SC-900 Describe the concepts of security, compliance, and identity Practice Test 16 — 15 Questions

Question 1

An organization wants to use a cloud-based SIEM to collect security data from multiple sources, including on-premises servers and cloud applications. Which Microsoft solution should they choose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR solution, built on Azure and designed to ingest security data from multiple sources — including on-premises servers via agents, cloud applications via connectors, and Microsoft 365/Azure services. It provides analytics rules, incident management, workbooks, and automation playbooks, making it the correct choice for a cloud-based SIEM.

Answer

Microsoft Intune

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Cloud

Question 2

A company uses Microsoft Purview to classify and protect data. They need to ensure that when a user attempts to share a file containing a credit card number externally, the file is blocked and the user is prompted with a policy tip. Which type of Microsoft Purview policy should they configure?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies in Microsoft Purview are designed to detect sensitive information types such as credit card numbers and take action — blocking sharing, showing policy tips, or restricting access. DLP policies evaluate content in Exchange, SharePoint, OneDrive, Teams, and endpoints, and can trigger user notifications when a policy match occurs. This directly satisfies the requirement to block external sharing and prompt the user.

Answer

Retention policy

Answer

Insider Risk Management policy

Answer

Sensitivity label policy

Question 3

An organization wants to enable passwordless authentication for its users by using a mobile app. Which Microsoft Entra ID authentication method should they implement?

Accepted Answer

Microsoft Authenticator (passwordless sign-in). Microsoft Authenticator's passwordless sign-in feature allows users to authenticate using their phone's biometric or PIN instead of a password, satisfying the requirement for passwordless authentication via a mobile app. It works by binding the user's account to the Authenticator app, which then receives push notifications or generates one-time codes for sign-in. This is the only option that specifically uses a mobile app as the authentication method.

Answer

Temporary Access Pass

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Question 4

A company uses Microsoft Defender for Cloud to secure its hybrid cloud environment. They need to continuously assess compliance with regulatory standards like ISO 27001 and receive recommendations for remediation. Which feature should they enable?

Accepted Answer

Defender for Cloud’s regulatory compliance dashboard. Microsoft Defender for Cloud's regulatory compliance dashboard continuously assesses resources against built-in or custom standards such as ISO 27001, PCI DSS, and NIST, showing compliance posture and providing remediation recommendations. This directly matches the requirement to assess compliance with regulatory standards and receive remediation guidance.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Answer

Defender for Cloud’s Secure Score

Question 5

Which THREE of the following are core principles of the Zero Trust security model? (Choose three.)

Accepted Answer

Verify explicitly. Option A (Verify explicitly) is correct because Zero Trust requires every access request to be authenticated and authorized based on all available data points, including user identity, device health, location, and resource sensitivity, rather than granting implicit trust based on network location. Option C (Assume breach) is correct because Zero Trust operates on the premise that threats may already exist inside the environment, so organizations must minimize blast radius, segment access, encrypt traffic, and use analytics to detect and respond to anomalies. Option D (Least privilege) is correct because Zero Trust limits user and workload access to only what is needed for the task, using just-in-time and just-enough-access policies to reduce lateral movement. Option B (Trust but verify) is not a Zero Trust principle; it reflects a traditional perimeter-based mindset where trust is initially granted and then checked, which contradicts Zero Trust's explicit verification of every request. Option E (Single factor authentication) is not a Zero Trust principle; Zero Trust strongly favors strong authentication such as multifactor authentication and phishing-resistant methods, not single-factor authentication.

Answer

Trust but verify

Answer

Single factor authentication

Question 6

Your organization is implementing a new policy to ensure that only authorized users can access sensitive financial data stored in Microsoft SharePoint Online. The security team wants to enforce multi-factor authentication (MFA) for all users accessing this data, but only when accessing from outside the corporate network. Which Microsoft Entra ID conditional access policy setting should you configure to meet this requirement?

Accepted Answer

Grant access requiring multi-factor authentication when the location is not trusted. The requirement is to enforce MFA for all users accessing sensitive financial data in SharePoint Online, but only when accessing from outside the corporate network. This is achieved by creating a Conditional Access policy that targets the SharePoint Online app, includes all users, and sets the condition to 'any location' excluding trusted locations, then grants access with the requirement of multi-factor authentication.

Answer

Use app-enforced restrictions for SharePoint

Answer

Grant access requiring device to be marked as compliant when location is not trusted

Answer

Block access when the location is not trusted

Question 7

A company wants to implement a Zero Trust security model. Which TWO of the following are core principles of Zero Trust?

Accepted Answer

Verify explicitly. Option B (Verify explicitly) is correct because Zero Trust requires every access request to be authenticated and authorized based on all available data points—user identity, device health, location, and workload—rather than assuming trust from network position. Option E (Least privilege access) is correct because Zero Trust limits user and workload access to only what is needed for the task, typically enforced through just-in-time and just-enough-access policies and micro-segmentation. Option A (Trust based on network location) is wrong because Zero Trust explicitly rejects the idea that being inside a corporate network grants trust. Option C (Perimeter-based security) is wrong because Zero Trust moves away from a castle-and-moat perimeter model toward identity-centric controls. Option D (Implicit trust for internal users) is wrong because Zero Trust assumes breach and requires continuous verification, never granting implicit trust to internal users.

Answer

Trust based on network location

Answer

Perimeter-based security

Answer

Implicit trust for internal users

Question 8

A company is implementing data classification in Microsoft Purview. Which THREE of the following are types of sensitive information that can be detected using built-in sensitive information types?

Accepted Answer

Passport numbers. Microsoft Purview ships with numerous built-in sensitive information types (SITs) that use pattern matching, checksums, and keyword evidence to detect common regulated data. Option A (Passport numbers) is correct because Purview includes built-in SITs for passport numbers of multiple countries (for example, U.S. and EU passport formats). Option B (Social security numbers) is correct because the U.S. Social Security Number (SSN) SIT is a core built-in type that matches the 3-2-4 digit pattern with additional validation. Option C (Credit card numbers) is correct because Purview provides built-in SITs for major card brands (Visa, Mastercard, American Express, Discover) that validate the number using the Luhn algorithm. Options D (Favorite color) and E (Project codenames) are not built-in SITs; these are arbitrary, organization-specific data elements that would require custom sensitive information types or trainable classifiers to detect.

Answer

Favorite color

Answer

Project codenames

Question 9

You are reviewing a conditional access policy in Microsoft Entra ID. The policy is enabled, applies to all cloud apps, and is configured to include users assigned to the Global Administrator or Exchange Administrator roles. Which users are affected by this policy?

Accepted Answer

All users who are members of the Global Administrator or Exchange Administrator role. The conditional access policy includes users assigned to the Global Administrator or Exchange Administrator roles. Therefore, only users with those specific roles are affected. It does not include all administrative roles or all users in the organization.

Answer

All users who are members of any Azure AD administrative role

Answer

All users who are members of the Global Administrator role only

Answer

All users in the organization

Question 10

Contoso Ltd. is a financial services company that must comply with strict regulatory requirements. They use Microsoft 365 E5, Microsoft Entra ID P2, Microsoft Purview, and Microsoft Defender for Cloud Apps. The compliance team needs to implement a data loss prevention (DLP) policy that detects and prevents the sharing of credit card numbers in Microsoft Teams messages. Additionally, they want to ensure that only users with a specific custom sensitivity label can access documents containing credit card numbers. The sensitivity label is named 'Financial-Confidential' and is applied automatically via auto-labeling. The DLP policy should block sharing of credit card numbers in Teams but allow users to override the block with a business justification. Which combination of actions should you configure in the Microsoft Purview DLP policy to meet these requirements?

Accepted Answer

Create a DLP policy in Microsoft Purview that blocks sharing of credit card numbers in Teams and allows overrides with business justification. Configure the policy to apply to content containing the 'Financial-Confidential' sensitivity label.. A Microsoft Purview DLP policy can detect credit card numbers in Teams messages and block sharing while allowing users to override with a business justification. Scoping the DLP policy to content containing the 'Financial-Confidential' sensitivity label applies the policy only to content with that label; it does not by itself restrict document access to only users with that label. Restricting access based on a sensitivity label requires a sensitivity label policy with encryption and access permissions. Therefore, option C addresses the Teams DLP requirement but does not fully implement the label-based access control; a separate sensitivity label policy would also be required.

Answer

Create a DLP policy in Microsoft Purview that blocks sharing of credit card numbers in Teams and does not allow overrides. Configure the policy to apply to all content.

Answer

Configure a session policy in Microsoft Defender for Cloud Apps that monitors Teams for credit card numbers and blocks sharing. Use the 'Block with override' action.

Answer

Use the built-in DLP template for financial data in Microsoft Purview and enable the 'Block with override' action. Set the scope to Teams.

Question 11

Fabrikam Inc. is a global manufacturing company that uses Microsoft Entra ID for identity management. They have recently experienced a security incident where an attacker compromised a user account and accessed sensitive intellectual property. The security team wants to implement identity protection measures to detect and respond to such attacks in the future. They need a solution that can automatically detect suspicious sign-in behavior, such as impossible travel and anomalous token issuance, and then take action to block the sign-in or require additional verification. Additionally, they want to integrate threat intelligence feeds to improve detection. Which Microsoft security solution should they use to meet these requirements?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection uses machine learning to detect risks like impossible travel and anomalous token issuance, and can automatically enforce policies such as requiring MFA or blocking sign-ins. It also integrates with threat intelligence feeds. Option A is wrong because Microsoft Defender for Identity focuses on on-premises Active Directory, not cloud sign-ins. Option C is wrong because Microsoft Sentinel is a SIEM, not an automated response tool for sign-in risks. Option D is wrong because Microsoft Defender for Cloud Apps is for cloud app discovery and control, not primarily for sign-in risk detection.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 12

A new security administrator is learning about core security concepts. They ask you to explain the difference between authentication and authorization. Which statement best describes authorization?

Accepted Answer

It is the process of determining what resources an authenticated user is permitted to access.. Authorization is the process of determining what an authenticated user is allowed to do. After authentication verifies identity, authorization checks permissions and policies to grant or deny access to resources. The other options describe authentication, encryption, and auditing, which are distinct security concepts. Understanding this distinction is fundamental in Microsoft identity and access management.

Answer

It is the process of verifying a user's identity by checking their credentials.

Answer

It is the process of auditing and logging user activity for compliance purposes.

Answer

It is the process of encrypting data both at rest and in transit.

Question 13

A financial services company is adopting a Zero Trust security model. The security team must implement controls that align with the principle of least privilege. Which two practices should they implement? (Choose two.)

Accepted Answer

Assign users the minimum permissions required to perform their job duties.. Least privilege requires that users have only the minimum access necessary to perform their tasks. Assigning minimum permissions and using just-in-time access for privileged roles both enforce this principle. The other options either grant excessive access or weaken authentication, which are contrary to Zero Trust and least privilege. These two practices help limit the blast radius of a potential compromise.

Answer

Disable multifactor authentication to streamline the user experience.

Answer

Grant all employees permanent administrator rights to simplify IT support.

Answer

Allow all users to access all company data to foster collaboration.

Question 14

A multinational corporation wants to ensure that its data handling practices comply with GDPR when processing personal data of European Union citizens. The compliance team is reviewing the concept of data residency. Which statement accurately describes data residency?

Accepted Answer

Data residency refers to the physical or geographic location where data is stored.. Data residency is about the geographic location where data is stored. For GDPR compliance, organizations may need to ensure that personal data of EU citizens remains within certain regions. The other options describe data subject rights, encryption, and data portability, which are related but distinct compliance concepts. Understanding data residency helps in designing compliant cloud architectures.

Answer

Data residency refers to the legal right of individuals to access their personal data.

Answer

Data residency refers to the ability to move data freely between cloud providers.

Answer

Data residency refers to the process of encrypting data to protect it from unauthorized access.

Question 15

A healthcare organization must comply with HIPAA regulations to protect patient data. The compliance team needs to implement a solution that helps them assess their compliance posture, provides a compliance score, and offers actionable improvement actions. Which Microsoft service should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the appropriate tool because it specifically provides compliance assessments, a compliance score, and improvement actions for regulatory standards such as HIPAA. Other services like Defender for Cloud Apps, Entra ID Protection, and Intune focus on security controls and device management but do not offer compliance posture assessment against frameworks.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps