SC-900 Describe the concepts of security, compliance, and identity Practice Test 12 — 15 Questions

Question 1

A healthcare organization must comply with HIPAA regulations regarding the protection of patient health information (PHI). Which cloud compliance concept ensures that the organization has controls in place to meet regulatory requirements?

Accepted Answer

Compliance management. Compliance management is the discipline of ensuring that an organization adheres to regulations like HIPAA by implementing controls. Security management focuses on protecting assets from threats. Identity management deals with authentication and authorization. Privacy management addresses personal data protection. The question specifically asks about meeting regulatory requirements.

Answer

Privacy management

Answer

Identity management

Answer

Security management

Question 2

Your company uses Microsoft Defender for Cloud to assess security posture. A recommendation states that virtual machines should have just-in-time (JIT) network access enabled. What is the primary security benefit of enabling JIT?

Accepted Answer

It reduces the attack surface by opening ports only when necessary. JIT network access reduces the attack surface by keeping network ports closed by default and opening them only when needed for legitimate traffic, based on user requests. It does not block all inbound traffic permanently; it allows authorized requests. It does not encrypt traffic or replace firewall rules; it complements them.

Answer

It replaces the need for network security groups

Answer

It encrypts all network traffic between the VM and clients

Answer

It permanently blocks all inbound traffic to the VM

Question 3

A Microsoft 365 organization needs to classify and protect sensitive documents based on their content, such as passport numbers. They want the classification to be applied automatically without user intervention. Which Microsoft Purview solution should they use?

Accepted Answer

Auto-labeling with sensitivity labels. Auto-labeling in Microsoft Purview Information Protection uses policy rules to automatically apply sensitivity labels to documents containing sensitive info like passport numbers. Trainable classifiers are used for more complex patterns but require training. Data Loss Prevention (DLP) can detect and protect but does not label documents by default. Unified labeling is a client-side feature requiring user action.

Answer

Unified labeling client

Answer

Data Loss Prevention (DLP) policies

Answer

Trainable classifiers

Question 4

Which TWO of the following are purposes of the 'Zero Trust' security model?

Accepted Answer

Explicitly verify every access request. Zero Trust assumes breach and verifies each request as though it originates from an open network. It explicitly verifies every access request, regardless of source. It does not assume a trusted internal network; that is the traditional perimeter model. It does not rely solely on a single perimeter firewall.

Answer

Rely on a single perimeter firewall

Answer

Trust internal traffic implicitly

Answer

Assume that the network is always safe

Question 5

Which THREE of the following are key concepts of identity management in Microsoft Entra ID?

Accepted Answer

Federation. Authentication verifies identity, authorization grants access, and federation allows using external identity providers. Single sign-on is a feature, not a core concept per se, but often listed. Least privilege is a security principle but not an identity management concept exclusive to Entra ID. Encryption is unrelated.

Answer

Encryption

Answer

Least privilege

Question 6

Which TWO of the following are features of Microsoft Purview Audit?

Accepted Answer

Records user and admin activities in the unified audit log. Microsoft Purview Audit provides detailed logging of user and admin activities, and allows searching the audit log for security investigations. It does not automatically block malicious activities (that's DLP or Defender), and it does not manage sensitivity labels (that's Information Protection). It does not provide real-time threat detection (that's Sentinel or Defender).

Answer

Manages sensitivity labels for documents

Answer

Provides real-time threat detection

Answer

Automatically blocks malicious activities

Question 7

You are the security architect for a multinational organization that uses Microsoft 365 E5, Microsoft Entra ID P2, and Microsoft Purview. The company has 10,000 employees across five regions. The legal department requires that all documents containing personally identifiable information (PII) of European Union citizens be automatically labeled with a 'Highly Confidential' sensitivity label and encrypted. Additionally, any sharing of such documents with external users must be blocked unless the sender explicitly justifies the business need. The solution must minimize manual user intervention. You need to design a Microsoft Purview configuration. What should you do?

Accepted Answer

Create an auto-labeling policy that detects EU PII sensitive info types, applies the 'Highly Confidential' label with encryption, and configure a conditional access rule to block external sharing without justification. Option C is correct because auto-labeling policies can automatically apply sensitivity labels based on sensitive info types (like EU PII) and can be configured to block external sharing unless a justification is provided. Option A is wrong because trainable classifiers require training and are not the standard for automatic PII detection. Option B is wrong because manual labeling requires user intervention. Option D is wrong because DLP policies do not apply labels; they only enforce actions.

Answer

Use a unified labeling client policy to prompt users to classify documents containing PII

Answer

Create a trainable classifier for PII and configure a manual labeling policy

Answer

Configure a DLP policy that blocks all documents containing PII from being shared externally

Question 8

Your company has a Microsoft 365 E5 subscription and uses Microsoft Teams for collaboration. The security team needs to ensure that guest users invited to Teams channels are required to pass multi-factor authentication (MFA) before accessing company resources. Currently, guest users are invited via Entra ID External ID but MFA is not enforced. You need to enforce MFA for all guest users. The solution should apply to all guest users across all applications. What should you configure?

Accepted Answer

Create a Conditional Access policy in Entra ID that targets all guest users and requires MFA. Option A is correct because a Conditional Access policy targeting all guest users and requiring MFA is the standard way to enforce MFA for guests across applications. Option B is wrong because it adds a step for all external users, which is broader than needed. Option C is wrong because it does not enforce MFA. Option D is wrong because the per-user MFA option is deprecated and less flexible.

Answer

Set the guest user access level in Teams to allow only authenticated users

Answer

Configure Entra ID External ID to require MFA for all external users

Answer

Enable MFA for each guest user account individually

Question 9

A small business uses Microsoft 365 Business Premium. The owner wants to ensure that employees can access their email and files from anywhere, but only from trusted devices that comply with company security policies (e.g., have antivirus enabled and are up-to-date). They have heard about Microsoft Intune but are not sure if it's included. You need to recommend a solution that enforces device compliance for accessing company data. What should you do?

Accepted Answer

Use Microsoft Intune to create device compliance policies and a Conditional Access policy to require compliant devices. Option C is correct because Microsoft 365 Business Premium includes Microsoft Intune, which can be used to create device compliance policies and a Conditional Access policy to require compliant devices. Option A is wrong because the basic security defaults do not enforce device compliance. Option B is wrong because requiring personal devices to be domain-joined is unrealistic for a small business. Option D is wrong because Require Managed Devices is a Conditional Access grant, but it requires Intune enrollment, which is not mentioned.

Answer

Configure Conditional Access to require managed devices

Answer

Require all employees to use company-issued devices that are domain-joined

Answer

Enable Security Defaults in Entra ID

Question 10

Your organization uses Microsoft Entra ID for identity management. You need to ensure that users can sign in using their social media accounts, such as Google or Facebook. Which feature should you configure?

Accepted Answer

External ID. Option B is correct because Microsoft Entra External ID allows you to configure identity providers for social identities like Google and Facebook. Option A is incorrect because Conditional Access is about enforcing access policies, not enabling social sign-in. Option C is incorrect because Identity Protection detects identity-based risks. Option D is incorrect because Privileged Identity Management manages role assignments.

Answer

Privileged Identity Management

Answer

Identity Protection

Answer

Conditional Access

Question 11

A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to emails containing credit card numbers. Which policy should they configure?

Accepted Answer

Auto-labeling policy. Option C is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive information types like credit card numbers. Option A is incorrect because sensitivity label policies publish labels for manual assignment. Option B is incorrect because DLP policies enforce actions but do not apply labels automatically. Option D is incorrect because retention policies manage data retention, not labeling.

Answer

Retention policy

Answer

Sensitivity label policy

Answer

Data loss prevention (DLP) policy

Question 12

Your organization uses Microsoft Defender XDR. The security team wants a central dashboard showing the overall security posture and recommended actions. Which tool should they use?

Accepted Answer

Microsoft Secure Score. Option D is correct because Microsoft Secure Score provides a dashboard with security recommendations and posture assessment. Option A is incorrect because Microsoft Entra ID is identity management. Option B is incorrect because Microsoft Sentinel is a SIEM. Option C is incorrect because Microsoft Purview is for data governance.

Answer

Microsoft Purview

Answer

Microsoft Entra ID

Answer

Microsoft Sentinel

Question 13

A company is planning to use Copilot for Microsoft 365. To ensure that Copilot responses are based only on data accessible to the user, which principle must be enforced?

Accepted Answer

User permissions and access controls are respected. Option B is correct because Copilot for Microsoft 365 uses the user's existing permissions to determine which content it can access. Option A is incorrect because Copilot does not universally index all data. Option C is incorrect because Copilot does not automatically grant access. Option D is incorrect because Copilot does not bypass permissions.

Answer

Copilot automatically grants access to all data

Answer

All organizational data is indexed and available to Copilot

Answer

Data must be stored in a specific location

Question 14

Which TWO components are part of the 'Zero Trust' security model? (Choose two.)

Accepted Answer

Least privilege. Correct answers are B and C: Verify explicitly assumes every access request is a potential threat, and Least privilege ensures users have only the minimum access needed. Option A is incorrect because perimeter security is a traditional model. Option D is incorrect because password complexity is a single factor. Option E is incorrect because VPNs are network access methods, not Zero Trust principles.

Answer

VPN access

Answer

Password complexity

Answer

Perimeter-based security

Question 15

Which TWO of the following are benefits of using Microsoft Entra ID for identity management? (Choose two.)

Accepted Answer

Conditional Access policies. Correct answers are B and D: Single sign-on (SSO) allows users to access multiple apps with one login, and Conditional Access provides policy-based access controls. Option A is incorrect because on-premises only is not a benefit. Option C is incorrect because storing passwords in plaintext is not a benefit. Option E is incorrect because local authentication is not a benefit of cloud identity.

Answer

Storing passwords in plaintext

Answer

Local authentication for all apps

Answer

On-premises authentication only