SC-900 Describe the concepts of security, compliance, and identity Practice Test 13 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR. The security team wants a central dashboard showing the overall security posture and recommended actions. Which tool should they use?

Accepted Answer

Microsoft Secure Score. Microsoft Secure Score provides a dashboard with security recommendations and posture assessment. Option A is incorrect because Microsoft Purview is for data governance. Option B is incorrect because Microsoft Entra ID is identity management. Option C is incorrect because Microsoft Sentinel is a SIEM.

Answer

Microsoft Purview

Answer

Microsoft Entra ID

Answer

Microsoft Sentinel

Question 2

Which TWO components are part of the 'Zero Trust' security model? (Choose two.)

Accepted Answer

Least privilege. Correct answers are A and D: Least privilege ensures users have only the minimum access needed, and Verify explicitly assumes every access request is a potential threat. Option B (VPN access) is a network access method, not a Zero Trust principle. Option C (password complexity) is a security control but not a core component of the Zero Trust model. Option E (perimeter-based security) is the traditional model that Zero Trust replaces.

Answer

VPN access

Answer

Password complexity

Answer

Perimeter-based security

Question 3

Which TWO of the following are benefits of using Microsoft Entra ID for identity management? (Choose two.)

Accepted Answer

Conditional Access policies. Correct answers are B and C. Single sign-on (SSO) allows users to access multiple applications with one set of credentials, improving user experience and security. Conditional Access policies enable organizations to enforce access controls based on conditions like user location, device state, or risk level. Option A (storing passwords in plaintext) is never a benefit and is a security risk. Option D (local authentication for all apps) contradicts the cloud-based identity model of Microsoft Entra ID, which centralizes authentication. Option E (on-premises authentication only) is not a benefit as it limits cloud integration and modern features.

Answer

Storing passwords in plaintext

Answer

Local authentication for all apps

Answer

On-premises authentication only

Question 4

Which THREE of the following are capabilities of Microsoft Purview Compliance Manager? (Choose three.)

Accepted Answer

Automated testing of controls. Correct answers are A, C, and E: Compliance Manager provides a compliance score, automated testing of controls, and improvement actions. Option B is incorrect because managing user identities is a capability of Microsoft Entra ID, not Compliance Manager. Option D is incorrect because creating data loss prevention policies is a feature of Microsoft Purview Data Loss Prevention, not Compliance Manager.

Answer

Manage user identities

Answer

Create data loss prevention policies

Question 5

You are a security administrator for Contoso Ltd., a global financial services company with 5,000 employees. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Entra ID, Microsoft Defender XDR, Microsoft Purview, and Microsoft Intune. Recently, the security team identified a risk: employees are sharing sensitive financial reports via external email recipients without encryption. To address this, you need to implement a solution that automatically applies encryption to emails containing the sensitive information type 'U.S. Bank Account Number' when sent to external recipients. The solution must not block the email but should encrypt it. Additionally, you want to notify the sender with a policy tip that the email will be encrypted. You have access to the Microsoft Purview compliance portal. What should you configure?

Accepted Answer

Create a Data Loss Prevention (DLP) policy in Microsoft Purview that detects 'U.S. Bank Account Number' and applies encryption to emails sent to external recipients, with a policy tip.. A Data Loss Prevention (DLP) policy in Microsoft Purview can automatically detect sensitive information types like 'U.S. Bank Account Number' and apply encryption to emails sent to external recipients, while also showing a policy tip to notify the sender. Option A is incorrect because Microsoft Defender for Office 365 does not provide DLP policies; DLP is part of Microsoft Purview. Option C is incorrect because simply enabling Message Encryption for all users does not automatically apply encryption based on content; it requires a DLP policy or other mechanism. Option D is incorrect because sensitivity labels require manual application or auto-labeling rules, whereas DLP can automatically enforce encryption based on conditions like sensitive data detection.

Answer

Configure an email encryption rule in Microsoft Defender for Office 365.

Answer

Enable Microsoft Purview Message Encryption for all users.

Answer

Create a sensitivity label with encryption and publish it to all users, then train users to apply it manually.

Question 6

Your organization is adopting a Zero Trust security model. You are tasked with implementing identity protection. The requirements are: enforce multi-factor authentication (MFA) for all users when accessing cloud applications, ensure that risky sign-ins are detected and blocked automatically, and provide administrators with a dashboard showing user risk levels. You have Microsoft Entra ID P2 licenses. What should you configure?

Accepted Answer

Configure a Conditional Access policy to require MFA for all cloud apps, enable Identity Protection to detect and automatically block risky sign-ins, and use the Identity Protection dashboard.. A Conditional Access policy enforces MFA for all cloud apps, Identity Protection detects and automatically blocks risky sign-ins, and the Identity Protection dashboard provides a view of user risk levels. Option A is incorrect because Microsoft Sentinel is a SIEM for security information and event management, not for identity protection. Option C is incorrect because Privileged Identity Management (PIM) manages privileged access roles, not general MFA or risk detection. Option D is incorrect because Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) for cloud app security, not for identity risk detection.

Answer

Configure Microsoft Sentinel to collect sign-in logs and create custom alerts for risky sign-ins.

Answer

Configure Privileged Identity Management for all users and enable MFA.

Answer

Configure Microsoft Defender for Cloud Apps to require MFA and detect risky sign-ins.

Question 7

You are a compliance officer for a law firm that uses Microsoft 365 E5 licenses. The firm must comply with GDPR. You need to implement a solution that automatically identifies personal data (e.g., email addresses) in SharePoint Online documents and applies a 'GDPR-Protected' sensitivity label. Additionally, you need to ensure that if a user attempts to share a labeled document externally, they receive a policy tip warning about GDPR compliance, but the share is not blocked. You have Microsoft Purview. What should you configure?

Accepted Answer

Create an auto-labeling policy to apply the 'GDPR-Protected' label to documents containing email addresses, and create a DLP policy for labeled documents that shows a policy tip when shared externally.. An auto-labeling policy can automatically detect personal data (e.g., email addresses) and apply the 'GDPR-Protected' sensitivity label. Then, a separate DLP policy configured for labeled documents can show a policy tip when users attempt to share them externally, warning about GDPR compliance without blocking the share. Option B is incorrect because a retention policy does not apply sensitivity labels or provide DLP policy tips. Option C is incorrect; publishing a sensitivity label only allows manual application by users, not automatic labeling, and it does not include DLP policy tips. Option D is incorrect because without applying the label, the DLP policy would not target only the labeled documents as required, and the policy tip would not be associated with the specific 'GDPR-Protected' label context.

Answer

Create a retention policy to tag documents containing email addresses.

Answer

Create a sensitivity label policy that publishes the 'GDPR-Protected' label to users and train them to apply it manually.

Answer

Create a DLP policy that detects email addresses and shows a policy tip, but do not apply a label.

Question 8

Your organization uses Microsoft Intune and Microsoft Entra ID. You need to enforce that only compliant and managed devices can access corporate email in Microsoft 365. Additionally, if a device is jailbroken, access should be blocked. You also want to provide a seamless sign-in experience for compliant devices. You have Microsoft Entra ID P1 licenses. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance and use Intune compliance policies to block jailbroken devices, with seamless SSO.. It combines Conditional Access policies in Microsoft Entra ID with Intune compliance policies. Conditional Access can require device compliance, and Intune compliance policies can block jailbroken devices. Seamless SSO provides a frictionless sign-in experience for compliant devices. Option A is incorrect because MAM policies manage app-level protection without device enrollment, but they do not enforce device compliance or block jailbroken devices. Option B is incorrect because Azure AD Join registers devices but does not automatically enforce compliance policies or block jailbroken devices. Option D is incorrect because Microsoft Defender for Endpoint is a threat protection solution and does not directly manage device compliance or conditional access.

Answer

Configure Mobile Application Management (MAM) policies to restrict access.

Answer

Configure Azure AD Join for all devices and enable device registration.

Answer

Configure Microsoft Defender for Endpoint to detect jailbroken devices.

Question 9

Your organization wants to ensure that only users with a specific sensitivity label can access a SharePoint site. Which Microsoft Purview feature should you configure?

Accepted Answer

Information Protection. Microsoft Purview Information Protection allows you to apply sensitivity labels to content, and these labels can be used to control access to SharePoint sites via conditional access policies. Option A is wrong because Insider Risk Management focuses on detecting risky activities, not on label-based access control. Option B is wrong because Communication Compliance monitors communications for policy violations. Option C is wrong because Data Lifecycle Management focuses on retention and deletion, not access control.

Answer

Insider Risk Management

Answer

Communication Compliance

Answer

Data Lifecycle Management

Question 10

A company deploys Microsoft Defender for Cloud Apps. They want to detect when a user downloads more than 100 files from SharePoint in 10 minutes. Which policy type should they create?

Accepted Answer

Anomaly detection policy. An anomaly detection policy in Defender for Cloud Apps can identify unusual file download activities based on predefined thresholds. Option A is wrong because a file policy monitors files based on metadata or content, not behavioral patterns. Option C is wrong because an app permission policy governs permissions granted to third-party apps. Option D is wrong because a session policy enforces real-time controls on user sessions.

Answer

File policy

Answer

App permission policy

Answer

Session policy

Question 11

A user reports that they cannot access a sensitive document in SharePoint. The document has a sensitivity label of 'Highly Confidential' applied. The user is a member of the 'Finance' group, which has the label permission. However, the user is located in a country that is blocked by a conditional access policy. What is the most likely reason the user cannot access the document?

Accepted Answer

A conditional access policy is blocking access based on the user's location. Although the user is a member of the Finance group and has the required sensitivity label permission, the conditional access policy blocks access based on the user's location (country). Conditional access policies can override label permissions. Option A is incorrect because the user does have the required label permission. Option B is incorrect because no licensing issue is indicated; Microsoft 365 E5 is not required for sensitivity labels. Option D is incorrect because the document does have a sensitivity label applied.

Answer

The user does not have the required sensitivity label permission

Answer

The user does not have a Microsoft 365 E5 license

Answer

The document does not have a sensitivity label applied

Question 12

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows external partners to access resources using their own identity provider. Which Microsoft Entra feature should you use?

Accepted Answer

External ID. Microsoft Entra External ID (formerly Azure AD B2B) allows external partners to access your organization's resources using their own identity providers, enabling secure collaboration without managing external identities. Option A is incorrect because Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) solution for multi-cloud permissions. Option B is incorrect because Microsoft Entra Verified ID is a verifiable credentials solution for decentralized identity verification. Option C is incorrect because Entra ID Governance focuses on identity lifecycle management, access reviews, and entitlement management.

Answer

Microsoft Entra Permissions Management

Answer

Microsoft Entra Verified ID

Answer

Entra ID Governance

Question 13

A company uses Microsoft Defender for Endpoint. An alert indicates that a device is communicating with a known malicious IP address. The security team wants to automatically block the IP address on all devices. Which action should they configure?

Accepted Answer

Indicator of compromise (IoC). An Indicator of compromise (IoC) in Microsoft Defender for Endpoint can be configured to automatically block a known malicious IP address across all devices. Option A (Custom detection rule) is wrong because custom detection rules are used for custom query-based detection, not for blocking. Option B (Automated investigation) is wrong because automated investigation can investigate and resolve alerts but does not directly block IP addresses. Option D (Threat analytics report) is wrong because it provides threat intelligence reports but does not take blocking actions.

Answer

Custom detection rule

Answer

Automated investigation

Answer

Threat analytics report

Question 14

An organization wants to classify and label data automatically based on sensitive content patterns such as credit card numbers. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) can automatically classify and label data based on sensitive content patterns such as credit card numbers. Option A (eDiscovery) is for legal discovery, Option C (Compliance Manager) is for compliance assessments, and Option D (Audit) is for logging activities.

Answer

eDiscovery

Answer

Compliance Manager

Answer

Audit

Question 15

Your company uses Microsoft Intune for device management. You need to ensure that all company data on a user's personally owned device is removed when the user is offboarded, but the user's personal data should remain. Which wipe action should you use?

Accepted Answer

Selective wipe. Selective wipe removes only company data from Intune-managed apps, leaving personal data intact. Full wipe resets the device and deletes all data. Delete removes the device from Intune management but does not wipe data. Retire removes the device from management and removes company data; however, the action that specifically performs a selective wipe of company data is Selective wipe.

Answer

Delete

Answer

Full wipe

Answer

Retire