SC-900 Describe the concepts of security, compliance, and identity Practice Test 14 — 15 Questions

Question 1

A security administrator receives an alert from Microsoft Sentinel about a possible brute-force attack against a virtual machine. The administrator wants to automatically block the attacker's IP address for 24 hours using a playbook. Which automation trigger should the playbook use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Incident trigger. An incident trigger allows the playbook to run automatically when a new incident is created in Microsoft Sentinel. In this scenario, the alert about the brute-force attack generates an incident, and the playbook can then block the attacker's IP address for 24 hours. Option B (Alert trigger) runs on alert generation, but the administrator wants to respond to the incident for a coordinated response. Option C (Scheduled trigger) runs on a timer and is not event-driven. Option D (Action trigger) is not a valid trigger type in Microsoft Sentinel.

Answer

Alert trigger

Answer

Scheduled trigger

Answer

Action trigger

Question 2

Your organization uses Microsoft Purview to enforce retention policies. You need to retain all documents in a specific SharePoint site for 5 years after they are created, and then delete them permanently. What should you configure?

Accepted Answer

A retention policy set to retain for 5 years and then delete. A retention policy scoped to a SharePoint site can be configured to retain items for 5 years after creation and then delete them permanently. This applies automatically to all content in the site without requiring manual action or labels. Option A is incorrect because DLP policies are for preventing data loss, not retention. Option C is incorrect because a retention label is applied per item and requires explicit assignment or auto-application rules, whereas a policy applies broadly to a location. Option D is incorrect because sensitivity labels are for classification and protection, not retention.

Answer

A DLP policy with a retention rule

Answer

A retention label set to retain for 5 years and then delete

Answer

A sensitivity label with a retention setting

Question 3

Which TWO are principles of the Zero Trust security model?

Accepted Answer

Verify explicitly. Options A and C are correct. Zero Trust principles include 'verify explicitly' and 'assume breach'. Option B contradicts Zero Trust as it trusts everything inside the network. Option D describes a traditional VPN-based approach, which is not a Zero Trust principle. Option E is a principle of defense in depth, not Zero Trust.

Answer

Trust everything inside the network

Answer

Use a VPN for remote access

Answer

Layer defenses

Question 4

Which THREE are capabilities of Microsoft Defender XDR?

Accepted Answer

Automated investigation and remediation. Options B, C, and D are correct. Microsoft Defender XDR provides automated investigation and remediation (B), incident management across email, endpoints, and identities (C), and cross-domain threat hunting (D). Option A (Device compliance policy management) is a capability of Microsoft Intune, not Defender XDR. Option E (Data classification and labeling) is a capability of Microsoft Purview, not Defender XDR.

Answer

Device compliance policy management

Answer

Data classification and labeling

Question 5

Which TWO are features of Microsoft Entra ID?

Accepted Answer

Single sign-on (SSO). Options A and E are correct. Microsoft Entra ID provides Single sign-on (SSO) and Self-service password reset (SSPR). Option B (Data loss prevention) is a feature of Microsoft Purview. Option C (Cloud app discovery) is part of Microsoft Defender for Cloud Apps. Option D (Mobile device management) is a feature of Microsoft Intune.

Answer

Data loss prevention (DLP)

Answer

Cloud app discovery

Answer

Mobile device management (MDM)

Question 6

You find a JSON representation of a sensitivity label in a SharePoint document's metadata. The label indicates encryption is applied and access is restricted to finance@contoso.com. Based on this information, what is the effect of the label applied to the document?

Accepted Answer

The document is encrypted and can only be accessed by users in the finance@contoso.com group. A sensitivity label configured with encryption settings restricts access to the specified user or group. In this scenario, the label 'Confidential' is applied with encryption and the user/group set to 'finance@contoso.com', which encrypts the document and limits access to members of that group. Option B is incorrect because the label includes encryption, not just visual marking. Option C is incorrect because access is restricted to the finance group, not any user with the decryption key. Option D is incorrect because the label enforces encryption, not retention.

Answer

The document is only marked as confidential but not encrypted

Answer

The document is encrypted and can be accessed by any user with the decryption key

Answer

The document will be retained for a specified period

Question 7

You run the following KQL query in Microsoft Sentinel. What is the purpose of this query?

```kusto
SigninLogs
| where UserPrincipalName == "admin@contoso.com"
| where ResultType == "50126"
| summarize FailedAttempts = count() by IPAddress
| sort by FailedAttempts desc
```

Accepted Answer

To detect potential brute-force attacks against a specific user account. This query filters sign-in logs for a specific user account and failed authentication results, then counts failed attempts by IP address. This pattern is used in Microsoft Sentinel to detect potential brute-force attacks against that specific user account.

Answer

To find all users who signed in from multiple IP addresses

Answer

To identify sign-ins that failed multi-factor authentication

Answer

To list all IP addresses that accessed the tenant

Question 8

You run the following PowerShell command in your Microsoft Entra ID environment:

Get-AzureADPolicy -Type TokenLifetimePolicy

What is the command retrieving?

Accepted Answer

Token lifetime policies. The command retrieves all policies of type 'TokenLifetimePolicy', which are used to define token lifetimes. Option A is wrong because conditional access policies use a different type. Option B is wrong because named locations are not policies. Option C is wrong because role assignments are not policies.

Answer

Conditional access policies

Answer

Named locations

Answer

Role assignments

Question 9

A company wants to ensure that only users with appropriate permissions can access sensitive data stored in Microsoft SharePoint Online. Which principle should they implement?

Accepted Answer

Apply the principle of least privilege. The principle of least privilege ensures that users have only the minimum permissions necessary to perform their tasks, which directly limits access to sensitive data. Option B (RBAC) is a method to enforce least privilege, but the question asks for the principle itself. Option C (MFA) adds authentication security but does not control permissions. Option D (defense in depth) is a broader security strategy, not specifically about permission minimization.

Answer

Assign roles based on job function using role-based access control (RBAC)

Answer

Enable multi-factor authentication (MFA) for all users

Answer

Implement defense in depth

Question 10

A healthcare organization must comply with HIPAA regulations. They use Microsoft Purview to classify and label patient data. Which Microsoft Purview capability helps them enforce data protection policies automatically?

Accepted Answer

Data loss prevention (DLP) policies. Data loss prevention (DLP) policies in Microsoft Purview can automatically detect and protect sensitive data like health information. Option A is wrong because eDiscovery focuses on searching content for legal purposes, not automatic enforcement. Option B is wrong because audit logs record events but don't enforce policies. Option C is wrong because sensitivity labels apply classification but not automatic protection actions.

Answer

eDiscovery

Answer

Audit logs

Answer

Sensitivity labels

Question 11

A multinational corporation wants to implement a Zero Trust security model. They plan to verify every access request explicitly, use least privilege access, and assume breach. Which Microsoft security solution should they use to enforce conditional access policies based on user, device, location, and risk?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct solution for enforcing conditional access policies based on signals like user, device, location, and risk. Option A (Microsoft Sentinel) is a SIEM/SOAR solution for security analytics, not access control. Option B (Microsoft Intune) manages devices but does not enforce access policies on its own. Option D (Microsoft Defender for Cloud Apps) provides cloud app security but is not the primary conditional access engine.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Question 12

A small business wants to enable single sign-on (SSO) for its employees using their existing on-premises Active Directory. They plan to migrate to cloud-based identity management. Which Microsoft service should they use to connect their on-premises directory to Microsoft Entra ID?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory with Microsoft Entra ID, enabling single sign-on (SSO). Option A is correct because it provides the primary and most comprehensive synchronization service for hybrid identity. Option C (AD FS) is for federation, not the primary synchronization service for connecting on-premises AD to Entra ID. Option B (Microsoft Intune) is for device management, not identity synchronization. Option D (Microsoft Entra Cloud Sync) is a lightweight synchronization service that can connect on-premises AD and enable SSO via Password Hash Synchronization; however, Microsoft Entra Connect offers a broader range of SSO methods (including Pass-through Authentication and Seamless SSO) and comprehensive hybrid identity features (like device writeback and custom sync rules), making it the more complete and standard solution for connecting on-premises AD and enabling full SSO as implied by a general migration scenario.

Answer

Microsoft Intune

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Cloud Sync

Question 13

An organization wants to ensure that its security team can quickly identify and respond to threats across all workloads, including identities, endpoints, email, and cloud apps. Which Microsoft security solution provides a unified incident management experience?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (formerly Microsoft 365 Defender) provides a unified incident management experience across identities, endpoints, email, and cloud apps. Option A is wrong because Microsoft Sentinel is a SIEM that can ingest data from multiple sources but is not the native XDR solution. Option B is wrong because Microsoft Defender for Cloud protects cloud workloads only. Option D is wrong because Microsoft Defender for Identity focuses on identity threats only.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity

Question 14

A financial services company needs to comply with GDPR and requires that personal data be automatically classified and protected when stored in Microsoft SharePoint and OneDrive. They also need to retain certain records for a minimum of 7 years. Which combination of Microsoft Purview capabilities should they use?

Accepted Answer

Sensitivity labels and retention labels. Sensitivity labels classify and protect personal data (e.g., encrypt, apply markings), while retention labels enforce the required 7-year retention period. Option A is incorrect because DLP policies detect and prevent data loss but do not enforce retention. Option C is incorrect because DLP policies do not classify data. Option D is incorrect because eDiscovery is for searching and exporting data, not for classification or retention.

Answer

Sensitivity labels and data loss prevention (DLP) policies

Answer

Data loss prevention (DLP) policies and retention labels

Answer

eDiscovery and sensitivity labels

Question 15

A user reports that they cannot access a sensitive document in SharePoint Online. The administrator checks the document's permissions and sees that the user is not listed directly, but a group they belong to has been granted access. Which identity concept describes this scenario?

Accepted Answer

Group-based access control. Group-based access control allows permissions to be assigned to groups rather than individuals, simplifying management. Option A is wrong because role-based access control is a specific type of group-based access using roles. Option B is wrong because privilege escalation refers to gaining higher permissions, not normal access via groups. Option D is wrong because attribute-based access control uses user attributes, not group membership.

Answer

Role-based access control (RBAC)

Answer

Privilege escalation

Answer

Attribute-based access control (ABAC)