SC-900 Describe the capabilities of Microsoft security solutions Practice Test 11 — 15 Questions

Question 1

Your organization wants to protect sensitive documents from being copied to unauthorized cloud services. Which Microsoft Purview capability should you use?

Accepted Answer

Data Loss Prevention (DLP) policy. Option B is correct because DLP policies can detect and prevent sharing of sensitive data to unauthorized services. Option A is incorrect because audit logs only record activity, not block. Option C is incorrect because sensitivity labels classify data but do not block sharing. Option D is incorrect because records management focuses on retention.

Answer

Audit log

Answer

Retention policy

Answer

Sensitivity label

Question 2

Which TWO of the following are features of Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Cloud Workload Protection Platform (CWPP). Microsoft Defender for Cloud is a Cloud Workload Protection Platform (CWPP) that provides unified security management and advanced threat protection for workloads running in Azure, on-premises, and other clouds. It also includes Cloud Security Posture Management (CSPM) capabilities, which continuously assess your environment against security benchmarks (e.g., CIS, NIST) and provide actionable recommendations to improve your security posture.

Answer

Data classification and labeling

Answer

Security Information and Event Management (SIEM)

Answer

Mobile Threat Defense (MTD)

Question 3

Which THREE of the following are capabilities of Microsoft Purview eDiscovery? (Choose three.)

Accepted Answer

Export search results to a PST file. Option B is correct because Microsoft Purview eDiscovery includes the capability to export search results to a PST file, allowing investigators to preserve and review mailbox content offline. This is a standard feature in both eDiscovery (Standard) and eDiscovery (Premium) for exporting Exchange Online data.

Answer

Block sharing of sensitive data via email

Answer

Automatically delete emails older than 7 years

Question 4

Which TWO of the following are benefits of using Microsoft Entra ID Conditional Access? (Choose two.)

Accepted Answer

Block access from locations that are not trusted. Options A and C are correct. A: Conditional Access can require MFA based on conditions. C: It can block access from untrusted locations. Options B, D, and E are incorrect: B is a benefit of passwordless; D is a benefit of SSPR; E is a benefit of PIM.

Answer

Allow users to reset their own passwords

Answer

Automatically grant temporary admin access

Answer

Eliminate the need for passwords entirely

Question 5

A tenant administrator runs the PowerShell cmdlet shown in the exhibit. The output shows that some compliance policies have IsAssigned = $false. What does this indicate?

Accepted Answer

The compliance policy is not assigned to any user or device group. The `IsAssigned` property in the output of a compliance policy PowerShell cmdlet (such as `Get-DeviceCompliancePolicy`) directly indicates whether the policy has been assigned to any user or device group. When `IsAssigned = $false`, it means the policy exists in the tenant but has not been linked to any group via an assignment, so it is not being enforced on any devices. This is a core concept in Microsoft Intune and Microsoft 365 compliance: a policy must be assigned to a group to take effect.

Answer

The compliance policy is scheduled to be assigned in the future

Answer

The compliance policy has been evaluated and found non-compliant

Answer

The compliance policy is a built-in policy that cannot be assigned

Question 6

Your organization uses Microsoft Sentinel as a SIEM. You need to collect security events from on-premises servers. Which connector should you use?

Accepted Answer

Azure Monitor Agent (AMA). Option B is correct because the Azure Monitor Agent (AMA) is the recommended agent to collect events from Windows and Linux servers to Log Analytics workspaces, which feed into Sentinel. Option A is incorrect because Log Analytics is the workspace, not a connector. Option C is incorrect because Office 365 connector is for cloud services. Option D is incorrect because Azure Security Center is now Defender for Cloud, which integrates but is not a connector.

Answer

Azure Security Center connector

Answer

Microsoft 365 Defender connector

Answer

Log Analytics workspace

Question 7

Your organization wants to label emails and documents as 'Confidential' automatically based on content patterns. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling (sensitivity labels). Option C is correct because auto-labeling policies in Purview automatically apply sensitivity labels based on conditions. Option A is incorrect because retention labels are for retention, not classification. Option B is incorrect because DLP is for protecting data, not labeling. Option D is incorrect because audit is for logging.

Answer

Audit log

Answer

Retention labels

Answer

Data Loss Prevention policy

Question 8

Your organization uses Microsoft Defender for Cloud Apps. A security analyst needs to receive an alert whenever a user accesses a cloud app from a new IP address that is not in the organization's trusted IP range. What should the analyst configure?

Accepted Answer

An anomaly detection policy. Option A is correct because anomaly detection policies in Defender for Cloud Apps can detect activities from unfamiliar locations/IPs. Option B is wrong because app permissions policies govern third-party app permissions, not access from IPs. Option C is wrong because session policies control real-time session monitoring, not alerting on new IPs. Option D is wrong because file policies monitor file activities, not login locations.

Answer

A file policy

Answer

A session policy

Answer

An app permission policy

Question 9

Your organization is implementing Microsoft Defender for Office 365 to protect against phishing attacks. You need to ensure that when a user clicks a malicious link in an email, the user is warned and the action is blocked. Which policy should you configure?

Accepted Answer

Safe Links policy. Option B is correct because Safe Links in Defender for Office 365 provides real-time time-of-click protection against malicious links. Option A is wrong because Safe Attachments scans attachments, not links. Option C is wrong because anti-phishing policies protect against spoofing and impersonation but do not block links at click time. Option D is wrong because anti-spam policies filter spam, not malicious links.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Anti-phishing policy

Question 10

You are a security administrator for a company that uses Microsoft 365. The compliance team needs to automatically classify and protect sensitive data such as credit card numbers in emails and documents. Which Microsoft Purview solution should you recommend?

Accepted Answer

Microsoft Purview Data Loss Prevention. Option C is correct because Microsoft Purview Data Loss Prevention (DLP) policies automatically detect and protect sensitive data like credit card numbers. Option A is wrong because Information Protection focuses on classification and labeling, but DLP enforces actions. Option B is wrong because Insider Risk Management detects risky user activities, not data classification. Option D is wrong because Records Management manages retention and disposition, not real-time protection.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Insider Risk Management

Question 11

Your organization has Microsoft Sentinel deployed. The security operations team needs to automatically respond to a security incident by opening an incident in ServiceNow and sending a notification to a Teams channel. What should you configure?

Accepted Answer

An automation rule with a playbook. Option A is correct because automation rules in Microsoft Sentinel can trigger playbooks (based on Azure Logic Apps) that integrate with external systems like ServiceNow and Teams. Option B is wrong because analytics rules create alerts, not automated responses. Option C is wrong because workbooks provide visualizations, not automation. Option D is wrong because watchlists are for correlation, not response.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 12

Your company uses Microsoft Entra ID and is implementing a zero-trust security model. You need to ensure that all access requests to sensitive applications are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID capability should you use?

Accepted Answer

Conditional Access with session controls. Conditional Access with session controls enforces continuous access evaluation (CAE) by intercepting real-time signals—such as user risk, device compliance, or location changes—after the initial authentication. This ensures that access to sensitive applications is verified throughout the session, not just at sign-in, aligning with the zero-trust principle of 'verify explicitly and continuously.'

Answer

Access reviews

Answer

Microsoft Entra Identity Protection

Answer

Privileged Identity Management

Question 13

Your organization has deployed Microsoft Intune for mobile device management. You need to ensure that users can only access corporate resources from devices that are compliant with your security policies. Which policy type should you configure?

Accepted Answer

A Conditional Access policy. Option D is correct because Conditional Access policies in Microsoft Entra ID can integrate with Intune compliance policies to block non-compliant devices. Option A is wrong because compliance policies define the compliance criteria but do not block access by themselves. Option B is wrong because configuration policies manage settings, not access control. Option C is wrong because app protection policies manage data in apps, not device-level access.

Answer

An app protection policy

Answer

A compliance policy

Answer

A configuration policy

Question 14

Your organization is using Microsoft Defender for Cloud to secure a multi-cloud environment including Azure and AWS. You need to identify misconfigurations that could lead to security breaches. Which feature should you use?

Accepted Answer

Cloud Security Posture Management (CSPM). Option A is correct because Microsoft Defender for Cloud's security posture management (CSPM) continuously assesses resources against security benchmarks and identifies misconfigurations. Option B is wrong because workload protections focus on threats, not configuration. Option C is wrong because the security score provides a score but not specific misconfigurations. Option D is wrong because regulatory compliance checks against standards, not general misconfigurations.

Answer

Cloud Workload Protection (CWP)

Answer

Regulatory compliance dashboard

Answer

Security score

Question 15

Your company uses Microsoft Purview to manage data across Azure, on-premises SQL Server, and Amazon S3. You need to create a unified map of all data sources and their sensitivity labels. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct feature because it provides a unified, automated map of data assets across hybrid and multi-cloud environments (Azure, on-premises SQL Server, and Amazon S3). It automatically scans and classifies data sources, applies sensitivity labels, and maintains a centralized metadata repository, enabling a holistic view of the data landscape and its sensitivity.

Answer

Microsoft Purview Data Sharing

Answer

Microsoft Purview Data Estate Insights

Answer

Microsoft Purview Data Catalog