SC-900 Describe the concepts of security, compliance, and identity Practice Test 10 — 15 Questions

Question 1

Order the steps to respond to a data breach using Microsoft 365 Defender incident response.

Accepted Answer

Identify the breach, then Isolate affected systems, then Investigate the scope and impact, then Contain the threat, then Remediate. Incident response typically starts with identification, isolation, investigation, containment, then remediation.

Answer

Identify the breach, then Investigate the scope and impact, then Contain the threat, then Isolate affected systems, then Remediate

Answer

Contain the threat, then Identify the breach, then Investigate the scope and impact, then Isolate affected systems, then Remediate

Answer

Identify the breach, then Isolate affected systems, then Remediate, then Investigate the scope and impact, then Contain the threat

Question 2

Sequence the steps to configure a retention policy in Microsoft Purview compliance portal.

Accepted Answer

Sign in to Compliance Portal, navigate to Retention, create a new retention policy, select locations and conditions, set retention duration.. Retention policies require signing in, navigating to retention, creating a policy, selecting locations/conditions, and setting duration.

Answer

Navigate to Retention, sign in to Compliance Portal, create a new retention policy, select locations and conditions, set retention duration.

Answer

Sign in to Compliance Portal, navigate to Retention, select locations and conditions, create a new retention policy, set retention duration.

Answer

Sign in to Compliance Portal, create a new retention policy, navigate to Retention, select locations and conditions, set retention duration.

Question 3

Match each Microsoft 365 compliance feature to its function.

Accepted Answer

eDiscovery: Search and export content from various data sources. The correct matches are: eDiscovery for searching and exporting content, Retention policies for managing retention and deletion, and Sensitivity labels for classifying and protecting data. Common confusions include mixing DLP with Sensitivity labels, and Communication Compliance with DLP.

Answer

Data Loss Prevention: Classify and protect data with encryption and visual markings

Answer

Communication Compliance: Detect and prevent accidental sharing of sensitive information

Question 4

Match each Azure security service to its purpose.

Accepted Answer

Microsoft Defender for Cloud: A unified infrastructure security management system that strengthens security posture and provides advanced threat protection.. Common confusions involve mixing up the purposes of security management (Defender for Cloud), SIEM/SOAR (Sentinel), and secret management (Key Vault).

Answer

Microsoft Defender for Cloud: A cloud-native SIEM and SOAR solution.

Answer

Azure Sentinel: A tool for securely storing and managing secrets, keys, and certificates.

Answer

Azure Key Vault: A unified infrastructure security management system that strengthens security posture.

Question 5

Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID feature should you use to verify that users and devices meet specific health requirements before granting access to corporate resources?

Accepted Answer

Conditional Access. Conditional Access policies can enforce device compliance, MFA, and other health checks before granting access. Option A is wrong because Privileged Identity Management manages just-in-time admin roles, not device health. Option B is wrong because Identity Governance manages access reviews and lifecycle, not real-time health verification. Option C is wrong because Identity Protection detects risks but does not enforce device health requirements.

Answer

Privileged Identity Management (PIM)

Answer

Identity Governance

Answer

Identity Protection

Question 6

Your company uses Microsoft Purview Information Protection to classify sensitive data. A user reports that when they try to share a document containing a credit card number via email, the email is blocked. Which Purview feature is most likely causing this behavior?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is specifically designed to detect and block sensitive data—such as credit card numbers—from being shared via email. When a user attempts to send a document containing a credit card number, the DLP policy scans the email content and attachments, matches the credit card pattern (e.g., using the predefined Sensitive Info Type for credit card numbers), and enforces an action like blocking the message. This is the most likely cause of the email being blocked.

Answer

Audit log

Answer

Sensitivity label

Answer

Retention label

Question 7

Which Microsoft security solution provides centralized investigation and response across identities, endpoints, email, and cloud apps by correlating alerts from multiple sources?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct answer because it is specifically designed to correlate alerts from identities, endpoints, email, and cloud apps into a single incident, providing centralized investigation and response. It uses the Microsoft 365 Defender portal to unify signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, enabling automated remediation across these domains.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 8

Your organization is deploying Microsoft Entra ID Governance. You need to automate the process of removing user access to a critical application when the user leaves the company. Which feature should you configure?

Accepted Answer

Entitlement Management. Entitlement Management in Microsoft Entra ID Governance allows you to create access packages that govern access to resources like critical applications. By configuring an access package with a 'Remove access when user leaves' policy, you can automatically revoke the user's assignments when their lifecycle state changes to 'leaving', ensuring access is removed without manual intervention.

Answer

Privileged Identity Management

Answer

Access Reviews

Answer

Lifecycle Workflows

Question 9

Your company uses Microsoft Defender for Cloud Apps. You notice that a user is downloading large volumes of data from a sanctioned cloud app that exceeds the normal pattern. Which action should you take to automatically block this activity?

Accepted Answer

Create a session policy to monitor and control downloads. You can create a session policy in Microsoft Defender for Cloud Apps that monitors user behavior and can block or restrict downloads that exceed a predefined threshold. Option B is wrong because a cloud discovery policy is used to discover shadow IT, not to block downloads. Option C is wrong because Microsoft Purview DLP policies are for data loss prevention based on content classification, not for blocking based on volume of downloads. Option D is wrong because blocking the entire app is too restrictive; a session policy allows targeted action on specific risky activities.

Answer

Configure a cloud discovery policy

Answer

Create a Microsoft Purview DLP policy

Answer

Block the app in Defender for Cloud Apps

Question 10

Which of the following is a primary purpose of Microsoft Entra ID Identity Protection?

Accepted Answer

Detect and remediate identity risks. Microsoft Entra ID Identity Protection is designed to detect, investigate, and remediate identity-based risks such as leaked credentials, sign-ins from unfamiliar locations, and risky user behaviors. Option B is incorrect because managing privileged roles is the purpose of Privileged Identity Management (PIM), not Identity Protection. Option C is incorrect because classifying and protecting sensitive data is handled by Microsoft Purview Information Protection. Option D is incorrect because managing device compliance policies is a function of Microsoft Intune.

Answer

Manage privileged roles

Answer

Classify and protect sensitive data

Answer

Manage device compliance policies

Question 11

Your organization uses Microsoft Sentinel as a SIEM. You need to create a rule that triggers an incident when a user account is created in an Azure subscription and then logs in from an unfamiliar location within 24 hours. Which type of rule should you configure?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that detects user account creation events (e.g., from AzureActivity) and then correlates those with sign-in logs (e.g., from SigninLogs) from unfamiliar locations within a 24-hour window. This rule type supports complex multi-table joins and time-based correlation, which is exactly what the scenario requires.

Answer

Anomaly detection rule

Answer

Fusion rule

Answer

Near-real-time (NRT) rule

Question 12

Your company is adopting a Zero Trust network architecture. You need to implement microsegmentation for workloads running in Azure. Which Azure service should you use?

Accepted Answer

Azure Network Security Groups (NSGs). Azure Network Security Groups (NSGs) are the correct service for implementing microsegmentation because they allow you to create granular, stateful filtering rules based on source/destination IP addresses, ports, and protocols at the subnet or individual virtual machine (NIC) level. This enables east-west traffic segmentation between workloads within the same virtual network, which is a core principle of Zero Trust network architecture.

Answer

Azure Firewall

Answer

Azure App Service

Answer

Azure Front Door

Question 13

Which Microsoft cloud service provides a unified data governance solution that helps you manage and protect data across your entire data estate, including multi-cloud and on-premises?

Accepted Answer

Microsoft Purview. Microsoft Purview is the correct answer because it is a unified data governance service that provides visibility into data assets across on-premises, multi-cloud, and SaaS environments. It enables data classification, sensitive data discovery, and policy-based access control to manage and protect the entire data estate, aligning with the question's requirement for a comprehensive governance solution.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 14

Which TWO of the following are components of the Microsoft Entra product family? (Choose two.)

Accepted Answer

Microsoft Entra Permissions Management. Options D and E are correct. Microsoft Entra ID is the core identity service, and Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) solution within the Microsoft Entra family. Option A is incorrect because Microsoft Defender for Identity is part of Microsoft Defender XDR, not part of the Microsoft Entra product family. Option B is incorrect because Microsoft Intune is an endpoint management service. Option C is incorrect because Microsoft Purview is a data governance and compliance service.

Answer

Microsoft Defender for Identity

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 15

Which THREE of the following are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Detect credit card numbers in Exchange Online emails. Options A, C, and E are correct. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive information such as credit card numbers in Exchange Online emails (A), detect sensitive information in Microsoft Teams messages (C), and detect passport numbers in SharePoint Online documents (E). Option B is incorrect because blocking network traffic from suspicious IP addresses is a network security feature, not a DLP capability. Option D is incorrect because detecting malware in email attachments is the function of Microsoft Defender for Office 365, not DLP.

Answer

Block network traffic from suspicious IP addresses

Answer

Detect malware in email attachments