SC-900 Describe the concepts of security, compliance, and identity Practice Test 10 — 15 Questions

Question 1

Your organization is deploying Microsoft Entra ID Governance. You need to automate the process of removing user access to a critical application when the user leaves the company. Which feature should you configure?

Accepted Answer

Entitlement Management. Option D is correct because Entitlement Management can automate access removal when a user's membership ends. Option A is wrong because Access Reviews require manual or scheduled reviews. Option B is wrong because Lifecycle Workflows automate user lifecycle but not access removal. Option C is wrong because PIM manages just-in-time access, not removal of directly assigned access.

Answer

Privileged Identity Management

Answer

Access Reviews

Answer

Lifecycle Workflows

Question 2

Your company uses Microsoft Defender for Cloud Apps. You notice that a user is downloading large volumes of data from a sanctioned cloud app that exceeds the normal pattern. Which action should you take to automatically block this activity?

Accepted Answer

Create a session policy to monitor and control downloads. Option B is correct because you can create a session policy that monitors user behavior and blocks downloads exceeding a threshold. Option A is wrong because cloud discovery identifies shadow IT, not blocking. Option C is wrong because DLP policies in Purview are for data classification, not block based on volume. Option D is wrong because blocking the app entirely is too restrictive.

Answer

Configure a cloud discovery policy

Answer

Create a Microsoft Purview DLP policy

Answer

Block the app in Defender for Cloud Apps

Question 3

Which of the following is a primary purpose of Microsoft Entra ID Identity Protection?

Accepted Answer

Detect and remediate identity risks. Option C is correct because Identity Protection detects and remediates identity-based risks. Option A is wrong because device management is Intune. Option B is wrong because privileged access is PIM. Option D is wrong because data classification is Purview.

Answer

Manage privileged roles

Answer

Classify and protect sensitive data

Answer

Manage device compliance policies

Question 4

Your organization uses Microsoft Sentinel as a SIEM. You need to create a rule that triggers an incident when a user account is created in an Azure subscription and then logs in from an unfamiliar location within 24 hours. Which type of rule should you configure?

Accepted Answer

Scheduled query rule. Option A is correct because a scheduled query rule can correlate two events based on time. Option B is wrong because anomaly detection rules use ML models. Option C is wrong because NRT rules run near real-time but not scheduled. Option D is wrong because fusion rules use advanced ML.

Answer

Anomaly detection rule

Answer

Fusion rule

Answer

Near-real-time (NRT) rule

Question 5

Your company is adopting a Zero Trust network architecture. You need to implement microsegmentation for workloads running in Azure. Which Azure service should you use?

Accepted Answer

Azure Network Security Groups (NSGs). Option C is correct because Azure Network Security Groups (NSGs) provide microsegmentation by filtering traffic between subnets and VMs. Option A is wrong because Azure Firewall is a stateful firewall but not for microsegmentation within a VNet. Option B is wrong because App Service is PaaS. Option D is wrong because Azure Front Door is a global load balancer.

Answer

Azure Firewall

Answer

Azure App Service

Answer

Azure Front Door

Question 6

Which Microsoft cloud service provides a unified data governance solution that helps you manage and protect data across your entire data estate, including multi-cloud and on-premises?

Accepted Answer

Microsoft Purview. Option D is correct because Microsoft Purview is the unified data governance service. Option A is wrong because Microsoft Defender for Cloud focuses on security posture. Option B is wrong because Microsoft Intune manages endpoints. Option C is wrong because Microsoft Sentinel is a SIEM.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 7

Which TWO of the following are components of the Microsoft Entra product family? (Choose two.)

Accepted Answer

Microsoft Entra Permissions Management. Option A and Option D are correct. Microsoft Entra ID is the identity service. Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution. Option B is wrong because Microsoft Defender for Identity is part of Microsoft Defender XDR. Option C is wrong because Microsoft Purview is a separate governance service.

Answer

Microsoft Defender for Identity

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 8

Which THREE of the following are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Detect credit card numbers in Exchange Online emails. Options A, C, and D are correct. DLP can detect sensitive data in Exchange emails, SharePoint documents, and Teams messages. Option B is wrong because DLP does not block network traffic; that is a network security function. Option E is wrong because DLP does not detect malware; that is Microsoft Defender for Endpoint.

Answer

Block network traffic from suspicious IP addresses

Answer

Detect malware in email attachments

Question 9

Which TWO of the following are identity-related security best practices recommended by Microsoft? (Choose two.)

Accepted Answer

Implement Conditional Access policies. Options A and C are correct. Using Conditional Access policies and enabling MFA are key identity security best practices. Option B is wrong because sharing passwords is never recommended. Option D is wrong because SSO reduces password use but is not a standalone best practice without MFA. Option E is wrong because disabling auditing reduces visibility.

Answer

Share passwords with team members for critical accounts

Answer

Use single sign-on (SSO) without MFA

Answer

Disable sign-in logs to reduce storage costs

Question 10

You are reviewing a Conditional Access policy configuration in Microsoft Entra ID. Based on the exhibit, what is the effect of this policy?

Accepted Answer

Blocks sign-ins that have a high sign-in risk level. Option C is correct. The policy blocks sign-ins with high sign-in risk level. Option A is wrong because user risk level is empty. Option B is wrong because it does not require MFA. Option D is wrong because it only blocks high risk, not all.

Answer

Blocks sign-ins for users with high user risk

Answer

Blocks all sign-ins for the assigned users

Answer

Requires multi-factor authentication for high-risk sign-ins

Question 11

You are a security analyst using Microsoft Sentinel. You run the Kusto query shown in the exhibit. What does this query do?

Accepted Answer

Counts security alerts containing 'MFA' per day for the last 7 days. Option B is correct. The query filters alerts with 'MFA' in the name over the last 7 days, counts them per day, and renders a timechart. Option A is wrong because it counts alerts, not distinct users. Option C is wrong because it counts alerts, not identities. Option D is wrong because it doesn't filter by severity.

Answer

Lists all identities that triggered MFA alerts

Answer

Counts distinct users with MFA alerts per day

Answer

Counts alerts by severity over the last week

Question 12

You run the PowerShell command shown in the exhibit. What is the purpose of this command?

Accepted Answer

Applies a sensitivity label to a document. Option A is correct. The command assigns a sensitivity label to a document. Option B is wrong because it does not remove a label. Option C is wrong because it does not encrypt the file; labeling may include encryption but the command itself only assigns the label. Option D is wrong because it does not export audit logs.

Answer

Encrypts a document using Azure Information Protection

Answer

Removes a sensitivity label from a document

Answer

Exports audit logs for labeled documents

Question 13

Your organization wants to enforce multi-factor authentication (MFA) for all users accessing cloud applications. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Create a Conditional Access policy. Option B is correct because Conditional Access policies allow you to require MFA based on conditions like user, location, or device. Option A is incorrect because MFA per-user is a legacy method. Option C is incorrect because PIM manages role activation, not MFA enforcement. Option D is incorrect because Identity Protection detects risks but does not directly enforce MFA.

Answer

Configure Privileged Identity Management

Answer

Use Identity Protection

Answer

Enable MFA per user

Question 14

Your company is implementing a zero-trust security model. Which principle requires verifying every access request as though it originates from an untrusted network, even if the request comes from within the corporate network?

Accepted Answer

Assume breach. Option C is correct because 'Assume breach' is the zero-trust principle that treats every access request as potentially compromised. Option A is incorrect because 'Explicit verification' is a different principle. Option B is incorrect because 'Least privilege' limits access rights. Option D is incorrect because 'Trust but verify' is not a zero-trust principle.

Answer

Least privilege

Answer

Trust but verify

Answer

Explicit verification

Question 15

Your organization uses Microsoft Purview to classify sensitive data. You need to create a custom sensitive information type that detects employee IDs matching the pattern 'EMP-XXXXX' (where X is a digit). Which rule pack element must you define?

Accepted Answer

Regular expression. Option D is correct because a regex pattern is used to define custom patterns in sensitive information types. Option A is incorrect because a keyword list is for exact keywords. Option B is incorrect because a function is for built-in functions. Option C is incorrect because a data store reference is for external data sources.

Answer

Keyword list

Answer

Data store reference

Answer

Function