SC-900 Describe the concepts of security, compliance, and identity Practice Test 12 — 15 Questions

Question 1

You are reviewing a Conditional Access policy configuration in Microsoft Entra ID. Based on the exhibit, what is the effect of this policy?

Accepted Answer

Blocks sign-ins that have a high sign-in risk level. The policy is configured to target 'All users' and 'All cloud apps' with a condition of 'Sign-in risk level: High' and an access control of 'Block access'. This means any sign-in attempt that Microsoft Entra ID detects as having a high sign-in risk (e.g., from a compromised token or anonymous IP) will be blocked. Option B correctly identifies this effect.

Answer

Blocks sign-ins for users with high user risk

Answer

Blocks all sign-ins for the assigned users

Answer

Requires multi-factor authentication for high-risk sign-ins

Question 2

You are a security analyst using Microsoft Sentinel. You run the following Kusto query:

SecurityAlert
| where TimeGenerated > ago(7d)
| where AlertName contains "MFA"
| summarize Count = count() by bin(TimeGenerated, 1d)
| render timechart

What does this query do?

Accepted Answer

Counts security alerts containing 'MFA' per day for the last 7 days. The query filters the SecurityAlert table to the last 7 days, keeps only alerts whose AlertName contains 'MFA', then summarizes by counting rows grouped into 1-day bins of TimeGenerated, and renders the result as a time chart. The output is therefore a daily count of MFA-related security alerts over the past week.

Answer

Lists all identities that triggered MFA alerts

Answer

Counts distinct users with MFA alerts per day

Answer

Counts alerts by severity over the last week

Question 3

You run the PowerShell command shown in the exhibit. What is the purpose of this command?

Accepted Answer

Applies a sensitivity label to a document. The PowerShell command shown in the exhibit is used to apply a sensitivity label to a document. Sensitivity labels in Microsoft 365 are applied using cmdlets like Set-AIPFileLabel or Set-Label, which tag the file with the specified label for classification and protection. This action does not encrypt the document by itself; encryption is a potential outcome of the label's protection settings, but the command's primary purpose is labeling.

Answer

Encrypts a document using Azure Information Protection

Answer

Removes a sensitivity label from a document

Answer

Exports audit logs for labeled documents

Question 4

Your organization wants to enforce multi-factor authentication (MFA) for all users accessing cloud applications. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Create a Conditional Access policy. Conditional Access policies in Microsoft Entra ID are the recommended way to enforce MFA for all users accessing cloud applications. A Conditional Access policy evaluates signals (user, device, location, app, risk) and can require MFA as a grant control. This provides granular, centralized control and supports reporting and what-if analysis.

Answer

Configure Privileged Identity Management

Answer

Use Identity Protection

Answer

Enable MFA per user

Question 5

Your company is implementing a zero-trust security model. Which principle requires verifying every access request as though it originates from an untrusted network, even if the request comes from within the corporate network?

Accepted Answer

Explicit verification. Explicit verification is one of the three core Zero Trust principles (alongside least privilege and assume breach) and specifically requires authenticating and authorizing every access request based on all available data points — identity, location, device health, service, and workload — regardless of whether the request originates inside or outside the corporate network. It rejects the traditional 'trusted internal network' assumption.

Answer

Least privilege

Answer

Trust but verify

Answer

Assume breach

Question 6

Your organization uses Microsoft Purview to classify sensitive data. You need to create a custom sensitive information type that detects employee IDs matching the pattern 'EMP-XXXXX' (where X is a digit). Which rule pack element must you define?

Accepted Answer

Regular expression. A custom sensitive information type (SIT) in Microsoft Purview is built from one or more pattern-matching elements; to detect a structured pattern like 'EMP-XXXXX' where X is a digit, you must define a regular expression (regex) that matches the literal 'EMP-' followed by exactly five digits. Regex is the only rule-pack element that can express this positional, character-class pattern. Supporting elements like keyword lists or functions can raise confidence but cannot define the pattern itself.

Answer

Keyword list

Answer

Data store reference

Answer

Function

Question 7

Your organization needs to control which users can access Microsoft Purview compliance portal. Which method should you use to grant access?

Accepted Answer

Assign users to the Compliance Administrator role group in Microsoft Purview. Access to the Microsoft Purview compliance portal is granted by assigning users to the appropriate role group within Purview itself, such as the Compliance Administrator role group. Option A is incorrect because Azure RBAC roles manage access to Azure resources, not to Purview. Option B is incorrect because Intune policies control device management and compliance, not user access to Purview. Option D is incorrect while Microsoft 365 E5 licenses are required to use Purview features, they do not by themselves grant access; explicit role assignment is necessary.

Answer

Add users to an Azure RBAC role

Answer

Configure Intune policy to allow access

Answer

Assign Microsoft 365 E5 licenses to users

Question 8

Your company is implementing data loss prevention (DLP) policies in Microsoft Purview. You need to prevent users from sharing credit card numbers via email. Which type of sensitive information type should you use in the DLP rule?

Accepted Answer

Built-in sensitive information type. Microsoft Purview ships with built-in sensitive information types (SITs) that already detect credit card numbers using validated patterns, including the Luhn checksum and contextual keywords like 'credit card' or 'CVV.' Using the built-in 'Credit Card Number' SIT is the fastest, most accurate way to enforce a DLP rule blocking card numbers in email. Custom or EDM approaches are unnecessary when a ready-made SIT exists.

Answer

Custom keyword list

Answer

Trainable classifier

Answer

Exact data match (EDM) based classification

Question 9

Your organization uses Microsoft Defender for Cloud Apps. You need to discover shadow IT usage. Which feature should you enable?

Accepted Answer

Cloud Discovery. Cloud Discovery in Microsoft Defender for Cloud Apps analyzes traffic logs from firewalls, proxies, and endpoints to identify which cloud apps are being used, including unsanctioned shadow IT. It builds a cloud app catalog with risk scores so security teams can sanction or block apps, directly addressing shadow IT discovery.

Answer

File policies

Answer

Conditional Access App Control

Answer

App catalog

Question 10

Your organization wants to use Microsoft Entra ID to provide single sign-on (SSO) for a third-party SaaS application. What must you configure in Microsoft Entra ID?

Accepted Answer

Enterprise application registration. To provide SSO for a third-party SaaS application using Microsoft Entra ID, you must configure an enterprise application registration, which represents the application in your tenant and enables SAML or OIDC-based SSO. This registration includes the necessary configuration for single sign-on, such as the reply URL and claims.

Answer

Identity Protection policy

Answer

Conditional Access policy

Answer

Self-service password reset

Question 11

Which Microsoft Purview solution should you use to automatically retain or delete content based on regulations?

Accepted Answer

Records Management. Records Management in Microsoft Purview provides policy-based retention and deletion labels that automatically enforce regulatory compliance requirements, such as GDPR or SOX. It uses retention labels and label policies to mark content for a specified duration, after which it is either retained, deleted, or reviewed via disposition review. This directly addresses the need to automatically retain or delete content based on regulations.

Answer

Communication Compliance

Answer

Data Loss Prevention (DLP)

Answer

eDiscovery

Question 12

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user executes a specific command on Azure VMs. Which data source should you connect to capture the command execution logs?

Accepted Answer

Windows Security Events via Azure Monitor Agent. To capture command execution logs on Azure VMs, you need to collect Windows Security Events, specifically event ID 4688 (process creation), which includes the command line if audit policy is enabled. The Windows Security Events via Azure Monitor Agent connector in Microsoft Sentinel ingests these events from the VMs. This data source provides the necessary telemetry to detect specific command executions.

Answer

Office Activity log

Answer

Azure AD audit logs

Answer

Azure Activity log

Question 13

Which TWO of the following are principles of the Zero Trust security model? (Select two.)

Accepted Answer

Verify explicitly. Option A, "Verify explicitly," is a core Zero Trust principle: every access request must be authenticated and authorized based on all available data points (identity, device health, location, workload, data classification) rather than assumed from network location. Option E, "Least privilege access," is also a foundational Zero Trust principle, requiring just-in-time and just-enough-access (JIT/JEA), risk-based adaptive policies, and data protection to limit each user's exposure. The unmarked options do not belong because B, "Perimeter-based security," reflects the traditional castle-and-moat model that Zero Trust explicitly replaces; C, "Implicit trust," is the assumption Zero Trust eliminates by treating every session as untrusted until verified; and D, "Trust but verify," is a Cold War-era adage (and a contrasting posture) rather than a Zero Trust principle, since Zero Trust never grants trust in the first place.

Answer

Perimeter-based security

Answer

Implicit trust

Answer

Trust but verify

Question 14

Which THREE of the following are capabilities of Microsoft Purview Information Protection? (Select three.)

Accepted Answer

Rights management. Microsoft Purview Information Protection provides rights management (A), which uses Azure Rights Management encryption to protect content both inside and outside the organization, so it is correct. It also delivers data classification (C), automatically identifying and categorizing sensitive content through trainable classifiers and sensitive information types, making it correct. Sensitivity labels (D) are the core capability of Information Protection, allowing users and admins to apply protection settings like encryption and content marking to files and emails, so it is correct. eDiscovery (B) belongs to the Microsoft Purview eDiscovery solution rather than Information Protection, and data loss prevention policies (E) are part of the separate Microsoft Purview Data Loss Prevention workload, so neither belongs to Information Protection's capabilities.

Answer

eDiscovery

Answer

Data loss prevention policies

Question 15

You have a Conditional Access policy in Microsoft Entra ID. The policy has the following settings: Assignments > Users > Include: All guest and external users; Assignments > Target resources > Cloud apps: All cloud apps; Access controls > Grant: Require multi-factor authentication. What is the effect of this policy?

Accepted Answer

Requires MFA for all external users accessing any cloud app. The policy applies to all guest and external users and targets all cloud apps, with the grant control requiring multi-factor authentication. Therefore, it requires MFA for all external users accessing any cloud app. It is not limited to guest users only, does not apply to all internal users, and does not exclude external users with the Global Administrator role.

Answer

Requires MFA for guest users only

Answer

Requires MFA for all users accessing all cloud apps

Answer

Requires MFA for external users except those with global admin role