SC-900 Describe the concepts of security, compliance, and identity Practice Test 12 — 15 Questions

Question 1

Which TWO of the following are types of identity in Microsoft Entra ID? (Select two.)

Accepted Answer

Synchronized identity. Options A and B are correct. Microsoft Entra ID supports two primary types of identity: synchronized identity (A) and cloud-only identity (B). A synchronized identity is created in an on-premises directory and synchronized to Entra ID. A cloud-only identity is created and managed entirely in Entra ID. Option C, Guest identity, is a type of external identity used for B2B collaboration, but it is not a primary identity type. Option D, Managed identity, is a service principal used for Azure resources to authenticate, not a user identity type. Option E, Hybrid identity, is a term for using both on-premises and cloud identities but is not a distinct identity type.

Answer

Guest identity

Answer

Managed identity

Answer

Hybrid identity

Question 2

You have a Conditional Access policy in Microsoft Entra ID. The policy has the following settings: Assignments > Users > Include: All guest and external users; Assignments > Target resources > Cloud apps: All cloud apps; Access controls > Grant: Require multi-factor authentication. What is the effect of this policy?

Accepted Answer

Requires MFA for all external users accessing any cloud app. The policy applies to all guest and external users and targets all cloud apps, with the grant control requiring multi-factor authentication. Therefore, it requires MFA for all external users accessing any cloud app. It is not limited to guest users only, does not apply to all internal users, and does not exclude external users with the Global Administrator role.

Answer

Requires MFA for guest users only

Answer

Requires MFA for all users accessing all cloud apps

Answer

Requires MFA for external users except those with global admin role

Question 3

Refer to the exhibit. You are configuring a sensitivity label in Microsoft Purview. The label is set to automatically apply when credit card numbers are detected. However, users report that the label is not being applied to documents containing credit card numbers. What is the most likely cause?

Accepted Answer

The label is not published to a label policy. The auto-labeling rule requires a condition, but the label may not be published to users. However, the exhibit shows no policy assignment. The most likely cause is that the label is not published to a label policy (option B). Option A is incorrect because encryption is configured. Option C is incorrect because the condition is valid. Option D is incorrect because user permissions are defined.

Answer

The encryption is misconfigured

Answer

The auto-labeling condition is incorrect

Answer

The user permissions are missing

Question 4

Refer to the exhibit. You have a Data Loss Prevention (DLP) policy in Microsoft Purview. What will happen when a user tries to share a document containing a credit card number via email?

Accepted Answer

The email is blocked and the user receives a notification. The DLP policy is configured to block the email and send a notification to the user when a credit card number is detected. Option A is incorrect because the policy applies to both internal and external recipients. Option B is incorrect because the email is blocked, not sent with a warning. Option C is incorrect because the user is notified when the email is blocked.

Answer

The email is blocked only if the recipient is external

Answer

The email is sent with a warning to the recipient

Answer

The email is sent but the user is not notified

Question 5

A company wants to ensure that only authorized users can access sensitive financial data stored in Microsoft SharePoint Online. Which identity feature should they use to require a second form of verification?

Accepted Answer

Multi-factor authentication. Multi-factor authentication (MFA) is the correct answer because it requires a second form of verification, such as a phone call or app notification, in addition to a password. Conditional Access is a policy engine that can enforce MFA but is not itself a verification method. Self-service password reset and Microsoft Authenticator are features that support MFA but are not the overarching concept.

Answer

Microsoft Authenticator

Answer

Self-service password reset

Answer

Conditional Access

Question 6

Your organization is implementing Microsoft Purview to manage data compliance. They need to automatically detect and protect credit card numbers in emails and documents. Which Microsoft Purview feature should they configure?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) policies in Microsoft Purview can automatically detect sensitive information like credit card numbers and apply protective actions, such as blocking or encrypting the content. Information Protection refers to sensitivity labels and encryption, but DLP is the feature that uses policies to detect and protect data in transit and at rest. Data Lifecycle Management handles retention and deletion. Insider Risk Management focuses on user behavior.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Answer

Information Protection

Question 7

A multinational corporation uses Microsoft Entra ID for identity management. They want to allow their external partners to use their own corporate credentials to access the company's resources, rather than creating guest accounts. Which Entra ID feature should they use?

Accepted Answer

Entra ID External ID. Entra ID External ID (formerly Azure AD External Identities) is the correct feature because it enables external partners to authenticate using their own corporate credentials via federation, without requiring guest accounts. This allows seamless access to the company's resources while maintaining the partner's identity lifecycle.

Answer

Entra ID B2C

Answer

Entra ID Direct Federation

Answer

Entra ID Verified ID

Question 8

A healthcare organization must comply with HIPAA regulations regarding the protection of patient health information (PHI). Which cloud compliance concept ensures that the organization has controls in place to meet regulatory requirements?

Accepted Answer

Compliance management. Compliance management is the discipline of ensuring that an organization adheres to regulations like HIPAA by implementing controls. Security management focuses on protecting assets from threats. Identity management deals with authentication and authorization. Privacy management addresses personal data protection. The question specifically asks about meeting regulatory requirements.

Answer

Privacy management

Answer

Identity management

Answer

Security management

Question 9

Your company uses Microsoft Defender for Cloud to assess security posture. A recommendation states that virtual machines should have just-in-time (JIT) network access enabled. What is the primary security benefit of enabling JIT?

Accepted Answer

It reduces the attack surface by opening ports only when necessary. JIT network access reduces the attack surface by keeping network ports closed by default and opening them only when needed for legitimate traffic, based on user requests. It does not block all inbound traffic permanently; it allows authorized requests. It does not encrypt traffic or replace firewall rules; it complements them.

Answer

It replaces the need for network security groups

Answer

It encrypts all network traffic between the VM and clients

Answer

It permanently blocks all inbound traffic to the VM

Question 10

A Microsoft 365 organization needs to classify and protect sensitive documents based on their content, such as passport numbers. They want the classification to be applied automatically without user intervention. Which Microsoft Purview solution should they use?

Accepted Answer

Auto-labeling with sensitivity labels. Auto-labeling in Microsoft Purview Information Protection uses policy rules to automatically apply sensitivity labels to documents containing sensitive info like passport numbers. Trainable classifiers are used for more complex patterns but require training. Data Loss Prevention (DLP) can detect and protect but does not label documents by default. Unified labeling is a client-side feature requiring user action.

Answer

Unified labeling client

Answer

Data Loss Prevention (DLP) policies

Answer

Trainable classifiers

Question 11

Which TWO of the following are purposes of the 'Zero Trust' security model?

Accepted Answer

Explicitly verify every access request. Zero Trust assumes breach and verifies each request as though it originates from an open network. It explicitly verifies every access request, regardless of source. It does not assume a trusted internal network; that is the traditional perimeter model. It does not rely solely on a single perimeter firewall.

Answer

Rely on a single perimeter firewall

Answer

Trust internal traffic implicitly

Answer

Assume that the network is always safe

Question 12

Which THREE of the following are key concepts of identity management in Microsoft Entra ID?

Accepted Answer

Federation. Authentication verifies identity, authorization grants access, and federation allows using external identity providers. Single sign-on is a feature, not a core concept per se, but often listed. Least privilege is a security principle but not an identity management concept exclusive to Entra ID. Encryption is unrelated.

Answer

Encryption

Answer

Least privilege

Question 13

Which TWO of the following are features of Microsoft Purview Audit?

Accepted Answer

Records user and admin activities in the unified audit log. Microsoft Purview Audit provides detailed logging of user and admin activities, and allows searching the audit log for security investigations. It does not automatically block malicious activities (that's DLP or Defender), and it does not manage sensitivity labels (that's Information Protection). It does not provide real-time threat detection (that's Sentinel or Defender).

Answer

Manages sensitivity labels for documents

Answer

Provides real-time threat detection

Answer

Automatically blocks malicious activities

Question 14

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their social media accounts, such as Google or Facebook. Which feature should you configure?

Accepted Answer

External ID. External ID (now known as Microsoft Entra External ID) allows you to configure identity providers for social accounts like Google and Facebook. This enables users to sign in with their existing social credentials by establishing federation via OAuth 2.0 or OpenID Connect protocols, rather than requiring a separate Microsoft Entra ID account.

Answer

Privileged Identity Management

Answer

Identity Protection

Answer

Conditional Access

Question 15

A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to emails containing credit card numbers. Which policy should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview are specifically designed to automatically apply sensitivity labels based on conditions, including the detection of sensitive information types like credit card numbers. Option B is incorrect because retention policies manage the lifecycle of data (how long it's kept or deleted), not the automatic application of sensitivity labels. Option C is incorrect because sensitivity label policies are used to publish sensitivity labels, making them available for manual application by users or for use by other policies, but they do not automatically apply labels based on content detection. Option D is incorrect because DLP policies are primarily used to detect sensitive information and enforce actions to prevent its unauthorized sharing or use, rather than automatically applying sensitivity labels as their primary function.

Answer

Retention policy

Answer

Sensitivity label policy

Answer

Data loss prevention (DLP) policy