SC-900 Hard Questions — 25 Difficult Questions

Question 1

Your organization uses Microsoft Purview Communication Compliance to detect harassing messages. You receive an alert for a message that appears to be a joke between colleagues. What should you do to prevent similar false positives?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Refine the policy conditions to exclude certain keywords or users. Microsoft Purview Communication Compliance policies are configurable to reduce false positives. You can refine the policy by adding conditions to exclude specific keywords (e.g., 'joke' or 'just kidding') or specific users (e.g., known colleagues) from triggering alerts, without disabling the policy or relying on user behavior changes.

Answer

Train users not to joke about sensitive topics

Answer

Delete the alert and ignore future similar messages

Answer

Turn off the policy and use a different solution

Question 2

A multinational corporation must comply with regulations that require them to keep financial records for 7 years and then permanently delete them. However, they are currently involved in litigation that requires preservation of all documents related to a specific project. They use Microsoft Purview. Which combination of features should they use to meet both requirements?

Accepted Answer

Data Lifecycle Management to retain for 7 years then delete, and eDiscovery (Premium) to place a legal hold on the project documents. Data Lifecycle Management (DLM) allows you to create retention labels that enforce a 7-year retention period followed by automatic deletion, satisfying the regulatory requirement. eDiscovery (Premium) provides the ability to place a legal hold on specific documents, which overrides the deletion policy to preserve data relevant to ongoing litigation. This combination ensures both compliance with the retention/deletion mandate and the preservation obligation.

Answer

Data Lifecycle Management to retain for 7 years then delete, and Sensitivity labels to mark documents

Answer

Audit (Premium) to log access and eDiscovery (Premium) to search

Answer

Information Protection to classify data and Data Lifecycle Management to retain

Question 3

You are reviewing a Conditional Access policy configuration in Microsoft Entra ID. Based on the exhibit, what is the effect of this policy?

Accepted Answer

Blocks sign-ins that have a high sign-in risk level. The policy is configured to target 'All users' and 'All cloud apps' with a condition of 'Sign-in risk level: High' and an access control of 'Block access'. This means any sign-in attempt that Microsoft Entra ID detects as having a high sign-in risk (e.g., from a compromised token or anonymous IP) will be blocked. Option B correctly identifies this effect.

Answer

Blocks sign-ins for users with high user risk

Answer

Blocks all sign-ins for the assigned users

Answer

Requires multi-factor authentication for high-risk sign-ins

Question 4

Refer to the exhibit. You run a Kusto query in Microsoft Defender XDR Advanced Hunting. What does this query return?

Accepted Answer

Top 10 high-severity alert titles by number of distinct affected devices. The query filters for high-severity alerts, then summarizes by AlertTitle and counts distinct DeviceName values. It orders by that count descending and takes the top 10, so it returns the top 10 high-severity alert titles ranked by the number of distinct affected devices.

Answer

Top 10 alert titles by number of distinct devices, including all severities

Answer

Top 10 devices with the most high-severity alerts

Answer

Top 10 high-severity alert titles by total number of alerts

Question 5

Which THREE Microsoft Purview solutions help protect sensitive data in Microsoft 365? (Choose three.)

Accepted Answer

Data Loss Prevention. Data Loss Prevention (DLP) is correct because it identifies, monitors, and automatically protects sensitive data across Exchange Online, SharePoint, OneDrive, and Teams by applying policies that block or warn users when sensitive content (e.g., credit card numbers or PII) is shared inappropriately. It uses deep content analysis, including keyword matches, regex patterns, and machine learning classifiers, to enforce protection actions.

Answer

Audit

Answer

eDiscovery

Question 6

Refer to the exhibit. An administrator runs the Azure CLI commands shown. What is the purpose of these commands?

Accepted Answer

To authenticate a service principal for automated tasks.. The Azure CLI commands shown are used to authenticate a service principal for automated tasks. Specifically, `az login --service-principal -u -p --tenant ` authenticates using the service principal's credentials without interactive user login, enabling non-interactive automation or scripts.

Answer

To create a new service principal.

Answer

To list all Azure subscriptions.

Answer

To log in to Azure as a user with MFA.

Question 7

Refer to the exhibit. You are a compliance administrator running PowerShell to update a sensitivity label in Microsoft Purview. The command fails with an error that the label is not found. What is the most likely cause?

Accepted Answer

The cmdlet Get-MgInformationProtectionPolicy does not return labels.. The cmdlet Get-MgInformationProtectionPolicy retrieves the policy configuration but does not return individual sensitivity labels. To update a specific label, you must use Get-MgInformationProtectionSensitivityLabel to first retrieve the label object, then pipe it to Set-MgInformationProtectionSensitivityLabel. The error 'label not found' occurs because the cmdlet used does not expose labels, not because the label is missing or misspelled.

Answer

The -Settings parameter is deprecated.

Answer

The user does not have permissions to view labels.

Answer

The label name is misspelled.

Question 8

Which TWO of the following are capabilities of Microsoft Purview Insider Risk Management? (Select TWO.)

Accepted Answer

Identify anomalous user activities such as mass file downloads. Microsoft Purview Insider Risk Management uses predefined risk indicators to detect anomalous user activities, such as mass file downloads, which may signal data theft or policy violations. These indicators are based on user behavior analytics and can be customized to align with organizational risk tolerance.

Answer

Review communications for policy violations

Answer

Conduct eDiscovery searches for legal cases

Answer

Block sharing of sensitive data via email

Question 9

Your organization uses Microsoft Entra ID. Which THREE authentication methods can be used for passwordless sign-in?

Accepted Answer

Microsoft Authenticator (phone sign-in). Microsoft Authenticator (phone sign-in) enables passwordless authentication by using a cryptographic key pair tied to the user's device. When signing in, the user approves a notification on their phone, and the Authenticator app signs the challenge with the private key, eliminating the need for a password.

Answer

SMS-based verification

Answer

Time-based one-time password (TOTP)

Question 10

Which THREE of the following are capabilities of Microsoft Purview eDiscovery? (Choose three.)

Accepted Answer

Export search results to a PST file. Microsoft Purview eDiscovery allows organizations to search for content across various Microsoft 365 services like Exchange Online, SharePoint Online, and OneDrive for Business (E). It enables placing legal holds on mailboxes and sites to preserve data for legal purposes (C), and allows exporting search results, including mailbox content, to PST files for offline review (B).

Answer

Block sharing of sensitive data via email

Answer

Automatically delete emails older than 7 years

Question 11

Which THREE of the following are features of Microsoft Purview Compliance Manager? (Select THREE.)

Accepted Answer

Compliance score and templates for custom assessments. Microsoft Purview Compliance Manager provides a **compliance score** that quantifies an organization's compliance posture and includes **templates for custom assessments** tailored to specific regulatory or organizational requirements (Option B). It also offers a library of **pre-built assessments** for common regulations like GDPR (Option C). Additionally, it details **improvement actions**, including those that are **Microsoft-managed**, to help organizations meet regulatory requirements (Option E).

Answer

Record declaration and disposition reviews

Answer

Trainable classifiers to identify sensitive content

Question 12

Your organization is using Microsoft Entra ID and has deployed Microsoft Intune for mobile device management. You need to ensure that only devices that are compliant with Intune policies can access corporate email via Microsoft Outlook for iOS and Android. Additionally, you need to prevent users from copying corporate data to personal apps on the same device. Which two Microsoft Entra features should you combine?

Accepted Answer

Conditional Access policy requiring compliant device, and Microsoft Intune app protection policy (MAM) to prevent data copy/paste to unmanaged apps.. It combines a Conditional Access policy that requires a compliant device (enforced by Intune) with an Intune app protection policy (MAM) that prevents copying corporate data to unmanaged apps. This meets both requirements. Option A is incorrect because Windows Autopilot is for provisioning, not compliance enforcement. Option B is incorrect because MFA and Windows Hello for Business do not control device compliance or data leakage. Option C is incorrect because requiring an approved client app alone does not enforce device compliance, and Azure AD Application Proxy is for remote access to on-premises apps, not data protection.

Answer

Conditional Access policy requiring hybrid Azure AD joined device, and Windows Autopilot.

Answer

Conditional Access policy requiring MFA, and Windows Hello for Business.

Answer

Conditional Access policy requiring approved client app, and Azure AD Application Proxy.

Question 13

A company is planning to use Copilot for Microsoft 365. To ensure that Copilot responses are based only on data accessible to the user, which principle must be enforced?

Accepted Answer

User permissions and access controls are respected. Copilot for Microsoft 365 uses the user's existing permissions to determine which content it can access. Option A is incorrect because Copilot does not automatically grant users access to data; it operates within existing user permissions. Option C is incorrect because while data is indexed, Copilot's access to that data for a specific user is always governed by that user's existing permissions, meaning not all organizational data is available to every user. Option D is incorrect because the storage location of data is not the principle that ensures Copilot responses are based only on data accessible to the user; rather, it is the enforcement of user permissions.

Answer

Copilot automatically grants access to all data

Answer

All organizational data is indexed and available to Copilot

Answer

Data must be stored in a specific location

Question 14

A company runs Windows Server virtual machines (VMs) on-premises and in Azure. The security team wants a unified view of missing security updates and known vulnerabilities (CVEs) across all VMs. They want to enable agentless scanning for Azure VMs and deploy a lightweight agent for on-premises machines. The results should be consolidated in a single dashboard with prioritized remediation recommendations. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides unified visibility into security vulnerabilities and missing updates across hybrid workloads, including on-premises and Azure VMs. It supports agentless scanning for Azure VMs (using the cloud-based scanner) and allows deployment of the Azure Monitor Agent (or legacy Log Analytics agent) for on-premises machines, consolidating findings in a single dashboard with prioritized remediation recommendations based on the Secure Score and integrated vulnerability assessment (e.g., Qualys or Microsoft Defender Vulnerability Management).

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Question 15

Which TWO of the following are examples of Microsoft Copilot for Security use cases?

Accepted Answer

Answering a natural language question about a KQL query. Microsoft Copilot for Security is designed to process natural language queries and provide insights into security data, including KQL queries and incident investigations. It allows security analysts to ask questions in plain English, receive explanations or summaries of KQL queries, and generate summaries of complex security incidents, which enhances productivity and understanding without requiring deep KQL expertise.

Answer

Configuring firewall rules in Azure

Answer

Resetting a user's password in Entra ID

Answer

Creating a new DLP policy in Microsoft Purview

Question 16

Refer to the exhibit. A compliance administrator is configuring role-based access control (RBAC) in Microsoft Purview compliance portal. Which role group would provide the permissions shown?

Accepted Answer

Information Protection. The exhibit displays permissions related to managing sensitivity labels, label policies, and data loss prevention (DLP) rules within Microsoft Purview. The Information Protection role group is specifically designed for administrators who need to configure and manage these information protection features, making it the correct choice as it directly encompasses all the displayed permissions.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Data Classification

Question 17

Your organization uses Microsoft Sentinel as its SIEM. You need to create an analytics rule that detects when a user account is created in Azure AD and then, within 10 minutes, that same account is used to grant admin consent to an application. You have a KQL query that joins AuditLogs and SigninLogs. However, the rule is generating too many false positives. You need to refine the query to reduce false positives. What should you do?

Accepted Answer

Add a condition to exclude accounts that are known admin accounts or service accounts.. Known admin or service accounts are often used for legitimate, automated admin consent grants, which can trigger false positives. By excluding these accounts from the detection logic, the rule focuses on anomalous behavior from non-privileged accounts, reducing noise while preserving the core detection of suspicious account creation followed by admin consent grant.

Answer

Change the rule to alert on every admin consent grant event regardless of account creation.

Answer

Remove the join with SigninLogs and only use AuditLogs.

Answer

Increase the time window from 10 minutes to 30 minutes.

Question 18

A company has a Microsoft Entra ID tenant with thousands of users. They need to ensure that only users with a 'Manager' attribute populated can access a sensitive app. Which approach should they use?

Accepted Answer

Create a dynamic group rule that includes users with a non-empty Manager attribute, then target the group in a Conditional Access policy. A dynamic group rule can evaluate the 'Manager' attribute and include only users where it is populated. This group can then be assigned to a Conditional Access policy that requires the group membership for access to the sensitive app, ensuring only users with a manager can authenticate.

Answer

Use HR-driven provisioning to populate an on-premises attribute and sync it

Answer

Create an access package in Entitlement Management that requires manager approval

Answer

Create an Administrative Unit for users with managers and assign the app to that unit

Question 19

Refer to the exhibit. You are creating a custom analytics rule in Microsoft Sentinel. What does this rule detect?

Accepted Answer

Sign-ins with medium or high risk from outside the US. The rule is configured with 'Risk level: Medium, High' and 'Location: Outside US'. This means it triggers only when both conditions are met: the sign-in risk is medium or high, and the location is outside the US. Option D correctly matches this combination, detecting sign-ins with medium or high risk from outside the US.

Answer

Sign-ins with high sign-in risk from any location

Answer

Sign-ins with medium or high risk from the US

Answer

Sign-ins from users with high user risk outside the US

Question 20

Which THREE are features of Microsoft Purview Data Lifecycle Management (formerly Records Management)? (Choose three.)

Accepted Answer

Retention policies. Retention policies are a core feature of Microsoft Purview Data Lifecycle Management because they allow administrators to apply retention settings at the container level (e.g., entire SharePoint site, Exchange mailbox, or OneDrive account) to automatically retain or delete content based on a defined schedule. This ensures that organizational data is kept for the required period and then removed, supporting compliance and governance requirements without manual intervention.

Answer

Data loss prevention

Answer

Sensitivity labels