML token. You also need to ensure that only users from a specific security group can access the app. What should you do?

Accepted Answer

Add the app from the gallery as a SAML application, configure claims mapping to include department and employee ID, and assign the app to the security group.. Option D is correct because the scenario requires SAML 2.0 support, custom attribute claims (department and employee ID), and group-based access control. Adding the app from the gallery as a SAML application allows you to configure SAML-based SSO, map claims to include the required attributes, and assign the app to a specific security group to restrict access. This fully meets the requirements using Microsoft Entra ID's free license.

Answer

Register the app using OpenID Connect and assign users to the app.

Answer

Add the app from the gallery using password-based SSO and configure group assignment.

Answer

Use Microsoft Entra Application Proxy to publish the app and configure pre-authentication.

Question 20

You are a security administrator for a company that uses Microsoft 365. The company has a Microsoft Purview Data Loss Prevention (DLP) policy that blocks sharing of Social Security Numbers (SSNs) externally. Recently, a user accidentally sent an email containing SSNs to an external partner after overriding the policy by selecting a business justification. Management wants to prevent users from overriding the policy for SSNs. You need to update the DLP policy to ensure that users cannot override the block for SSNs. What should you do?

Accepted Answer

Modify the rule to set 'Allow override' to 'No' in the policy tip configuration.. Option A is correct because the 'Allow override' setting in the policy tip configuration directly controls whether users can bypass a DLP block action by providing a business justification. Setting this to 'No' prevents any override for the rule that blocks SSNs, ensuring that the block is enforced without exception. This is the specific mechanism in Microsoft Purview DLP to disable user overrides for a given rule.

Answer

Increase the rule priority to ensure it is enforced before other rules.

Answer

Remove the policy tip from the rule to prevent users from overriding.

Answer

Change the action from 'Block with override' to 'Block' and remove the policy tip.