SC-900 Describe the concepts of security, compliance, and identity Practice Test 11 — 15 Questions

Question 1

Sequence the steps to configure a retention policy in Microsoft Purview compliance portal.

Accepted Answer

Sign in to Compliance Portal, navigate to Retention, create a new retention policy, select locations and conditions, set retention duration.. Retention policies require signing in, navigating to retention, creating a policy, selecting locations/conditions, and setting duration.

Answer

Navigate to Retention, sign in to Compliance Portal, create a new retention policy, select locations and conditions, set retention duration.

Answer

Sign in to Compliance Portal, navigate to Retention, select locations and conditions, create a new retention policy, set retention duration.

Answer

Sign in to Compliance Portal, create a new retention policy, navigate to Retention, select locations and conditions, set retention duration.

Question 2

Match each Microsoft 365 compliance feature to its function.

Accepted Answer

eDiscovery: Search and export content from various data sources. The correct matches are: eDiscovery for searching and exporting content, Retention policies for managing retention and deletion, and Sensitivity labels for classifying and protecting data. Common confusions include mixing DLP with Sensitivity labels, and Communication Compliance with DLP.

Answer

Data Loss Prevention: Classify and protect data with encryption and visual markings

Answer

Communication Compliance: Detect and prevent accidental sharing of sensitive information

Question 3

Match each Azure security service to its purpose.

Accepted Answer

Microsoft Defender for Cloud: A unified infrastructure security management system that strengthens security posture and provides advanced threat protection.. Common confusions involve mixing up the purposes of security management (Defender for Cloud), SIEM/SOAR (Sentinel), and secret management (Key Vault).

Answer

Microsoft Defender for Cloud: A cloud-native SIEM and SOAR solution.

Answer

Azure Sentinel: A tool for securely storing and managing secrets, keys, and certificates.

Answer

Azure Key Vault: A unified infrastructure security management system that strengthens security posture.

Question 4

Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID feature should you use to verify that users and devices meet specific health requirements before granting access to corporate resources?

Accepted Answer

Conditional Access. Conditional Access is the Microsoft Entra ID policy engine that evaluates signals—including user, device compliance state, location, and risk—before granting access to resources. It can require that devices be marked compliant in Intune or hybrid-joined before allowing access, which directly implements the Zero Trust 'verify explicitly' principle. This makes it the correct feature for enforcing device health requirements at access time.

Answer

Privileged Identity Management (PIM)

Answer

Identity Governance

Answer

Identity Protection

Question 5

Your company uses Microsoft Purview Information Protection to classify sensitive data. A user reports that when they try to share a document containing a credit card number via email, the email is blocked. Which Purview feature is most likely causing this behavior?

Accepted Answer

Data Loss Prevention (DLP) policy. A Data Loss Prevention (DLP) policy in Microsoft Purview is specifically designed to detect and block sensitive data—such as credit card numbers—from being shared via email. When a user attempts to send a document containing a credit card number, the DLP policy scans the email content and attachments, matches the credit card pattern (e.g., using the predefined Sensitive Info Type for credit card numbers), and enforces an action like blocking the message. This is the most likely cause of the email being blocked.

Answer

Audit log

Answer

Sensitivity label

Answer

Retention label

Question 6

Which Microsoft security solution provides centralized investigation and response across identities, endpoints, email, and cloud apps by correlating alerts from multiple sources?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct answer because it is specifically designed to correlate alerts from identities, endpoints, email, and cloud apps into a single incident, providing centralized investigation and response. It uses the Microsoft 365 Defender portal to unify signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, enabling automated remediation across these domains.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 7

Your organization is deploying Microsoft Entra ID Governance. You need to automate the process of removing user access to a critical application when the user leaves the company. Which feature should you configure?

Accepted Answer

Entitlement Management. Entitlement Management in Microsoft Entra ID Governance allows you to create access packages that govern access to resources like critical applications. By configuring an access package with a 'Remove access when user leaves' policy, you can automatically revoke the user's assignments when their lifecycle state changes to 'leaving', ensuring access is removed without manual intervention.

Answer

Privileged Identity Management

Answer

Access Reviews

Answer

Lifecycle Workflows

Question 8

Your company uses Microsoft Defender for Cloud Apps. You notice that a user is downloading large volumes of data from a sanctioned cloud app that exceeds the normal pattern. Which action should you take to automatically block this activity?

Accepted Answer

Create a session policy to monitor and control downloads. Microsoft Defender for Cloud Apps uses Conditional Access App Control to proxy user sessions to sanctioned cloud apps, enabling real-time monitoring and control. A session policy can detect anomalous download volumes and automatically block the download action within the session. This is the only option that provides real-time blocking of a specific activity (downloads) within a sanctioned app.

Answer

Configure a cloud discovery policy

Answer

Create a Microsoft Purview DLP policy

Answer

Block the app in Defender for Cloud Apps

Question 9

Which of the following is a primary purpose of Microsoft Entra ID Identity Protection?

Accepted Answer

Detect and remediate identity risks. Microsoft Entra ID Identity Protection is designed to detect, investigate, and remediate identity-based risks. It uses signals like leaked credentials, atypical sign-in behavior, and risky users to generate risk detections and risk levels, which can be used in Conditional Access policies to block or require remediation.

Answer

Manage privileged roles

Answer

Classify and protect sensitive data

Answer

Manage device compliance policies

Question 10

Your organization uses Microsoft Sentinel as a SIEM. You need to create a rule that triggers an incident when a user account is created in an Azure subscription and then logs in from an unfamiliar location within 24 hours. Which type of rule should you configure?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that detects user account creation events (e.g., from AzureActivity) and then correlates those with sign-in logs (e.g., from SigninLogs) from unfamiliar locations within a 24-hour window. This rule type supports complex multi-table joins and time-based correlation, which is exactly what the scenario requires.

Answer

Anomaly detection rule

Answer

Fusion rule

Answer

Near-real-time (NRT) rule

Question 11

Your company is adopting a Zero Trust network architecture. You need to implement microsegmentation for workloads running in Azure. Which Azure service should you use?

Accepted Answer

Azure Network Security Groups (NSGs). Azure Network Security Groups (NSGs) are the correct service for implementing microsegmentation because they allow you to create granular, stateful filtering rules based on source/destination IP addresses, ports, and protocols at the subnet or individual virtual machine (NIC) level. This enables east-west traffic segmentation between workloads within the same virtual network, which is a core principle of Zero Trust network architecture.

Answer

Azure Firewall

Answer

Azure App Service

Answer

Azure Front Door

Question 12

Which Microsoft cloud service provides a unified data governance solution that helps you manage and protect data across your entire data estate, including multi-cloud and on-premises?

Accepted Answer

Microsoft Purview. Microsoft Purview is the correct answer because it is a unified data governance service that provides visibility into data assets across on-premises, multi-cloud, and SaaS environments. It enables data classification, sensitive data discovery, and policy-based access control to manage and protect the entire data estate, aligning with the question's requirement for a comprehensive governance solution.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 13

Which TWO of the following are components of the Microsoft Entra product family? (Choose two.)

Accepted Answer

Microsoft Entra Permissions Management. Microsoft Entra ID (option E) is the core component of the Microsoft Entra product family, formerly known as Azure Active Directory, providing cloud-based identity and access management, SSO, MFA, and Conditional Access. Microsoft Entra Permissions Management (option D) is also part of the Entra family, offering cloud infrastructure entitlement management (CIEM) to discover, remediate, and monitor permissions across multicloud environments like Azure, AWS, and GCP. By contrast, Microsoft Defender for Identity (option A) belongs to the Microsoft Defender XDR suite for threat protection, Microsoft Intune (option B) is part of the Microsoft Intune family for endpoint management, and Microsoft Purview (option C) is a separate compliance and data governance product family, so none of these three are Entra components.

Answer

Microsoft Defender for Identity

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 14

Which THREE of the following are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Detect credit card numbers in Exchange Online emails. Option A is correct because Microsoft Purview DLP includes built-in sensitive information types (SITs) such as Credit Card Number that can be applied to Exchange Online as a workload location, inspecting email content and attachments for matches. Option C is correct because DLP policies support Microsoft Teams as a location, scanning chat and channel messages for sensitive information types and taking actions like blocking or warning. Option E is correct because SharePoint Online is a supported DLP workload location, and SITs such as Passport Number (e.g., the U.S. Passport Number or international variants) can be detected in documents stored there. Option B is not a DLP capability; blocking traffic from suspicious IP addresses is a network security function handled by firewalls, Azure Firewall, or Defender for Cloud, not by Purview DLP. Option D is not a DLP capability; malware detection in email attachments is performed by Exchange Online Protection and Microsoft Defender for Office 365, not by Purview DLP, which focuses on sensitive information rather than malicious code.

Answer

Block network traffic from suspicious IP addresses

Answer

Detect malware in email attachments

Question 15

Which TWO of the following are identity-related security best practices recommended by Microsoft? (Choose two.)

Accepted Answer

Implement Conditional Access policies. Option B is correct because Microsoft recommends Conditional Access policies in Microsoft Entra ID to evaluate signals such as user, device, location, and risk, and then enforce appropriate access controls (for example, requiring MFA or compliant devices) before granting access to resources. Option E is correct because enabling multi-factor authentication (MFA) is a core Microsoft identity best practice that adds a second verification factor beyond a password, dramatically reducing the risk of credential compromise and account takeover. Options A, C, and D are not best practices: sharing passwords for critical accounts violates the principle of individual accountability and non-repudiation, using SSO without MFA still leaves accounts protected only by a single factor, and disabling sign-in logs removes the audit and monitoring data needed to detect and investigate suspicious authentication activity.

Answer

Share passwords with team members for critical accounts

Answer

Use single sign-on (SSO) without MFA

Answer

Disable sign-in logs to reduce storage costs