SC-900 Describe the concepts of security, compliance, and identity Practice Test 2 — 15 Questions

Question 1

A small business uses Microsoft 365 Business Premium. The owner wants to ensure that employees can access their email and files from anywhere, but only from trusted devices that comply with company security policies (e.g., have antivirus enabled and are up-to-date). They have heard about Microsoft Intune but are not sure if it's included. You need to recommend a solution that enforces device compliance for accessing company data. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Microsoft Intune to create device compliance policies and a Conditional Access policy to require compliant devices. Microsoft 365 Business Premium includes Microsoft Intune, which is essential for managing devices and defining compliance policies. Option C is correct because it combines Intune to create device compliance policies (e.g., requiring antivirus and up-to-date OS) with Conditional Access to enforce these policies, ensuring only compliant devices can access company data. Option A is wrong because while Conditional Access can require managed devices, it relies on a device management solution like Intune to define and report device compliance, which is not fully addressed by just configuring Conditional Access. Option B is wrong because requiring all devices to be domain-joined is a traditional on-premises approach that is often impractical for a small business with remote access needs and personal devices. Option D is wrong because Security Defaults provide a baseline for identity security (such as requiring multi-factor authentication) but do not enforce device compliance or check for device health attributes like antivirus status or update levels.

Answer

Configure Conditional Access to require managed devices

Answer

Require all employees to use company-issued devices that are domain-joined

Answer

Enable Security Defaults in Entra ID

Question 2

A company is planning to use Copilot for Microsoft 365. To ensure that Copilot responses are based only on data accessible to the user, which principle must be enforced?

Accepted Answer

User permissions and access controls are respected. Copilot for Microsoft 365 uses the user's existing permissions to determine which content it can access. Option A is incorrect because Copilot does not automatically grant users access to data; it operates within existing user permissions. Option C is incorrect because while data is indexed, Copilot's access to that data for a specific user is always governed by that user's existing permissions, meaning not all organizational data is available to every user. Option D is incorrect because the storage location of data is not the principle that ensures Copilot responses are based only on data accessible to the user; rather, it is the enforcement of user permissions.

Answer

Copilot automatically grants access to all data

Answer

All organizational data is indexed and available to Copilot

Answer

Data must be stored in a specific location

Question 3

You work for a healthcare organization that uses Microsoft 365 E5 licenses. The organization must comply with HIPAA regulations. You need to ensure that electronic protected health information (ePHI) is classified and protected. Specifically, you want to automatically detect and apply a 'Highly Confidential' sensitivity label to documents containing medical record numbers, and also prevent users from sharing these documents externally via email. You have Microsoft Purview deployed. What should you implement first?

Accepted Answer

Create a sensitive information type for medical record numbers, then an auto-labeling policy to apply a sensitivity label, and finally a DLP policy to block external sharing of labeled documents.. To meet the requirements, first create a sensitive information type (SIT) for medical record numbers. Then create an auto-labeling policy that uses that SIT to apply the 'Highly Confidential' sensitivity label, and finally create a DLP policy to block external sharing of documents with that label. Option A is incorrect because it relies on custom keywords instead of a SIT and does not apply a sensitivity label. Option B is incorrect because it skips the required first step of creating a SIT; without a SIT, the auto-labeling policy cannot reliably detect medical record numbers, and auto-labeling alone does not block external sharing. Option C is incorrect because it skips the SIT and does not apply the 'Highly Confidential' sensitivity label; detecting medical record numbers and blocking sharing is only part of the solution.

Answer

Create a DLP policy that blocks external sharing of any document with a custom keyword.

Answer

Create an auto-labeling policy that applies a sensitivity label to documents with medical record numbers.

Answer

Create a DLP policy that detects medical record numbers and blocks external sharing.

Question 4

Your organization wants to ensure that only users with a specific sensitivity label can access a SharePoint site. Which Microsoft Purview feature should you configure?

Accepted Answer

Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) provides sensitivity labels that can be applied to content and can enforce encryption and access restrictions. By configuring a sensitivity label with encryption settings and applying it to a SharePoint site, you can ensure that only users with that label can access the site's content. This is done through label policies and site-level label integration.

Answer

Insider Risk Management

Answer

Communication Compliance

Answer

Data Lifecycle Management

Question 5

An organization wants to classify and label data automatically based on sensitive content patterns such as credit card numbers. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the solution designed to identify, classify, and protect sensitive information using sensitive information types (SITs) such as credit card numbers, and to apply policies that prevent accidental sharing. DLP policies can detect credit card patterns and automatically block, warn, or restrict sharing of that content.

Answer

eDiscovery

Answer

Compliance Manager

Answer

Audit

Question 6

Your company uses Microsoft Intune for device management. You need to ensure that all company data on a user's personally owned device is removed when the user is offboarded, but the user's personal data should remain. Which wipe action should you use?

Accepted Answer

Selective wipe. Selective wipe (also known as selective wipe or company data removal) removes only corporate data, applications, and policies from a device while leaving personal data intact. This is the correct action when offboarding a user from a personally owned device (BYOD) and you need to preserve their personal content. Full wipe would erase the entire device, and Retire removes management but does not necessarily remove company data.

Answer

Delete

Answer

Full wipe

Answer

Retire

Question 7

You find a JSON representation of a sensitivity label in a SharePoint document's metadata. The label indicates encryption is applied and access is restricted to finance@contoso.com. Based on this information, what is the effect of the label applied to the document?

Accepted Answer

The document is encrypted and can only be accessed by users in the finance@contoso.com group. A sensitivity label that specifies encryption and scopes access to finance@contoso.com means the document is encrypted (via Azure Rights Management) and only members of that group can decrypt and open it. The label's protection settings are enforced by the Purview Information Protection service, so unauthorized users see an access-denied message even if they can see the file in SharePoint.

Answer

The document is only marked as confidential but not encrypted

Answer

The document is encrypted and can be accessed by any user with the decryption key

Answer

The document will be retained for a specified period

Question 8

A company wants to ensure that only users with appropriate permissions can access sensitive data stored in Microsoft SharePoint Online. Which principle should they implement?

Accepted Answer

Apply the principle of least privilege. The principle of least privilege states that users should be granted only the minimum access rights necessary to perform their job functions, which directly addresses the requirement to restrict sensitive SharePoint Online data to appropriately permissioned users. It is the foundational access-control principle that governs how permissions should be scoped in Microsoft 365. RBAC, MFA, and defense in depth are complementary controls, but least privilege is the specific principle that limits who can reach the data.

Answer

Assign roles based on job function using role-based access control (RBAC)

Answer

Enable multi-factor authentication (MFA) for all users

Answer

Implement defense in depth

Question 9

A small business wants to enable single sign-on (SSO) for its employees using their existing on-premises Active Directory. They plan to migrate to cloud-based identity management. Which Microsoft service should they use to connect their on-premises directory to Microsoft Entra ID?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct choice because it is the primary tool designed to integrate on-premises Active Directory Domain Services (AD DS) with Microsoft Entra ID, enabling synchronized identities and single sign-on (SSO). It supports multiple authentication methods, including password hash synchronization, pass-through authentication, and federation with AD FS, allowing a small business to leverage existing AD credentials for cloud services. This directly addresses the requirement to connect on-premises directory to Entra ID for SSO.

Answer

Microsoft Intune

Answer

Active Directory Federation Services (AD FS)

Answer

Microsoft Entra Cloud Sync

Question 10

A company is designing a data governance strategy using Microsoft Purview. They need to allow data owners to define custom attributes for data assets and control who can access those assets. Which Purview feature should they use?

Accepted Answer

Microsoft Purview Data Catalog. Microsoft Purview Data Catalog is the feature that lets data owners and stewards annotate data assets with custom attributes (business terms, classifications, contacts, descriptions) and apply access policies through the catalog's governance experience. It provides the business-friendly view of the data estate where owners define metadata and control who can discover and access assets. The Data Catalog is built on top of the Data Map but adds the curation and access-control layer the question requires.

Answer

Microsoft Purview Data Estate Insights

Answer

Microsoft Purview Data Policy

Answer

Microsoft Purview Data Map

Question 11

Refer to the exhibit. An administrator deploys this Azure Resource Manager template. Which TWO of the following statements are true?

Accepted Answer

The policy assignment audits whether SQL Database transparent data encryption is enabled.. Option D is correct because the template contains a policy assignment whose policy definition targets SQL Database transparent data encryption (TDE) and uses the audit effect, so it evaluates and reports on TDE status rather than enforcing it. Option E is correct because Azure Policy assignments can be scoped to a subscription or management group (as well as a resource group), and the template's policy assignment is deployed at a scope that supports these broader targets. Option A is not correct because an ARM template deployment does not create the resource group it is deployed into; the resource group must already exist. Option B is not correct because the policy uses the audit effect, which only reports non-compliance and does not enforce or remediate encryption on existing SQL databases. Option C is not correct because the template does not define a Microsoft.Sql/servers/databases resource, so no new SQL database is deployed.

Answer

The template creates a resource group if it does not exist.

Answer

The policy assignment enforces encryption on existing SQL databases.

Answer

The template deploys a new SQL database.

Question 12

Refer to the exhibit. A security administrator is reviewing an Azure Resource Manager template for a virtual machine. What is the purpose of the 'identity' section shown?

Accepted Answer

It assigns a user-assigned managed identity to the VM so it can access other Azure resources securely.. The 'identity' section in an ARM template defines the managed identity configuration for the resource. When it specifies a user-assigned identity (typically via the 'userAssignedIdentities' property with a resource ID), it attaches that pre-existing managed identity to the VM. This allows the VM to authenticate to other Azure services (like Key Vault or Storage) without storing credentials in code, using Microsoft Entra ID token-based authentication. The correct option captures this exact purpose: assigning a user-assigned managed identity for secure access to other resources.

Answer

It enables system-assigned managed identity for the VM.

Answer

It configures multi-factor authentication for the VM.

Answer

It creates a new managed identity named 'id1' in the resource group.

Question 13

Refer to the exhibit. A security analyst runs this Kusto Query Language (KQL) query in Microsoft Sentinel. What is being identified?

Accepted Answer

Sign-in attempts by disabled user accounts.. The KQL query in Microsoft Sentinel is designed to identify sign-in attempts by disabled user accounts. This is typically done by joining sign-in logs with user account status information and filtering for accounts that are disabled but still attempting authentication. The query likely uses tables like SigninLogs and AADUserAccounts, checking for disabled status.

Answer

Multi-factor authentication failures.

Answer

Successful sign-ins in the last day.

Answer

Sign-in attempts from unknown IP addresses.

Question 14

A company wants to ensure that all users access corporate resources using multi-factor authentication (MFA). Which Microsoft Entra ID feature should they configure to enforce MFA for all users?

Accepted Answer

Conditional Access. Conditional Access is the Microsoft Entra ID feature that allows administrators to create granular policies that enforce MFA for all users based on conditions such as user group, application, location, and device state. It provides the flexibility to require MFA universally while excluding specific scenarios if needed, and it is the recommended method for enforcing MFA in a controlled manner. Security defaults also enforce MFA but are a simpler, all-or-nothing setting primarily for tenants without Conditional Access licenses, and they cannot be customized.

Answer

Privileged Identity Management

Answer

Identity Protection

Answer

Security defaults

Question 15

Which TWO of the following are components of the Microsoft Security Development Lifecycle (SDL)? (Choose two.)

Accepted Answer

Security training. The explanation for option A ('Penetration testing is part of security validation but is not an SDL phase.') is misleading. Penetration testing is explicitly listed as a key practice within the SDL's Verification phase in Microsoft's official documentation and SC-900 learning paths. If Threat modeling (E), which is a practice within the Design phase, is considered a 'core phase' or component, then Penetration testing (A) should also be considered a component. The explanation for E also imprecisely calls Threat modeling a 'core phase' instead of a core practice or component within a phase. Both Security training (C) and Threat modeling (E) are indeed core to the SDL, but so is Penetration testing (A) as a critical verification activity.

Answer

Penetration testing

Answer

Data classification

Answer

Code signing