SC-900 Describe the concepts of security, compliance, and identity Practice Test 14 — 15 Questions

Question 1

Which TWO of the following are benefits of using Microsoft Entra ID for identity management? (Choose two.)

Accepted Answer

Conditional Access policies. Option B (Conditional Access policies) is correct because Microsoft Entra ID provides a policy engine that evaluates signals such as user/group membership, device compliance, location, and risk to grant, block, or require MFA for access to cloud and integrated apps. Option C (Single sign-on, SSO) is correct because Entra ID acts as a centralized identity provider using protocols like SAML 2.0, WS-Federation, OpenID Connect, and OAuth 2.0, letting users authenticate once and access multiple applications without re-entering credentials. Option A is wrong because storing passwords in plaintext is a severe security anti-pattern and Entra ID stores credentials as salted hashes, not plaintext. Option D is wrong because Entra ID is a cloud-based identity service, not a mechanism for local authentication of every app. Option E is wrong because Entra ID is a cloud identity provider and does not restrict authentication to on-premises only; it can integrate with on-premises AD via Entra Connect or Entra Cloud Sync.

Answer

Storing passwords in plaintext

Answer

Local authentication for all apps

Answer

On-premises authentication only

Question 2

Which THREE of the following are capabilities of Microsoft Purview Compliance Manager? (Choose three.)

Accepted Answer

Automated testing of controls. Option A (Automated testing of controls) is correct because Compliance Manager can automatically test certain Microsoft cloud controls against your tenant configuration — for example, verifying MFA enforcement or password policies — and update their status without manual evidence collection. Option C (Improvement actions) is correct because Compliance Manager provides a catalog of improvement actions that map to controls and standards, letting you assign owners, set implementation status, and track remediation steps to raise your compliance posture. Option E (Compliance score) is correct because Compliance Manager calculates a compliance score that quantifies your progress based on completed improvement actions and passed assessments, weighted by control importance. Option B (Manage user identities) is not a Compliance Manager capability; identity lifecycle and authentication are handled by Microsoft Entra ID. Option D (Create data loss prevention policies) is not a Compliance Manager capability; DLP policies are authored and enforced through Microsoft Purview Data Loss Prevention in the compliance portal, not through Compliance Manager.

Answer

Manage user identities

Answer

Create data loss prevention policies

Question 3

You are a security administrator for Contoso Ltd., a global financial services company with 5,000 employees. The company uses Microsoft 365 E5 licenses and has deployed Microsoft Entra ID, Microsoft Defender XDR, Microsoft Purview, and Microsoft Intune. Recently, the security team identified a risk: employees are sharing sensitive financial reports via external email recipients without encryption. To address this, you need to implement a solution that automatically applies encryption to emails containing the sensitive information type 'U.S. Bank Account Number' when sent to external recipients. The solution must not block the email but should encrypt it. Additionally, you want to notify the sender with a policy tip that the email will be encrypted. You have access to the Microsoft Purview compliance portal. What should you configure?

Accepted Answer

Create a Data Loss Prevention (DLP) policy in Microsoft Purview that detects 'U.S. Bank Account Number' and applies encryption to emails sent to external recipients, with a policy tip.. A DLP policy in Microsoft Purview is the correct solution because it can automatically detect sensitive information types like 'U.S. Bank Account Number' in email content and apply encryption actions (such as Encrypt-Only or Do Not Forward) when the email is sent to external recipients. The policy can also be configured to show a policy tip to the sender, notifying them that the email will be encrypted, without blocking the email. This directly meets the requirement of automatic encryption with sender notification, leveraging the built-in DLP capabilities in Microsoft 365 E5.

Answer

Configure an email encryption rule in Microsoft Defender for Office 365.

Answer

Enable Microsoft Purview Message Encryption for all users.

Answer

Create a sensitivity label with encryption and publish it to all users, then train users to apply it manually.

Question 4

Your organization is adopting a Zero Trust security model. You are tasked with implementing identity protection. The requirements are: enforce multi-factor authentication (MFA) for all users when accessing cloud applications, ensure that risky sign-ins are detected and blocked automatically, and provide administrators with a dashboard showing user risk levels. You have Microsoft Entra ID P2 licenses. What should you configure?

Accepted Answer

Configure a Conditional Access policy to require MFA for all cloud apps, enable Identity Protection to detect and automatically block risky sign-ins, and use the Identity Protection dashboard.. Microsoft Entra ID P2 includes Identity Protection, which provides risk detection for sign-ins and users, and Conditional Access, which enforces access controls like MFA. A Conditional Access policy requiring MFA for all cloud apps directly meets the first requirement. Enabling Identity Protection allows automatic blocking of risky sign-ins via risk-based Conditional Access policies, and the Identity Protection dashboard shows user risk levels, satisfying the remaining requirements.

Answer

Configure Microsoft Sentinel to collect sign-in logs and create custom alerts for risky sign-ins.

Answer

Configure Privileged Identity Management for all users and enable MFA.

Answer

Configure Microsoft Defender for Cloud Apps to require MFA and detect risky sign-ins.

Question 5

You are a compliance officer for a law firm that uses Microsoft 365 E5 licenses. The firm must comply with GDPR. You need to implement a solution that automatically identifies personal data (e.g., email addresses) in SharePoint Online documents and applies a 'GDPR-Protected' sensitivity label. Additionally, you need to ensure that if a user attempts to share a labeled document externally, they receive a policy tip warning about GDPR compliance, but the share is not blocked. You have Microsoft Purview. What should you configure?

Accepted Answer

Create an auto-labeling policy to apply the 'GDPR-Protected' label to documents containing email addresses, and create a DLP policy for labeled documents that shows a policy tip when shared externally.. An auto-labeling policy in Microsoft Purview can use sensitive information types (SITs) such as email addresses to automatically apply the 'GDPR-Protected' sensitivity label to SharePoint Online documents. A DLP policy scoped to documents with that label can then show a policy tip when users attempt external sharing, without blocking the action, satisfying the requirement for a warning only. This combination meets both the auto-classification and the non-blocking policy tip requirements.

Answer

Create a retention policy to tag documents containing email addresses.

Answer

Create a sensitivity label policy that publishes the 'GDPR-Protected' label to users and train them to apply it manually.

Answer

Create a DLP policy that detects email addresses and shows a policy tip, but do not apply a label.

Question 6

Your organization uses Microsoft Intune and Microsoft Entra ID. You need to enforce that only compliant and managed devices can access corporate email in Microsoft 365. Additionally, if a device is jailbroken, access should be blocked. You also want to provide a seamless sign-in experience for compliant devices. You have Microsoft Entra ID P1 licenses. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance and use Intune compliance policies to block jailbroken devices, with seamless SSO.. To enforce that only compliant and managed devices access corporate email, and to block jailbroken devices, the correct approach is a Conditional Access policy in Microsoft Entra ID that requires device compliance, combined with Intune compliance policies that detect and block jailbroken devices. Enabling seamless SSO provides the desired sign-in experience for compliant devices. This combination satisfies all stated requirements with Entra ID P1 licensing.

Answer

Configure Mobile Application Management (MAM) policies to restrict access.

Answer

Configure Azure AD Join for all devices and enable device registration.

Answer

Configure Microsoft Defender for Endpoint to detect jailbroken devices.

Question 7

A company deploys Microsoft Defender for Cloud Apps. They want to detect when a user downloads more than 100 files from SharePoint in 10 minutes. Which policy type should they create?

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Microsoft Defender for Cloud Apps are designed to identify unusual user activities that deviate from normal behavior, such as mass file downloads. They use machine learning to establish a baseline and trigger alerts when thresholds like 'more than 100 files in 10 minutes' are exceeded. This is the correct policy type for detecting such behavioral anomalies.

Answer

File policy

Answer

App permission policy

Answer

Session policy

Question 8

A user reports that they cannot access a sensitive document in SharePoint. The document has a sensitivity label of 'Highly Confidential' applied. The user is a member of the 'Finance' group, which has the label permission. However, the user is located in a country that is blocked by a conditional access policy. What is the most likely reason the user cannot access the document?

Accepted Answer

A conditional access policy is blocking access based on the user's location. The user is a member of the Finance group, which has the necessary sensitivity label permission, so lack of permission is not the issue. The most likely reason is that a conditional access policy is blocking access based on the user's location, as the user is in a blocked country. Conditional access policies in Microsoft Entra ID can restrict access based on location, and this would override other permissions.

Answer

The user does not have the required sensitivity label permission

Answer

The user does not have a Microsoft 365 E5 license

Answer

The document does not have a sensitivity label applied

Question 9

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows external partners to access resources using their own identity provider. Which Microsoft Entra feature should you use?

Accepted Answer

External ID. Microsoft Entra External ID (formerly Azure AD B2B) allows external partners to access your organization's resources using their own identity providers, enabling secure collaboration without managing external identities. Option A is incorrect because Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) solution for multi-cloud permissions. Option B is incorrect because Microsoft Entra Verified ID is a verifiable credentials solution for decentralized identity verification. Option C is incorrect because Entra ID Governance focuses on identity lifecycle management, access reviews, and entitlement management.

Answer

Microsoft Entra Permissions Management

Answer

Microsoft Entra Verified ID

Answer

Entra ID Governance

Question 10

A company uses Microsoft Defender for Endpoint. An alert indicates that a device is communicating with a known malicious IP address. The security team wants to automatically block the IP address on all devices. Which action should they configure?

Accepted Answer

Indicator of compromise (IoC). An Indicator of Compromise (IoC) in Microsoft Defender for Endpoint lets security teams define a known malicious IP address, URL, domain, or file hash and configure an action such as 'Block' or 'Alert and block'. Once created, the IoC is enforced across all onboarded devices, automatically blocking communication with the malicious IP. This is the correct feature for automated, organization-wide blocking.

Answer

Custom detection rule

Answer

Automated investigation

Answer

Threat analytics report

Question 11

A security administrator receives an alert from Microsoft Sentinel about a possible brute-force attack against a virtual machine. The administrator wants to automatically block the attacker's IP address for 24 hours using a playbook. Which automation trigger should the playbook use?

Accepted Answer

Incident trigger. An incident trigger allows the playbook to run automatically when a new incident is created in Microsoft Sentinel. In this scenario, the alert about the brute-force attack generates an incident, and the playbook can then block the attacker's IP address for 24 hours. Option B (Alert trigger) runs on alert generation, but the administrator wants to respond to the incident for a coordinated response. Option C (Scheduled trigger) runs on a timer and is not event-driven. Option D (Action trigger) is not a valid trigger type in Microsoft Sentinel.

Answer

Alert trigger

Answer

Scheduled trigger

Answer

Action trigger

Question 12

Your organization uses Microsoft Purview to enforce retention policies. You need to retain all documents in a specific SharePoint site for 5 years after they are created, and then delete them permanently. What should you configure?

Accepted Answer

A retention policy set to retain for 5 years and then delete. A retention policy in Microsoft Purview is applied at the workload/location level (e.g., a specific SharePoint site) and can be configured to retain content for 5 years and then delete it. This matches the requirement of scoping retention to a site without relying on per-item labeling. Retention policies are the correct construct when you want location-based, automatic retention and deletion.

Answer

A DLP policy with a retention rule

Answer

A retention label set to retain for 5 years and then delete

Answer

A sensitivity label with a retention setting

Question 13

Which TWO are principles of the Zero Trust security model?

Accepted Answer

Verify explicitly. Option A, "Verify explicitly," is a core Zero Trust principle: every access request must be authenticated and authorized based on all available data points, including user identity, device health, location, and resource sensitivity, rather than granting implicit trust based on network location. Option C, "Assume breach," is the other foundational Zero Trust principle: organizations must operate as if an attacker is already present, which drives micro-segmentation, least-privilege access, end-to-end encryption, and continuous monitoring to minimize blast radius and detect threats. Option B, "Trust everything inside the network," is the opposite of Zero Trust, which explicitly rejects the castle-and-moat assumption that internal traffic is inherently trustworthy. Option D, "Use a VPN for remote access," is a connectivity mechanism, not a Zero Trust principle; Zero Trust instead favors per-request, identity-based access controls over implicit network-level trust. Option E, "Layer defenses," describes defense in depth, a complementary but distinct security strategy, not one of the three canonical Zero Trust principles (verify explicitly, use least-privilege access, assume breach).

Answer

Trust everything inside the network

Answer

Use a VPN for remote access

Answer

Layer defenses

Question 14

Which THREE are capabilities of Microsoft Defender XDR?

Accepted Answer

Automated investigation and remediation. Option B is correct because Microsoft Defender XDR provides automated investigation and remediation (AIR) that uses playbooks to automatically investigate alerts and take remediation actions across affected assets. Option C is correct because Defender XDR correlates alerts into unified incidents spanning email (Defender for Office 365), endpoints (Defender for Endpoint), and identities (Defender for Identity), giving a single incident queue and management experience. Option D is correct because Defender XDR enables cross-domain threat hunting, allowing advanced hunting queries over unified data from endpoints, email, identities, and cloud apps in one schema. Option A is not correct because device compliance policy management is a Microsoft Intune/Endpoint Manager capability, not a Defender XDR function. Option E is not correct because data classification and labeling is handled by Microsoft Purview Information Protection, not Defender XDR.

Answer

Device compliance policy management

Answer

Data classification and labeling

Question 15

Which TWO are features of Microsoft Entra ID?

Accepted Answer

Single sign-on (SSO). Options A and E are correct. Microsoft Entra ID provides Single sign-on (SSO) and Self-service password reset (SSPR). Option B (Data loss prevention) is a feature of Microsoft Purview. Option C (Cloud app discovery) is part of Microsoft Defender for Cloud Apps. Option D (Mobile device management) is a feature of Microsoft Intune.

Answer

Data loss prevention (DLP)

Answer

Cloud app discovery

Answer

Mobile device management (MDM)