SC-900 Mock Exam 82 — 25 Questions

Question 1

Your organization, Fabrikam Inc., is migrating from on-premises Active Directory to Microsoft Entra ID. You have a custom line-of-business (LOB) application that uses Windows Integrated Authentication (WIA) and requires Kerberos delegation. The application will be hosted on Azure VMs. You need to enable users to sign in to the LOB application using their Microsoft Entra ID credentials without exposing the application to the internet. Which approach should you use?

Accepted Answer

Use Microsoft Entra Application Proxy with Kerberos Constrained Delegation (KCD). Publish the app through Application Proxy and configure pre-authentication with Entra ID.. Option B is correct because Microsoft Entra Application Proxy with Kerberos Constrained Delegation (KCD) allows you to publish an on-premises or Azure VM-hosted application that uses Windows Integrated Authentication (WIA) without exposing it to the internet. The Application Proxy service handles pre-authentication with Microsoft Entra ID, then uses KCD to obtain a Kerberos ticket on behalf of the user, enabling seamless sign-in with Entra ID credentials while keeping the application internal.

Answer

Deploy Microsoft Entra Domain Services and join the VMs to the managed domain. Configure the app to use Windows Integrated Authentication.

Answer

Set up a site-to-site VPN and join the Azure VMs to the on-premises domain. Configure the app to use Windows Integrated Authentication.

Answer

Install Azure AD Connect and sync users to Entra ID. Configure the app to use OAuth 2.0.

Question 2

Your organization uses Microsoft Entra ID P1. You need to implement a solution that allows users to reset their own passwords without administrator intervention. The solution must also enforce a policy that requires users to verify their identity with two methods before resetting. What should you configure?

Accepted Answer

Enable self-service password reset (SSPR) and configure the number of methods required to reset to 2.. Option D is correct because self-service password reset (SSPR) in Microsoft Entra ID P1 allows users to reset their own passwords without administrator intervention. By configuring SSPR and setting the number of methods required to reset to 2, you enforce the policy that users must verify their identity with two authentication methods before resetting their password.

Answer

Configure Privileged Identity Management (PIM) to require approval for password reset.

Answer

Create an Identity Protection user risk policy to force password reset.

Answer

Configure a Conditional Access policy to require MFA for password changes.

Question 3

Your organization uses Microsoft Defender for Cloud to protect Azure subscriptions. You need to enforce that all storage accounts must have encryption at rest enabled. You have enabled Azure Policy to audit this configuration. However, you notice that some storage accounts are non-compliant. You need to automatically remediate non-compliant storage accounts. What should you do?

Accepted Answer

Add a 'deployIfNotExists' policy to automatically enable encryption on storage accounts.. Option C is correct because a 'deployIfNotExists' policy assignment in Azure Policy can automatically remediate non-compliant storage accounts by enabling encryption at rest. This policy effect triggers a remediation task that deploys the required configuration (e.g., setting the 'Encryption' property to 'Enabled' on the storage account resource) without manual intervention. The audit policy only reports non-compliance, while deployIfNotExists actively enforces the desired state.

Answer

Create a Microsoft Defender for Cloud recommendation to enable encryption.

Answer

Use the compliance dashboard to manually enable encryption on non-compliant accounts.

Answer

Change the policy effect from 'audit' to 'deny' to prevent creation of non-compliant accounts.

Question 4

Your organization has implemented Microsoft Defender for Cloud to protect Azure resources. You are responsible for security posture management. You need to ensure that all Azure VMs have the latest security updates installed. You have enabled automatic VM patching via Azure Update Manager. However, some VMs are not receiving updates because they are not registered with the Update Manager. You need to identify which VMs are missing updates and ensure they are patched. What should you do?

Accepted Answer

Use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs.. Option A is correct because Microsoft Defender for Cloud provides a recommendation 'System updates should be installed on your machines' that identifies VMs missing updates. Option B is wrong because Azure Policy can enforce compliance but does not directly identify missing updates. Option C is wrong because Azure Update Manager's compliance view shows update status, but it may not show unregistered VMs. Option D is wrong because security alerts are for threats, not missing updates.

Answer

Create an Azure Policy to enforce automatic updates on all VMs.

Answer

Review Microsoft Defender for Cloud security alerts for 'Missing system updates'.

Answer

Use Azure Update Manager's compliance view to export a list of VMs with missing updates.

Question 5

Your organization, Northwind Traders, uses Microsoft Intune to manage Windows 10 devices. You have created a compliance policy that requires devices to have BitLocker enabled. After assigning the policy, you notice that some devices are reporting as non-compliant due to BitLocker not being enabled. You have verified that the devices support BitLocker and that the policy is correctly assigned. You need to ensure that BitLocker is enabled on these devices automatically. What should you do?

Accepted Answer

Create an endpoint protection configuration profile to enable BitLocker. Option A is correct because a device configuration profile for endpoint protection can enable BitLocker automatically. Option B is wrong because the compliance policy only reports compliance, it does not remediate. Option C is wrong because Windows Update policies do not configure BitLocker. Option D is wrong because scripts are not the standard method for BitLocker enabling via Intune.

Answer

Modify the compliance policy to allow non-compliant devices

Answer

Create a Windows update ring policy

Answer

Use a PowerShell script to enable BitLocker manually

Question 6

Your organization, Contoso Ltd., uses Microsoft 365 and Microsoft Defender XDR. You are a security administrator. Recently, a user named John Doe reported that his account is sending phishing emails internally. You suspect his account is compromised. You need to contain the threat immediately while preserving forensic data. The company has the following security solutions: Microsoft Entra ID P2, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, Microsoft Sentinel, and Microsoft Purview. You need to prevent the compromised account from causing further damage. Which action should you take first?

Accepted Answer

Disable the user account in Microsoft Entra ID. Option A is correct because disabling the user account in Microsoft Entra ID is the quickest way to stop the compromised account from sending emails. Option B is wrong because resetting password does not immediately revoke active sessions; tokens may still be valid. Option C is wrong while useful, revoking sessions is not as immediate as disabling the account; also, disabling the account is a stronger containment step. Option D is wrong because creating a mail flow rule takes time and may not stop the account if it's already authenticated.

Answer

Reset the user's password and require a password change

Answer

Revoke all refresh tokens for the user in Microsoft Entra ID

Answer

Create a mail flow rule in Exchange Online to block the user's emails

Question 7

You are a compliance officer at a healthcare organization that uses Microsoft 365. The organization must comply with HIPAA regulations. You have Microsoft Purview, Microsoft Defender for Cloud Apps, and Microsoft Intune. You need to ensure that all devices accessing patient health information (PHI) are compliant with the organization's security policies, which require device encryption, a minimum OS version, and the use of a compliant mobile device management (MDM) provider. Currently, some devices are not managed by Intune. You need to enforce that only compliant devices can access PHI stored in SharePoint Online. What should you do?

Accepted Answer

Configure a conditional access policy in Microsoft Entra ID to require compliant devices. Option B is correct because conditional access policies in Microsoft Entra ID can require devices to be compliant (managed by Intune) and meet compliance policies before accessing SharePoint. Option A is wrong because DLP policies do not enforce device compliance. Option C is wrong because app protection policies apply to mobile apps but do not require device management. Option D is wrong because device compliance policies require devices to be enrolled in Intune first; conditional access is needed to enforce the requirement.

Answer

Create a device compliance policy in Microsoft Intune and assign it to all users

Answer

Deploy an app protection policy in Microsoft Intune to restrict data access

Answer

Create a DLP policy in Microsoft Purview to block access from non-compliant devices

Question 8

Your organization uses Microsoft Purview eDiscovery to manage legal holds. A legal hold has been placed on a user’s mailbox, but the user has left the company and their mailbox has been converted to a shared mailbox. You need to ensure that the legal hold remains effective. What should you do?

Accepted Answer

Verify that the legal hold is still listed in the eDiscovery case for the mailbox.. Option B is correct because converting a mailbox to a shared mailbox does not remove the hold; however, you should verify that the hold is still in place. Option A is wrong because the hold is already applied. Option C is wrong because you don't need to recreate the hold. Option D is wrong because the hold is not automatically removed.

Answer

Convert the shared mailbox back to a user mailbox to keep the hold.

Answer

Create a new legal hold for the shared mailbox.

Answer

Remove the legal hold and reapply it to the shared mailbox.

Question 9

You are a security administrator for Contoso Ltd., which uses Microsoft 365 E5. The company has 10,000 users and uses Microsoft Entra ID for identity. The security team has noticed an increase in sign-in attempts from anonymous IP addresses and from locations outside the company's home country. They want to implement a solution that automatically blocks sign-ins from anonymous IP addresses and requires MFA for sign-ins from outside the home country. They also want to ensure that if a user's risk level is high, they are forced to change their password. The solution must use Microsoft Entra ID Protection and Conditional Access. You have already configured a Conditional Access policy to require MFA for all users. Which of the following is the most efficient way to meet all requirements with minimal administrative overhead?

Accepted Answer

Configure Identity Protection sign-in risk policy to block anonymous IP addresses, user risk policy to require password change for high-risk users, and create a Conditional Access policy to require MFA for sign-ins from outside the home country.. Correct: D. Using Identity Protection's risk policies for anonymous IP and high risk, plus a Conditional Access policy for location-based MFA, is efficient. Option A: Combining all in one policy is not possible because Conditional Access cannot detect anonymous IP automatically (Identity Protection does). Option B: Only Conditional Access cannot detect anonymous IP. Option C: Missing location-based MFA requirement.

Answer

Create a single Conditional Access policy that blocks anonymous IP addresses, requires MFA based on location, and forces password change for high-risk users.

Answer

Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to block sign-ins from outside the home country.

Answer

Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to require MFA for all users.

Question 10

You are responsible for Microsoft Purview Information Protection at a law firm that handles highly confidential client documents. The firm uses Microsoft 365 E5. You need to ensure that any document containing the phrase 'Attorney-Client Privileged' is automatically labeled with a 'Highly Confidential' sensitivity label and encrypted. Additionally, if a user attempts to send such a document via email outside the organization, the action should be blocked and the user should be prompted with a policy tip. You have already created the sensitivity label with encryption settings. What should you do next?

Accepted Answer

Create an auto-labeling policy for the label, and create a DLP policy that detects the label and blocks external sharing with a policy tip.. Correct: B. Create an auto-labeling policy for the label, and a DLP policy that detects the label and blocks external sharing with policy tip. Option A: Missing DLP policy. Option C: Manual labeling is not automatic. Option D: DLP policy alone cannot auto-label.

Answer

Create a DLP policy that detects the phrase and automatically applies the label, then blocks external sharing.

Answer

Create an auto-labeling policy for the label, and create a mail flow rule in Exchange to block external emails with that label.

Answer

Create a manual labeling policy and train users to apply the label, then create a DLP policy.

Question 11

You work at a mid-sized company that uses Microsoft Defender for Business (a subscription included with Microsoft 365 Business Premium). The company has 300 devices enrolled in Microsoft Intune. Recently, a malware outbreak occurred on several devices. You need to implement a solution that automatically remediates devices that are found to be infected with malware. The solution should isolate the device from the network and run a full scan. Which action should you take?

Accepted Answer

Enable automatic investigation and remediation in Microsoft Defender for Business.. Correct: A. Defender for Business includes automated investigation and remediation capabilities. Option B: Intune compliance policies enforce compliance but do not automatically remediate malware. Option C: Conditional Access controls access, not remediation. Option D: Antivirus policies set baseline but do not automate response.

Answer

Create a Conditional Access policy to block access for devices with malware.

Answer

Create an Intune compliance policy to mark devices as non-compliant if malware is detected.

Answer

Configure Microsoft Defender Antivirus to run a weekly scan.

Question 12

You are the security administrator for a large healthcare organization that uses Microsoft 365 E5. The organization must comply with HIPAA and GDPR regulations. You have implemented Microsoft Purview Information Protection with sensitivity labels to classify and protect patient data. Recently, the compliance team identified that some documents containing Protected Health Information (PHI) are being shared externally without protection. You need to prevent users from sharing documents classified as 'Highly Confidential' with external users unless the document is encrypted and labeled. Additionally, you must ensure that any external sharing of such documents is automatically blocked. You have the following options available. Which action should you take?

Accepted Answer

Create a data loss prevention (DLP) policy in Microsoft Purview that detects the 'Highly Confidential' label and blocks sharing with external users. Option A is correct because a DLP policy can detect documents with the 'Highly Confidential' label and block external sharing. Option B is incorrect because auto-labeling applies labels but does not block sharing. Option C is incorrect because retention policies do not control sharing. Option D is incorrect because conditional access policies do not inspect document labels.

Answer

Configure auto-labeling for SharePoint to automatically apply the 'Highly Confidential' label to all documents containing PHI

Answer

Configure a conditional access policy in Microsoft Entra ID to block external access to SharePoint sites containing PHI

Answer

Create a retention policy for SharePoint that prevents deletion of documents with the 'Highly Confidential' label

Question 13

You are the compliance administrator for Contoso, a multinational corporation with headquarters in the US and subsidiaries in Europe and Asia. Contoso uses Microsoft 365 E5 and Microsoft Purview. The company handles personal data subject to GDPR and CCPA. You need to design a compliance solution that meets the following requirements:
- Automatically classify and protect documents containing personal data in SharePoint Online and OneDrive for Business.
- Ensure that data subject requests (DSRs) for access and deletion can be fulfilled within the regulatory timeframes.
- Prevent accidental sharing of sensitive data via email and Teams.
- Maintain an audit trail of all activities related to personal data for at least one year.
- Manage data retention to comply with local laws that require different retention periods for different types of data.
Which combination of Microsoft Purview solutions should you use?

Accepted Answer

Sensitivity labels with auto-labeling, DLP, eDiscovery, Data Lifecycle Management, and Audit (Premium). Option C is correct because sensitivity labels with auto-labeling classify and protect data; DLP prevents sharing; eDiscovery and Data Lifecycle Management handle DSRs and retention; Audit (Premium) provides 1-year audit retention. Option A is wrong because Communication Compliance is for monitoring, not DSRs. Option B is wrong because Information Barriers restrict communication, not retention. Option D is wrong because Insider Risk Management is for risk detection, not compliance lifecycle.

Answer

Insider Risk Management, DLP, eDiscovery, and Data Lifecycle Management

Answer

Data Lifecycle Management, Information Barriers, DLP, and Audit (Premium)

Answer

Sensitivity labels, Communication Compliance, eDiscovery, and Audit (Standard)

Question 14

A small consulting company, Northwind Traders, uses Microsoft 365 Business Premium and wants to implement basic compliance solutions. They have 50 users and need to: (1) prevent employees from sharing customer credit card information via email; (2) retain all deleted emails for 1 year; (3) allow users to classify documents as 'Confidential' manually; (4) generate reports on policy violations. The company has limited IT staff and wants a quick, out-of-the-box solution. What should they configure?

Accepted Answer

Use Microsoft Purview to create a DLP policy for credit card info, a retention policy for deleted emails, and publish a sensitivity label for 'Confidential'.. Option D is correct because Microsoft Purview provides DLP policies, retention policies, and sensitivity labels out-of-the-box. Option A is wrong because Microsoft 365 Defender focuses on security, not compliance. Option B is wrong because Microsoft Entra ID is for identity. Option C is wrong because Microsoft Intune is for device management.

Answer

Use Microsoft Intune to set data loss prevention policies and configure document classification.

Answer

Use Microsoft 365 Defender to block sharing of credit card data and configure email retention.

Answer

Use Microsoft Entra ID to create conditional access policies and enable retention.

Question 15

You work for a law firm that uses Microsoft 365 E5. The firm handles highly confidential client information and must comply with attorney-client privilege. You need to implement a compliance solution that:
- Prevents unauthorized sharing of privileged documents via email.
- Enables lawyers to easily classify documents as 'Privileged' and automatically encrypt them.
- Allows the compliance team to monitor for accidental exposure of privileged information in Teams chats.
- Ensures that privileged documents are retained for 7 years after case closure, then automatically deleted.
- Provides the ability to search for privileged documents in case of a legal hold.
What should you configure?

Accepted Answer

Sensitivity labels with encryption, DLP, Communication Compliance, Data Lifecycle Management, and eDiscovery. Option B is correct because sensitivity labels can classify and encrypt privileged documents; DLP prevents sharing; Communication Compliance monitors Teams; Data Lifecycle Management manages retention; eDiscovery handles legal hold. Option A is wrong because Information Barriers restrict communication between groups, not relevant for privilege. Option C is wrong because Audit (Standard) does not provide 7-year retention. Option D is wrong because Insider Risk Management focuses on risk, not classification.

Answer

DLP, Communication Compliance, Data Lifecycle Management, and Audit (Standard)

Answer

Insider Risk Management, DLP, Data Lifecycle Management, and eDiscovery

Answer

Sensitivity labels, Information Barriers, Data Lifecycle Management, and eDiscovery

Question 16

You are a compliance administrator for Contoso, a multinational company that uses Microsoft 365. The company has the following requirements: 
1. Automatically retain all documents containing personally identifiable information (PII) for 7 years. 
2. Prevent users from sharing PII via email with external recipients unless they provide a business justification. 
3. Monitor and alert when users access sensitive data outside of business hours. 
4. Generate a compliance score for GDPR and ISO 27001. 
You need to configure the appropriate Microsoft Purview solutions. For each requirement, match the correct solution. Which combination of solutions should you use?

Accepted Answer

Data Lifecycle Management for retention; DLP for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring. Option B is correct because: Requirement 1 is met by a retention policy in Data Lifecycle Management; Requirement 2 is met by a DLP policy with user overrides; Requirement 3 is met by Insider Risk Management (abnormal access); Requirement 4 is met by Compliance Manager. Option A is wrong because Information Protection labels are for classification, not retention. Option C is wrong because Communication Compliance is for communications, not access monitoring. Option D is wrong because eDiscovery is for legal discovery, not access monitoring.

Answer

Information Protection for retention; DLP for sharing; Data Lifecycle Management for monitoring; Compliance Manager for scoring

Answer

Data Lifecycle Management for retention; Communication Compliance for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

Answer

Information Protection for retention; eDiscovery for sharing; Insider Risk Management for monitoring; Compliance Manager for scoring

Question 17

As a compliance administrator for Contoso Ltd., you are responsible for implementing Microsoft Purview solutions to meet regulatory requirements. The organization operates in the healthcare sector and handles Protected Health Information (PHI). Your key objectives are: (1) Automatically detect PHI in documents stored in SharePoint Online and OneDrive for Business using built-in sensitive information types. (2) Apply a 'Highly Confidential - PHI' sensitivity label that encrypts the content and adds a custom header. (3) Ensure that the label is automatically applied when PHI is detected, with a policy that allows users to override the label with justification. (4) Audit all label application activities for compliance reporting. (5) Retain documents containing PHI for a minimum of 7 years. You have access to Microsoft Purview compliance portal. Which action should you take FIRST to achieve these objectives?

Accepted Answer

Create a sensitivity label named 'Highly Confidential - PHI' with encryption and header, and publish it to users and groups.. The first step is to create the sensitivity label with the required encryption and header settings and publish it so that it can be used in auto-labeling policies. Auto-labeling policies can then be configured to apply the label based on sensitive info types, with user override. Retention labels and policies are separate and can be configured later. Audit is enabled by default but should be verified. Therefore, option C is the correct first action.

Answer

Create an auto-labeling policy in Microsoft Purview that applies the sensitivity label to documents containing PHI.

Answer

Enable auditing in Microsoft Purview by turning on Audit logging.

Answer

Create a retention label and policy to retain documents containing PHI for 7 years.

Question 18

You are a compliance administrator for a multinational corporation that uses Microsoft Purview. The company must comply with the General Data Protection Regulation (GDPR). You need to implement a solution that allows data subjects to request access to their personal data stored in Exchange Online, SharePoint Online, and OneDrive for Business. The solution must provide a centralized portal for data subjects to submit requests and for privacy officers to manage the entire process, including searching for data, reviewing results, and exporting or redacting data. You also need to ensure that requests are automatically routed to the appropriate privacy officer based on the data subject's region. Microsoft Purview has been licensed for the entire organization. What should you configure?

Accepted Answer

Configure Microsoft Purview eDiscovery (Premium) cases with workflow automation and role-based access for privacy officers.. Microsoft Purview eDiscovery (Standard) allows for content searches across Exchange, SharePoint, and OneDrive, and can be used to manage GDPR data subject requests. However, the centralized portal and automated routing are features of Microsoft Purview eDiscovery (Premium), which includes case management, review sets, and advanced workflows. Therefore, the best option is to configure eDiscovery (Premium) cases with workflow automation. Option A is too basic. Option C is for data retention, not subject access requests. Option D is for classification, not access requests.

Answer

Use Microsoft Purview Information Protection to manually classify and search for personal data.

Answer

Configure Microsoft Purview eDiscovery (Standard) cases to manage each request manually.

Answer

Create retention labels and policies to retain personal data for GDPR compliance.

Question 19

Your organization, Fabrikam Inc., uses Microsoft 365 and has Microsoft Purview licensed. You need to implement a compliance solution to monitor and prevent the sharing of confidential financial data via email. Specifically, you want to: (1) Detect when users send emails containing financial account numbers (e.g., credit card numbers) to external recipients. (2) Automatically block such emails with a policy tip notifying the sender. (3) Allow the sender to override the block if they provide a business justification. (4) Create a report of all blocked emails for compliance review. Which Microsoft Purview feature should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information in emails and apply actions such as block with policy tip and allow override with justification. DLP also provides incident reports. Option A is for email encryption, not blocking. Option B is for communication monitoring, not data protection. Option C is for retention, not real-time blocking.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Message Encryption

Answer

Microsoft Purview Data Lifecycle Management

Question 20

Your organization, Contoso Ltd., is a multinational company with offices in the US, EU, and Asia. You are the compliance administrator. The legal team requires that all documents containing personally identifiable information (PII) of EU citizens be retained for 10 years after the last modification. Additionally, any document classified as 'Highly Confidential' must be encrypted and have a custom header 'CONFIDENTIAL - DO NOT FORWARD' when shared externally. You also need to ensure that only users in the EU region can access documents containing EU PII. You have Microsoft Purview with the necessary licenses. You need to design a compliance solution that meets these requirements with minimal administrative overhead. What should you do?

Accepted Answer

Create a retention label for 10-year retention based on PII content; create a sensitivity label 'Highly Confidential' with encryption and header; configure a conditional access policy in Microsoft Entra ID to restrict access to EU users for documents labeled 'Highly Confidential'. Option A combines a retention label for 10-year retention, a sensitivity label with encryption and header, and a conditional access policy to restrict access based on region. This meets all requirements. Option B uses DLP, which does not enforce access control per region. Option C uses a single label, but retention and sensitivity are separate; also conditional access is needed. Option D lacks encryption and header for external sharing.

Answer

Create a Data Loss Prevention (DLP) policy to block external sharing of PII; create a retention policy for 10 years on all content; use sensitivity labels for encryption

Answer

Use a single unified label that combines retention and sensitivity settings; then configure an auto-labeling policy to apply it; use a device compliance policy to restrict access

Answer

Create a retention policy for 10 years on all content; use sensitivity labels with encryption; then configure a DLP policy to add the header when shared externally