SC-900 Hard Questions — 25 Difficult Questions

Question 1

A company must comply with the General Data Protection Regulation (GDPR). They need a unified solution that provides a compliance score, actionable recommendations to improve their security posture, and the ability to track their progress over time. Additionally, they want to assign improvement actions to specific teams and automate the collection of evidence for controls. Which two Microsoft Purview solutions should the administrator use? (Select two.)

Accepted Answer

Compliance Manager. Compliance Manager is correct because it provides a unified compliance score, actionable recommendations to improve security posture, and the ability to track progress over time. It also allows administrators to assign improvement actions to specific teams and automate evidence collection for controls, directly meeting all the stated GDPR compliance requirements.

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Question 2

A company uses Salesforce and Box as cloud apps. The security team discovers that a third-party OAuth app with excessive permissions was granted access to Salesforce data by a user. They want a solution that can detect such risky OAuth apps and automatically revoke their permissions based on policy. Which Microsoft security solution provides this capability?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is a Cloud Access Security Broker (CASB) that provides visibility into third-party OAuth apps connected to cloud services like Salesforce and Box. It can detect OAuth apps with excessive permissions and automatically revoke them based on conditional access or app governance policies, making it the correct solution for this scenario.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 3

A security operations team uses Microsoft 365 Defender and wants to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, such as Pass-the-Hash (PtH) and Golden Ticket attacks. They also need to integrate these alerts into Microsoft Sentinel for central incident management. Which Microsoft security solution provides these capabilities?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct answer because it is specifically designed to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, including Pass-the-Hash (PtH) and Golden Ticket attacks. It uses behavioral analytics and machine learning to identify suspicious activities such as anomalous Kerberos ticket requests and NTLM authentication anomalies. MDI also natively integrates with Microsoft Sentinel, allowing alerts to be ingested for central incident management.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Question 4

A security architect is designing a new security posture based on the Zero Trust model. The architect wants to ensure that every access request is fully authenticated, authorized, and encrypted before granting access, and that access is granted only to the minimum necessary resources. Which three principles of Zero Trust align with these requirements? (Choose three.)

Accepted Answer

Verify explicitly. Option A is correct because the 'Verify explicitly' principle of Zero Trust requires that every access request must be fully authenticated, authorized, and encrypted before granting access. This means using strong authentication mechanisms (e.g., multifactor authentication) and continuous validation of identity and device health, not just relying on network location or implicit trust.

Answer

Network segmentation

Question 5

A company uses Microsoft Entra ID and has multiple departments with separate organizational units (OUs) in its on-premises Active Directory. The help desk team needs to be able to reset passwords for users only in the Finance department. What feature should be used to delegate this administrative scope?

Accepted Answer

Administrative Units. Administrative Units (AUs) in Microsoft Entra ID allow you to delegate administrative permissions over a subset of users, groups, or devices without granting broader tenant-wide access. By creating an AU for the Finance department and assigning the Helpdesk Administrator role scoped to that AU, the help desk team can reset passwords only for Finance users, matching the on-premises OU structure.

Answer

Dynamic groups

Answer

Conditional Access policies

Answer

Privileged Identity Management (PIM)

Question 6

A financial services company must comply with a regulation that requires all audit-related documents to be retained for 7 years and then permanently deleted. The compliance officer wants to ensure that even if a user modifies or deletes a file, the original content is preserved for the full 7 years, and at the end of the period the files are automatically destroyed without any manual approval. The company uses Microsoft 365 and stores these documents in SharePoint Online and Microsoft Teams. Which Microsoft Purview solution should the compliance officer configure?

Accepted Answer

Microsoft Purview Data Lifecycle Management using a retention policy configured to retain items for 7 years and then delete them automatically. Option C is correct because Microsoft Purview Data Lifecycle Management allows you to create a retention policy that retains items for a fixed period (7 years) and then automatically deletes them without any manual intervention. This meets the regulatory requirement for automatic destruction at the end of the retention period, and the policy applies to both SharePoint Online and Microsoft Teams, preserving the original content even if a user modifies or deletes the file.

Answer

Microsoft Purview Retention Labels with a disposition review that requires manual approval at the end of the retention period

Answer

Microsoft Purview Retention Policy with a record label to mark items as regulatory records

Answer

Microsoft Purview eDiscovery with a hold policy to preserve the documents indefinitely

Question 7

A company uses Microsoft 365 E5. An employee's corporate laptop is infected with keylogging malware that captures the employee's credentials. The attacker uses these credentials to sign in to Exchange Online and forward sensitive emails to an external account. Under the shared responsibility model, who is primarily responsible for the security incident?

Accepted Answer

The customer is responsible because they control user devices, accounts, and access policies.. Under the shared responsibility model, the customer is responsible for securing user devices, managing user accounts, and configuring access policies. In this scenario, the keylogging malware on the employee's corporate laptop is a customer-side endpoint security issue, and the attacker used stolen credentials to access Exchange Online. Microsoft is responsible for the security of the cloud infrastructure (e.g., physical data centers, network, and hypervisor), but not for threats originating from compromised customer-managed devices or user accounts.

Answer

Microsoft is responsible because they provide the cloud service and must protect against all threats.

Answer

Both Microsoft and the customer share equal responsibility for all layers of the service.

Answer

Neither party is responsible because the employee bypassed security controls.

Question 8

A company uses a third-party SaaS CRM application. The security team needs to monitor user sessions in real-time when sales representatives access the CRM from personal, unmanaged devices. The goal is to prevent the download of sensitive customer data to local drives. The solution should block download actions and show a warning to the user. Which Microsoft security solution should the team deploy to enforce these session controls?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) provides session-level controls via its Conditional Access App Control feature. This allows real-time monitoring and control of user sessions in third-party SaaS apps like CRM, enabling actions such as blocking downloads and displaying warnings based on device compliance (e.g., unmanaged devices). The solution integrates with Azure AD Conditional Access to enforce these policies at the session layer without modifying the underlying SaaS application.

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Question 9

A company uses an on-premises Active Directory (AD) and wants to enable single sign-on (SSO) for users to access Microsoft 365 and a third-party SaaS application. They plan to use an external identity provider (IdP) that supports Security Assertion Markup Language (SAML) 2.0. Which identity concept does this implementation primarily rely on?

Accepted Answer

Federation. Federation is the correct answer because it establishes a trust relationship between the on-premises Active Directory and the external identity provider (IdP) using SAML 2.0, enabling users to authenticate once and gain access to both Microsoft 365 and the third-party SaaS application without re-entering credentials. This relies on the IdP issuing SAML assertions that are trusted by the relying parties (Microsoft 365 and the SaaS app), which is the core mechanism of federated identity.

Answer

Provisioning

Answer

Synchronization

Answer

Directory extension

Question 10

A company wants to monitor employee communications in Microsoft Teams and Exchange Online for potential policy violations such as harassment or inappropriate sharing of confidential information. They need a solution that allows them to define policies, review flagged messages, and manage investigations. Which Microsoft Purview solution should they use?

Accepted Answer

Communication Compliance. Communication Compliance is the correct Microsoft Purview solution because it is specifically designed to monitor communications (e.g., emails in Exchange Online and messages in Microsoft Teams) for policy violations such as harassment or inappropriate sharing of confidential information. It allows administrators to define customizable policies, automatically flag messages that match sensitive information types or offensive language, and manage investigations through a built-in review workflow.

Answer

Insider Risk Management

Answer

Information Barriers

Answer

Audit (Standard or Premium)

Question 11

A compliance officer needs to identify and monitor potentially risky user activities, such as users copying large amounts of data to external devices or sharing sensitive files with unauthorized recipients. They want to create a policy that detects these activities and automatically escalates them for investigation. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management is specifically designed to detect and investigate malicious or inadvertent insider risks based on activities like data exfiltration, unusual file sharing, or violations of corporate policies. It uses indicators and adaptive policies to assign risk scores and trigger alerts for review. Audit (option B) only provides logging and does not have built-in risk analysis. Communication Compliance (option C) focuses on inappropriate communications, not data-related risks. Compliance Manager (option D) assesses compliance posture but does not detect risky user activities. Therefore, Insider Risk Management is the correct solution.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Compliance Manager

Question 12

A company deploys a custom web application on Azure App Service (PaaS). The application stores user data in Azure SQL Database. The security team is responsible for securing the application code, managing authentication, and configuring TLS for data in transit. According to the Microsoft shared responsibility model, which security responsibility remains with Microsoft for this PaaS deployment?

Accepted Answer

Patching the operating system of the underlying physical and virtual hosts. In a PaaS deployment like Azure App Service, Microsoft is responsible for the security of the underlying cloud infrastructure, including patching the operating system of the physical and virtual hosts that run the platform. This is a core tenant of the shared responsibility model, where the customer manages application-level security (code, authentication, TLS) while Microsoft manages the host OS and hypervisor.

Answer

Configuring the firewall rules for the web application

Answer

Managing user access to the application

Answer

Encrypting the application data at rest in Azure SQL Database

Question 13

A company deploys a custom application on Azure App Service (PaaS). Which of the following security responsibilities falls completely under the customer's scope according to the shared responsibility model?

Accepted Answer

Managing the application code and its configuration. In the shared responsibility model for PaaS like Azure App Service, the customer is responsible for managing the application code and its configuration, including secrets, connection strings, and authentication settings. Microsoft manages the underlying platform, including the OS and runtime, so the customer's scope is limited to what they deploy and configure within the service.

Answer

Applying operating system patches to the virtual machines running the App Service

Answer

Configuring network security groups to filter traffic to the App Service

Answer

Ensuring physical security of the Azure data centers

Question 14

A company has deployed Microsoft 365 Defender to unify threat detection and response. Which two components are included within the Microsoft 365 Defender integrated solution? (Select all that apply.)

Accepted Answer

Microsoft Defender for Endpoint. Microsoft 365 Defender is an integrated threat protection suite that unifies detection and response across an organization's Microsoft 365 environment. It includes Microsoft Defender for Endpoint, which provides endpoint detection and response (EDR) capabilities for devices, and Microsoft Defender for Office 365, which protects against email, phishing, and collaboration threats. These two components work together within the Microsoft 365 Defender portal to correlate alerts and automate response across endpoints and Office 365 workloads.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 15

A user logs into a corporate laptop by inserting a smart card and entering a PIN. The user then attempts to open a confidential folder. The operating system checks the user's access rights and denies access. Which security concepts are demonstrated in this scenario?

Accepted Answer

Authentication and authorization. The scenario demonstrates authentication (verifying the user's identity via smart card + PIN) and authorization (the OS checking access rights and denying access to the folder). Authentication confirms who the user is, while authorization determines what resources they can access. Option B correctly pairs these two concepts.

Answer

Identification and authorization

Answer

Authentication and accounting

Answer

Identification and authentication

Question 16

A security architect is designing a Zero Trust security model for a hybrid organization. Which principle of Zero Trust requires that every access request must be fully authenticated and authorized regardless of the network location, and that access should be granted with the minimum level required?

Accepted Answer

Verify explicitly. B is correct because the 'Verify explicitly' principle of Zero Trust mandates that every access request must be fully authenticated and authorized based on all available data points—including user identity, device health, and location—before granting access. This principle directly requires that authentication and authorization occur for every request, regardless of network location, and that the resulting access is granted with the minimum level required, which is further enforced by the 'Use least privileged access' principle. In a hybrid organization, this ensures that even requests from inside the corporate network are treated with the same scrutiny as external requests.

Answer

Assume breach

Answer

Use least privileged access

Answer

Segment access

Question 17

A large enterprise uses a variety of cloud applications, including sanctioned apps like Microsoft 365 and unsanctioned apps that employees adopted without IT approval. The security team wants to discover all cloud applications in use, assess each app's risk score based on more than 80 risk factors, and control data sharing within sanctioned apps to prevent data leakage. Additionally, they need to identify which users are using a new, unknown file-sharing service. Which Microsoft security solution should be deployed to meet these requirements?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (formerly Microsoft Cloud App Security) is a Cloud Access Security Broker (CASB) that provides visibility into both sanctioned and unsanctioned cloud apps through its Cloud Discovery feature. It assesses risk scores based on over 80 risk factors (e.g., encryption standards, data residency, and compliance certifications) and enables data sharing controls via session policies (e.g., Conditional Access App Control) to prevent data leakage. It also supports anomaly detection to identify users of new, unknown file-sharing services by analyzing traffic logs from network appliances or endpoints.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Purview Data Loss Prevention (DLP)

Question 18

A healthcare organization runs a mix of workloads on Azure (Azure VMs, SQL Database) and on-premises (Windows Servers). They must continuously assess their compliance against the HIPAA and HITRUST regulatory frameworks. They want a unified dashboard that shows their compliance score against these standards and provides step-by-step recommendations to remediate violations. Which Microsoft Defender for Cloud capability should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a unified view of an organization's compliance posture against specific regulatory standards like HIPAA and HITRUST. It displays a compliance score for each selected framework and offers step-by-step remediation recommendations for identified violations, directly meeting the requirement for continuous assessment and guided remediation.

Answer

Secure score

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Servers

Question 19

A company deploys a custom web application on Azure App Service (PaaS). The application stores data in Azure SQL Database. The security team needs to identify which security responsibilities fall under the customer according to the Microsoft shared responsibility model. Which of the following is primarily the customer's responsibility for this PaaS deployment?

Accepted Answer

Managing user identities and access to the application. In a PaaS deployment like Azure App Service with Azure SQL Database, the customer is responsible for managing user identities and access to the application, including authentication, authorization, and role-based access control (RBAC). Microsoft manages the underlying infrastructure, including the host OS, physical datacenter security, and network backbone, but the customer must secure application-level access and data plane operations.

Answer

Physical security of the datacenter hosting the App Service

Answer

Patching the operating system of the App Service host machines

Answer

Network security for the Azure backbone connecting datacenters

Question 20

A security manager wants to ensure that an employee who sends an email cannot later deny having sent it. Which security concept and associated technology is best suited to achieve this?

Accepted Answer

Non-repudiation, achieved through digital signatures. Non-repudiation ensures that a party cannot deny an action, such as sending an email. Digital signatures, which use asymmetric cryptography (e.g., RSA or ECDSA) and a hash of the message, provide cryptographic proof of the sender's identity and message integrity, making denial impossible.

Answer

Confidentiality, achieved through encryption

Answer

Integrity, achieved through hashing

Answer

Access control, achieved through permissions