SC-900 Describe the concepts of security, compliance, and identity Practice Test 11 — 15 Questions

Question 1

Your organization needs to control which users can access Microsoft Purview compliance portal. Which method should you use to grant access?

Accepted Answer

Assign users to the Compliance Administrator role group in Microsoft Purview. Option A is correct because you assign the appropriate role group in Microsoft Purview compliance portal. Option B is incorrect because licenses are needed but do not alone grant access. Option C is incorrect because Azure RBAC manages Azure resources, not Purview. Option D is incorrect because Intune manages devices, not access to Purview.

Answer

Add users to an Azure RBAC role

Answer

Configure Intune policy to allow access

Answer

Assign Microsoft 365 E5 licenses to users

Question 2

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to prevent users from sharing credit card numbers via email. Which type of sensitive information type should you use in the DLP rule?

Accepted Answer

Built-in sensitive information type. Option B is correct because a built-in sensitive information type for credit card numbers is available. Option A is incorrect because an exact data match (EDM) is for custom databases. Option C is incorrect because a custom keyword list would be inefficient. Option D is incorrect because a trainable classifier is for custom classification.

Answer

Custom keyword list

Answer

Trainable classifier

Answer

Exact data match (EDM) based classification

Question 3

Your organization uses Microsoft Defender for Cloud Apps. You need to discover shadow IT usage. Which feature should you enable?

Accepted Answer

Cloud Discovery. Option C is correct because Cloud Discovery analyzes traffic logs to identify shadow IT. Option A is incorrect because Conditional Access App Control is for enforcing policies on sanctioned apps. Option B is incorrect because the app catalog lists known cloud apps. Option D is incorrect because file policies are for data protection.

Answer

File policies

Answer

Conditional Access App Control

Answer

App catalog

Question 4

Your organization wants to use Microsoft Entra ID to provide single sign-on (SSO) for a third-party SaaS application. What must you configure in Microsoft Entra ID?

Accepted Answer

Enterprise application registration. Option A is correct because you need to add the SaaS app from the gallery and configure SSO. Option B is incorrect because Conditional Access is for access controls. Option C is incorrect because Identity Protection is for risk detection. Option D is incorrect because self-service password reset is a different feature.

Answer

Identity Protection policy

Answer

Conditional Access policy

Answer

Self-service password reset

Question 5

Which Microsoft Purview solution should you use to automatically retain or delete content based on regulations?

Accepted Answer

Records Management. Option B is correct because retention policies in Microsoft Purview manage data retention and deletion. Option A is incorrect because DLP prevents data leaks. Option C is incorrect because eDiscovery is for legal discovery. Option D is incorrect because communication compliance monitors communications.

Answer

Communication Compliance

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Question 6

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user executes a specific command on Azure VMs. Which data source should you connect to capture the command execution logs?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Option C is correct because Azure Activity logs capture resource management operations, but command execution on VMs is captured by Windows Event Logs or Syslog. However, the best answer here is Windows Security Events via the Azure Monitor agent, which is option C. Option A is incorrect because Azure Activity log does not capture guest OS commands. Option B is incorrect because Office Activity logs are for Microsoft 365. Option D is incorrect because Azure AD audit logs are for identity events.

Answer

Office Activity log

Answer

Azure AD audit logs

Answer

Azure Activity log

Question 7

Which TWO of the following are principles of the Zero Trust security model? (Select two.)

Accepted Answer

Verify explicitly. Options B and D are correct. Zero Trust principles include 'Verify explicitly' and 'Use least privilege access' (or 'Assume breach' and 'Verify explicitly'). Actually the official principles are: Verify explicitly, Use least privilege, Assume breach. So the correct two are B and D.

Answer

Perimeter-based security

Answer

Implicit trust

Answer

Trust but verify

Question 8

Which THREE of the following are capabilities of Microsoft Purview Information Protection? (Select three.)

Accepted Answer

Rights management. Options A, B, and D are correct. Microsoft Purview Information Protection includes sensitivity labels (A), data classification (B), and rights management (D). Option C is incorrect because DLP is a separate solution. Option E is incorrect because eDiscovery is a different solution.

Answer

eDiscovery

Answer

Data loss prevention policies

Question 9

Which TWO of the following are types of identity in Microsoft Entra ID? (Select two.)

Accepted Answer

Synchronized identity. Options A and D are correct. Microsoft Entra ID supports cloud-only identities (A) and synchronized identities from on-premises (D). Option B is incorrect because 'Guest identity' is a type of external identity, but it is not a primary category. Option C is incorrect because 'Hybrid identity' is a scenario, not a type. Option E is incorrect because 'Managed identity' is a specific Azure resource identity.

Answer

Guest identity

Answer

Managed identity

Answer

Hybrid identity

Question 10

Refer to the exhibit. You have a Conditional Access policy defined in Microsoft Entra ID. What is the effect of this policy?

Accepted Answer

Requires MFA for all external users accessing any cloud app. Option D is correct because the policy includes all external users and all cloud apps, requiring MFA. Option A is incorrect because it does not exclude any apps. Option B is incorrect because it includes all external users, not just guest users. Option C is incorrect because it does not exclude external users with specific roles.

Answer

Requires MFA for guest users only

Answer

Requires MFA for all users accessing all cloud apps

Answer

Requires MFA for external users except those with global admin role

Question 11

Refer to the exhibit. You are configuring a sensitivity label in Microsoft Purview. The label is set to automatically apply when credit card numbers are detected. However, users report that the label is not being applied to documents containing credit card numbers. What is the most likely cause?

Accepted Answer

The label is not published to a label policy. Option B is correct because the auto-labeling rule requires a condition, but the label may not be published to users. However, the exhibit shows no policy assignment. The most likely cause is that the label is not published to a label policy (option B). Option A is incorrect because encryption is configured. Option C is incorrect because the condition is valid. Option D is incorrect because user permissions are defined.

Answer

The encryption is misconfigured

Answer

The auto-labeling condition is incorrect

Answer

The user permissions are missing

Question 12

Refer to the exhibit. You have a Data Loss Prevention (DLP) policy in Microsoft Purview. What will happen when a user tries to share a document containing a credit card number via email?

Accepted Answer

The email is blocked and the user receives a notification. Option B is correct because the rule blocks access and notifies the user. Option A is incorrect because the user is notified. Option C is incorrect because the document is blocked, not allowed with warning. Option D is incorrect because the rule applies to all users.

Answer

The email is blocked only if the recipient is external

Answer

The email is sent with a warning to the recipient

Answer

The email is sent but the user is not notified

Question 13

A company wants to ensure that only authorized users can access sensitive financial data stored in Microsoft SharePoint Online. Which identity feature should they use to require a second form of verification?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) is the correct answer because it requires a second form of verification, such as a phone call or app notification, in addition to a password. Conditional Access is a policy engine that can enforce MFA but is not itself a verification method. Self-service password reset and Microsoft Authenticator are features that support MFA but are not the overarching concept.

Answer

Microsoft Authenticator

Answer

Self-service password reset

Answer

Conditional Access

Question 14

Your organization is implementing Microsoft Purview to manage data compliance. They need to automatically detect and protect credit card numbers in emails and documents. Which Microsoft Purview feature should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) policies in Microsoft Purview can automatically detect sensitive information like credit card numbers and apply protective actions, such as blocking or encrypting the content. Information Protection refers to sensitivity labels and encryption, but DLP is the feature that uses policies to detect and protect data in transit and at rest. Data Lifecycle Management handles retention and deletion. Insider Risk Management focuses on user behavior.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

Information Protection

Question 15

A multinational corporation uses Microsoft Entra ID for identity management. They want to allow their external partners to use their own corporate credentials to access the company's resources, rather than creating guest accounts. Which Entra ID feature should they use?

Accepted Answer

Entra ID External ID. Entra ID External ID (formerly Azure AD B2B) enables external partners to use their own identity providers, including corporate credentials, to access your resources without needing separate guest accounts. This is achieved through federation. Entra ID B2C is for customer-facing applications. Direct federation is a method within External ID. Entra ID Verified ID is for verifiable credentials.

Answer

Entra ID B2C

Answer

Entra ID Direct Federation

Answer

Entra ID Verified ID