SC-900 Describe the concepts of security, compliance, and identity Practice Test 11 — 15 Questions

Question 1

Which TWO of the following are identity-related security best practices recommended by Microsoft? (Choose two.)

Accepted Answer

Implement Conditional Access policies. The correct answers are B and E. Implementing Conditional Access policies allows organizations to enforce access controls based on conditions, which is a best practice for identity security. Enabling multi-factor authentication (MFA) adds an extra layer of security beyond passwords. Option A is incorrect because sharing passwords violates security best practices. Option C is incorrect because SSO without MFA does not provide adequate protection. Option D is incorrect because disabling sign-in logs reduces visibility and hinders security monitoring.

Answer

Share passwords with team members for critical accounts

Answer

Use single sign-on (SSO) without MFA

Answer

Disable sign-in logs to reduce storage costs

Question 2

You are reviewing a Conditional Access policy configuration in Microsoft Entra ID. Based on the exhibit, what is the effect of this policy?

Accepted Answer

Blocks sign-ins that have a high sign-in risk level. The policy is configured to target 'All users' and 'All cloud apps' with a condition of 'Sign-in risk level: High' and an access control of 'Block access'. This means any sign-in attempt that Microsoft Entra ID detects as having a high sign-in risk (e.g., from a compromised token or anonymous IP) will be blocked. Option B correctly identifies this effect.

Answer

Blocks sign-ins for users with high user risk

Answer

Blocks all sign-ins for the assigned users

Answer

Requires multi-factor authentication for high-risk sign-ins

Question 3

You are a security analyst using Microsoft Sentinel. You run the following Kusto query:

SecurityAlert
| where TimeGenerated > ago(7d)
| where AlertName contains "MFA"
| summarize Count = count() by bin(TimeGenerated, 1d)
| render timechart

What does this query do?

Accepted Answer

Counts security alerts containing 'MFA' per day for the last 7 days. The Kusto query filters security alerts containing 'MFA' in the alert name over the last 7 days, counts the number of alerts per day, and renders a timechart. Option B is incorrect because the query counts alerts, not identities. Option C is incorrect because it counts alerts, not distinct users. Option D is incorrect because the query does not filter by severity.

Answer

Lists all identities that triggered MFA alerts

Answer

Counts distinct users with MFA alerts per day

Answer

Counts alerts by severity over the last week

Question 4

You run the PowerShell command shown in the exhibit. What is the purpose of this command?

Accepted Answer

Applies a sensitivity label to a document. The command assigns a sensitivity label to a document. Option B is wrong because the command does not encrypt the document; labeling may include encryption, but the cmdlet itself only assigns the label. Option C is wrong because it does not remove a label; the command applies a label. Option D is wrong because it does not export audit logs.

Answer

Encrypts a document using Azure Information Protection

Answer

Removes a sensitivity label from a document

Answer

Exports audit logs for labeled documents

Question 5

Your organization wants to enforce multi-factor authentication (MFA) for all users accessing cloud applications. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Create a Conditional Access policy. Conditional Access policies allow you to require MFA based on conditions like user, location, or device. Option A is incorrect because Privileged Identity Management (PIM) manages role activation and assignment, not MFA enforcement. Option C is incorrect because Identity Protection detects risks such as leaked credentials but does not directly enforce MFA. Option D is incorrect because enabling MFA per user is a legacy method that does not provide granular conditional access.

Answer

Configure Privileged Identity Management

Answer

Use Identity Protection

Answer

Enable MFA per user

Question 6

Your company is implementing a zero-trust security model. Which principle requires verifying every access request as though it originates from an untrusted network, even if the request comes from within the corporate network?

Accepted Answer

Explicit verification. 'Explicit verification' is the zero-trust principle that requires verifying every access request as though it originates from an untrusted network, regardless of the source. Option A is incorrect because 'Least privilege' limits access rights but does not inherently treat all requests as untrusted. Option B is incorrect because 'Trust but verify' is a traditional security model that trusts internal networks, contradicting zero-trust. Option D is incorrect because 'Assume breach' focuses on minimizing the impact of a breach, not on verifying every access request.

Answer

Least privilege

Answer

Trust but verify

Answer

Assume breach

Question 7

Your organization uses Microsoft Purview to classify sensitive data. You need to create a custom sensitive information type that detects employee IDs matching the pattern 'EMP-XXXXX' (where X is a digit). Which rule pack element must you define?

Accepted Answer

Regular expression. A regular expression (regex) is used to define the custom pattern for employee IDs like 'EMP-XXXXX'. Option A (keyword list) is for exact keywords, not patterns. Option D (function) is for built-in functions, not custom patterns. Option C (data store reference) is for external data sources, not pattern definition.

Answer

Keyword list

Answer

Data store reference

Answer

Function

Question 8

Your organization needs to control which users can access Microsoft Purview compliance portal. Which method should you use to grant access?

Accepted Answer

Assign users to the Compliance Administrator role group in Microsoft Purview. Access to the Microsoft Purview compliance portal is granted by assigning users to the appropriate role group within Purview itself, such as the Compliance Administrator role group. Option A is incorrect because Azure RBAC roles manage access to Azure resources, not to Purview. Option B is incorrect because Intune policies control device management and compliance, not user access to Purview. Option D is incorrect while Microsoft 365 E5 licenses are required to use Purview features, they do not by themselves grant access; explicit role assignment is necessary.

Answer

Add users to an Azure RBAC role

Answer

Configure Intune policy to allow access

Answer

Assign Microsoft 365 E5 licenses to users

Question 9

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to prevent users from sharing credit card numbers via email. Which type of sensitive information type should you use in the DLP rule?

Accepted Answer

Built-in sensitive information type. A built-in sensitive information type for credit card numbers is available in Microsoft Purview. Option A is incorrect because a custom keyword list would be inefficient and unreliable for detecting credit card numbers. Option C is incorrect because a trainable classifier is used for custom classification, not for predefined patterns like credit cards. Option D is incorrect because Exact Data Match (EDM) classification requires a custom database, not a built-in type.

Answer

Custom keyword list

Answer

Trainable classifier

Answer

Exact data match (EDM) based classification

Question 10

Your organization uses Microsoft Defender for Cloud Apps. You need to discover shadow IT usage. Which feature should you enable?

Accepted Answer

Cloud Discovery. Cloud Discovery analyzes traffic logs to identify shadow IT. Option A is incorrect because file policies are used for data protection and monitoring, not for discovering shadow IT. Option B is incorrect because Conditional Access App Control enforces policies on sanctioned apps, not for discovery. Option D is incorrect because the app catalog lists known cloud apps, not for discovering unknown usage.

Answer

File policies

Answer

Conditional Access App Control

Answer

App catalog

Question 11

Your organization wants to use Microsoft Entra ID to provide single sign-on (SSO) for a third-party SaaS application. What must you configure in Microsoft Entra ID?

Accepted Answer

Enterprise application registration. Enterprise application registration. To enable SSO for a third-party SaaS application in Microsoft Entra ID, you must register the application as an enterprise application and configure SSO settings. Option A is incorrect because Identity Protection policies are for detecting and responding to identity risks, not for SSO configuration. Option B is incorrect because Conditional Access policies enforce access controls based on conditions, but the prerequisite for SSO is the application registration. Option D is incorrect because self-service password reset is unrelated to SSO setup.

Answer

Identity Protection policy

Answer

Conditional Access policy

Answer

Self-service password reset

Question 12

Which Microsoft Purview solution should you use to automatically retain or delete content based on regulations?

Accepted Answer

Records Management. Records Management in Microsoft Purview provides policy-based retention and deletion labels that automatically enforce regulatory compliance requirements, such as GDPR or SOX. It uses retention labels and label policies to mark content for a specified duration, after which it is either retained, deleted, or reviewed via disposition review. This directly addresses the need to automatically retain or delete content based on regulations.

Answer

Communication Compliance

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Question 13

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user executes a specific command on Azure VMs. Which data source should you connect to capture the command execution logs?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Windows Security Events via Azure Monitor Agent. To capture command execution logs on Azure VMs, you need guest OS-level logs, which are provided by Windows Security Events (or Syslog) collected by the Azure Monitor Agent. Microsoft Sentinel can ingest these logs using the Windows Security Events connector. Option A (Office Activity log) is incorrect; it captures Microsoft 365 user and admin activities, not VM commands. Option C (Azure AD audit logs) is incorrect; it logs Azure Active Directory sign-ins and changes, not OS-level events. Option D (Azure Activity log) is incorrect; it records resource management operations on Azure resources, not guest OS commands executed within a VM.

Answer

Office Activity log

Answer

Azure AD audit logs

Answer

Azure Activity log

Question 14

Which TWO of the following are principles of the Zero Trust security model? (Select two.)

Accepted Answer

Verify explicitly. The correct principles of Zero Trust are 'Verify explicitly' and 'Use least privilege access' (or 'Least privilege access'). Therefore, options A and E are correct. Option B (Perimeter-based security) is a traditional security model, opposite of Zero Trust. Option C (Implicit trust) and D (Trust but verify) are not part of Zero Trust; Zero Trust assumes no implicit trust and uses 'verify explicitly' instead.

Answer

Perimeter-based security

Answer

Implicit trust

Answer

Trust but verify

Question 15

Which THREE of the following are capabilities of Microsoft Purview Information Protection? (Select three.)

Accepted Answer

Rights management. Options A, C, and D are correct. Microsoft Purview Information Protection includes rights management (A), data classification (C), and sensitivity labels (D) as core capabilities. Option B (eDiscovery) is a separate solution in Microsoft Purview, not part of Information Protection. Option E (data loss prevention policies) is also a different solution, although it works together with Information Protection.

Answer

eDiscovery

Answer

Data loss prevention policies