SC-900 Describe the concepts of security, compliance, and identity Practice Test 15 — 15 Questions

Question 1

An organization uses Microsoft Intune to manage devices. They want to ensure that only devices that are compliant with security policies (e.g., encryption enabled, latest patches) can access corporate email. Which Microsoft Entra feature should they use to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access in Microsoft Entra ID. Conditional Access in Microsoft Entra ID allows administrators to create policies that enforce access controls based on conditions such as device compliance, as reported by Intune. Only devices that satisfy the compliance requirements (e.g., encryption enabled, latest patches) are granted access to corporate email. Option B (Microsoft Defender for Endpoint) focuses on threat detection and response, not access enforcement. Option C (Device compliance policies in Microsoft Intune) defines the compliance criteria and marks devices as compliant or non-compliant, but it does not enforce access at the application level—that enforcement is done by Conditional Access. Option D (Azure AD Join) is a device identity registration method, not an access control mechanism.

Answer

Microsoft Defender for Endpoint

Answer

Device compliance policies in Microsoft Intune

Answer

Azure AD Join

Question 2

A company is designing a data governance strategy using Microsoft Purview. They need to allow data owners to define custom attributes for data assets and control who can access those assets. Which Purview feature should they use?

Accepted Answer

Microsoft Purview Data Catalog. Microsoft Purview Data Catalog allows data owners to manage custom attributes and set access controls on data assets. Option A is wrong because Data Estate Insights provides monitoring, not governance. Option B is wrong because Data Policy enables policies on data sources, not asset-level custom attributes. Option D is wrong because Data Map is the underlying metadata store, not for end-user governance.

Answer

Microsoft Purview Data Estate Insights

Answer

Microsoft Purview Data Policy

Answer

Microsoft Purview Data Map

Question 3

Which TWO of the following are benefits of using Microsoft Entra ID for identity management?

Accepted Answer

Single sign-on (SSO) to cloud applications. Single sign-on (SSO) and multi-factor authentication (MFA) are key benefits of Entra ID. Password hash synchronization is a feature of Entra Connect, not a direct benefit. On-premises Active Directory is a separate service. Security incident detection is more aligned with Microsoft Sentinel or Defender.

Answer

Password hash synchronization

Answer

Automated security incident detection

Answer

Replacement of on-premises Active Directory

Question 4

Refer to the exhibit. An administrator deploys this Azure Resource Manager template. Which TWO of the following statements are true?

Accepted Answer

The policy assignment audits whether SQL Database transparent data encryption is enabled.. The policy definition ID corresponds to 'Audit if SQL Database encryption is not enabled'. The effect is 'AuditIfNotExists', so it audits but does not enforce. The assignment is at subscription/management group scope, not resource group. It does not deploy a resource but assigns a policy.

Answer

The template creates a resource group if it does not exist.

Answer

The policy assignment enforces encryption on existing SQL databases.

Answer

The template deploys a new SQL database.

Question 5

Which THREE of the following are components of the Zero Trust security model?

Accepted Answer

Use least privilege access. The three core principles of Zero Trust are: verify explicitly, use least privilege access, and assume breach. Network perimeter security is a traditional model, not Zero Trust. Single sign-on is a convenience feature, not a core principle.

Answer

Single sign-on (SSO)

Answer

Network perimeter security

Question 6

Refer to the exhibit. A security administrator is reviewing an Azure Resource Manager template for a virtual machine. What is the purpose of the 'identity' section shown?

Accepted Answer

It assigns a user-assigned managed identity to the VM so it can access other Azure resources securely.. The 'identity' section in this Azure Resource Manager template assigns a user-assigned managed identity to the virtual machine. The 'type' is set to 'UserAssigned' and the 'userAssignedIdentities' property references an existing managed identity by its resource ID. This allows the VM to authenticate to Azure services without storing credentials, using the specified identity. Option D is correct because it accurately describes this behavior.

Answer

It enables system-assigned managed identity for the VM.

Answer

It configures multi-factor authentication for the VM.

Answer

It creates a new managed identity named 'id1' in the resource group.

Question 7

Refer to the exhibit. A security analyst runs this Microsoft Graph PowerShell command. What is the most likely purpose of this command?

Accepted Answer

To find users whose user principal name starts with 'j'.. The command uses the Get-MgUser cmdlet with a -Filter parameter to retrieve users whose userPrincipalName starts with 'j'. The -Select parameter limits the output to specific properties. Therefore, option A correctly identifies the purpose. Option B is incorrect because no update operations (e.g., Update-MgUser) are used. Option C is incorrect because no removal operations (e.g., Remove-MgUser) are used. Option D is incorrect because the command filters by userPrincipalName and does not display group membership.

Answer

To update the display names of users starting with 'j'.

Answer

To remove users whose user principal name starts with 'j'.

Answer

To list all users and their group memberships.

Question 8

Refer to the exhibit. A security analyst runs this Kusto Query Language (KQL) query in Microsoft Sentinel. What is being identified?

Accepted Answer

Sign-in attempts by disabled user accounts.. The query filters sign-in logs from the last day with ResultType 50057, which indicates that the user account is disabled. Therefore, the query is identifying sign-in attempts by disabled user accounts. Option A is incorrect because MFA failures have different result types (e.g., 500121, 50074). Option B is incorrect because successful sign-ins have ResultType 0. Option C is incorrect because unknown IP addresses are not identified by ResultType 50057; they would involve other fields or result types.

Answer

Multi-factor authentication failures.

Answer

Successful sign-ins in the last day.

Answer

Sign-in attempts from unknown IP addresses.

Question 9

A company wants to ensure that all users access corporate resources using multi-factor authentication (MFA). Which Microsoft Entra ID feature should they configure to enforce MFA for all users?

Accepted Answer

Conditional Access. Conditional Access policies allow granular control over authentication requirements, including MFA enforcement. Security defaults provide basic MFA but are less flexible. Identity Protection detects risks but does not enforce MFA directly. Privileged Identity Management manages roles, not MFA enforcement.

Answer

Privileged Identity Management

Answer

Identity Protection

Answer

Security defaults

Question 10

An organization uses Microsoft Purview to manage data compliance. They need to automatically detect and protect credit card numbers stored in SharePoint Online. Which Microsoft Purview solution should they implement?

Accepted Answer

Microsoft Purview Data Loss Prevention. Data Loss Prevention (DLP) policies can identify sensitive data like credit card numbers and apply protection actions such as blocking access. Information Protection (sensitivity labels) classifies data but does not automatically detect and protect specific patterns like credit card numbers without DLP integration.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Lifecycle Management

Question 11

A security analyst needs to investigate a potential ransomware attack affecting multiple endpoints. They want to centralize detection and response across devices, email, and applications. Which Microsoft solution should they use?

Accepted Answer

Microsoft 365 Defender (now Microsoft Defender XDR). Microsoft Defender XDR (formerly Microsoft 365 Defender) provides unified detection and response across endpoints, email, identities, and applications. Microsoft Sentinel is a SIEM for broader security data. Defender for Cloud is for cloud workloads. Defender for Endpoint only covers endpoints.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud

Question 12

Which Microsoft Entra ID feature allows an organization to provide external partners with access to its applications while maintaining control over authentication and governance?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (including B2B collaboration) enables secure sharing of apps with external users. It allows the organization to manage identities and enforce policies like MFA for guests.

Answer

Microsoft Entra ID Governance

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Permissions Management

Question 13

A company requires that all sensitive data in Microsoft Teams messages be automatically encrypted and labeled with a 'Confidential' tag. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection includes sensitivity labels that can be auto-applied to sensitive data in Teams messages. DLP policies can detect data but do not apply labels directly. Data Lifecycle Management handles retention. Compliance Manager is for assessments.

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Compliance Manager

Question 14

An organization wants to use a cloud-based SIEM to collect security data from multiple sources, including on-premises servers and cloud applications. Which Microsoft solution should they choose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM that can ingest data from various sources. Defender for Cloud is for cloud security posture management. Microsoft 365 Defender is for detection and response across Microsoft 365. Intune is for device management.

Answer

Microsoft Intune

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Cloud

Question 15

A company uses Microsoft Purview to classify and protect data. They need to ensure that when a user attempts to share a file containing a credit card number externally, the file is blocked and the user is prompted with a policy tip. Which type of Microsoft Purview policy should they configure?

Accepted Answer

Data Loss Prevention (DLP) policy. DLP policies can detect sensitive data like credit card numbers and enforce actions such as blocking sharing with a policy tip. Sensitivity labels require manual application or auto-labeling, but the block action is defined by DLP. Insider Risk Management focuses on risky user activities.

Answer

Retention policy

Answer

Insider Risk Management policy

Answer

Sensitivity label policy