SC-900 Describe the capabilities of Microsoft security solutions Practice Test 14 — 15 Questions

Question 1

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email, but allow sharing via Microsoft Teams messages. What should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a DLP policy scoped to Exchange Online with a block action, and a separate DLP policy scoped to Teams with an audit-only action. Microsoft Purview DLP allows you to create separate policies scoped to different workloads. By creating a DLP policy for Exchange Online with a block action, you prevent credit card numbers from being shared via email. A separate DLP policy scoped to Microsoft Teams with an audit-only action allows sharing in Teams while still logging the activity for monitoring.

Answer

Create a single DLP policy that blocks credit card numbers in both Exchange and Teams

Answer

Configure an exception in the DLP policy for Teams using a rule exception

Answer

Use Microsoft Purview Insider Risk Management to block sharing in Teams

Question 2

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which policy should you configure?

Accepted Answer

Conditional Access policy in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By configuring a Conditional Access policy that requires device compliance, only devices marked as compliant by Intune can access corporate email. This is the correct mechanism because Conditional Access acts as the gatekeeper that enforces the compliance requirement at the authentication and authorization layer.

Answer

Device compliance policy in Microsoft Intune

Answer

Enrollment restrictions in Microsoft Intune

Answer

App protection policy in Microsoft Intune

Question 3

Your organization uses Microsoft Purview eDiscovery to manage legal cases. You need to place a hold on a user's mailbox to preserve data for an ongoing litigation. Which role do you need to assign to the eDiscovery manager?

Accepted Answer

eDiscovery Manager (with the Legal Hold role enabled). To place a hold on a user's mailbox in Microsoft Purview eDiscovery, you need the eDiscovery Manager role group with the Legal Hold role enabled. This role specifically grants the permission to create and manage litigation holds, which preserve mailbox content for legal cases. Without the Legal Hold sub-role, an eDiscovery Manager can search and export but cannot apply holds.

Answer

Records Management

Answer

Information Protection

Answer

Compliance Administrator

Question 4

Your organization wants to use Microsoft Defender for Cloud Apps to detect anomalous user behavior across cloud applications. Which feature should you enable?

Accepted Answer

Anomaly detection policies. Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then trigger alerts for deviations, such as impossible travel, unusual data exfiltration, or risky sign-in patterns. This directly addresses the requirement to detect anomalous user behavior across cloud applications.

Answer

App connectors

Answer

Secure Score

Answer

Cloud Discovery

Question 5

You are reviewing a Microsoft Purview DLP policy rule represented in JSON. What is the effect of this rule?

Accepted Answer

It blocks the sending of an email if it contains 10 or more credit card numbers with high confidence. The JSON rule defines a condition where the DLP policy blocks email transmission when the count of credit card numbers detected with high confidence meets or exceeds 10. The 'BlockAccess' action in the rule enforces this by preventing the email from being sent, and the 'NotifyUser' action with 'NotifyOnly' set to false ensures the user is notified of the block. This matches the behavior of a Microsoft Purview DLP policy that uses a threshold-based condition with high confidence to block sensitive data sharing.

Answer

It notifies the user when a single credit card number is detected in email

Answer

It triggers a policy tip when a single credit card number is detected

Answer

It blocks access to a SharePoint site containing credit card numbers

Question 6

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows users to sign in using their social media accounts, such as Google or Facebook. What should you configure?

Accepted Answer

External identities (B2B) with social identity providers. External identities (B2B) in Microsoft Entra ID allow you to configure social identity providers (e.g., Google, Facebook) as federation sources. This enables users to sign in with their existing social accounts by leveraging OAuth 2.0 and OpenID Connect protocols, without needing to create a separate Microsoft account.

Answer

Microsoft Authenticator app for passwordless sign-in

Answer

Privileged Identity Management

Answer

Self-service password reset

Question 7

Your organization wants to protect sensitive documents from being copied to unauthorized cloud services. Which Microsoft Purview capability should you use?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information—such as credit card numbers or health records—when users attempt to copy or share it with unauthorized cloud services like personal OneDrive or third-party storage apps. By scanning content in transit and applying actions like blocking the action or encrypting the data, DLP directly addresses the requirement to prevent data exfiltration to unauthorized cloud destinations.

Answer

Audit log

Answer

Retention policy

Answer

Sensitivity label

Question 8

Which TWO of the following are features of Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Cloud Workload Protection Platform (CWPP). Microsoft Defender for Cloud is a Cloud Workload Protection Platform (CWPP) that provides unified security management and advanced threat protection for workloads running in Azure, on-premises, and other clouds. It also includes Cloud Security Posture Management (CSPM) capabilities, which continuously assess your environment against security benchmarks (e.g., CIS, NIST) and provide actionable recommendations to improve your security posture.

Answer

Data classification and labeling

Answer

Security Information and Event Management (SIEM)

Answer

Mobile Threat Defense (MTD)

Question 9

Which TWO of the following are benefits of using Microsoft Entra ID Conditional Access? (Choose two.)

Accepted Answer

Block access from locations that are not trusted. Conditional Access policies can enforce multi-factor authentication based on user risk (D) and block access from untrusted locations (B). Option A (allow users to reset their own passwords) is a feature of self-service password reset (SSPR), not Conditional Access. Option C (automatically grant temporary admin access) is a benefit of Privileged Identity Management (PIM). Option E (eliminate the need for passwords entirely) is related to passwordless authentication, not Conditional Access.

Answer

Allow users to reset their own passwords

Answer

Automatically grant temporary admin access

Answer

Eliminate the need for passwords entirely

Question 10

A tenant administrator runs the PowerShell cmdlet shown in the exhibit. The output shows that some compliance policies have IsAssigned = $false. What does this indicate?

Accepted Answer

The compliance policy is not assigned to any user or device group. The `IsAssigned` property in the output of a compliance policy PowerShell cmdlet (such as `Get-DeviceCompliancePolicy`) directly indicates whether the policy has been assigned to any user or device group. When `IsAssigned = $false`, it means the policy exists in the tenant but has not been linked to any group via an assignment, so it is not being enforced on any devices. This is a core concept in Microsoft Intune and Microsoft 365 compliance: a policy must be assigned to a group to take effect.

Answer

The compliance policy is scheduled to be assigned in the future

Answer

The compliance policy has been evaluated and found non-compliant

Answer

The compliance policy is a built-in policy that cannot be assigned

Question 11

Your organization uses Microsoft Sentinel as a SIEM. You need to collect security events from on-premises servers. Which connector should you use?

Accepted Answer

Azure Monitor Agent (AMA). The Azure Monitor Agent (AMA) is the correct connector because it is the primary agent for collecting security events from on-premises Windows and Linux servers into a Log Analytics workspace, which Microsoft Sentinel uses as its data source. AMA supports data collection rules (DCRs) to filter and route specific security event IDs, replacing the legacy Log Analytics agent. This enables Sentinel to ingest Windows Security Events (e.g., Event ID 4625 for failed logons) for threat detection and incident creation.

Answer

Azure Security Center connector

Answer

Microsoft 365 Defender connector

Answer

Log Analytics workspace

Question 12

Your organization wants to label emails and documents as 'Confidential' automatically based on content patterns. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling (sensitivity labels). Auto-labeling (sensitivity labels) in Microsoft Purview can automatically apply 'Confidential' labels to emails and documents based on content patterns, such as credit card numbers or specific keywords. This feature uses pattern matching and machine learning classifiers to detect sensitive content and assign the appropriate sensitivity label without manual intervention.

Answer

Audit log

Answer

Retention labels

Answer

Data Loss Prevention policy

Question 13

Your organization uses Microsoft Defender for Cloud Apps. A security analyst needs to receive an alert whenever a user accesses a cloud app from a new IP address that is not in the organization's trusted IP range. What should the analyst configure?

Accepted Answer

An anomaly detection policy. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user activities, such as access from a new IP address outside the organization's trusted IP range. This policy leverages machine learning to establish a baseline of normal behavior and triggers alerts when deviations occur, making it the correct choice for this scenario.

Answer

A file policy

Answer

A session policy

Answer

An app permission policy

Question 14

Your organization is implementing Microsoft Defender for Office 365 to protect against phishing attacks. You need to ensure that when a user clicks a malicious link in an email, the user is warned and the action is blocked. Which policy should you configure?

Accepted Answer

Safe Links policy. Safe Links in Defender for Office 365 provides real-time time-of-click protection against malicious links. Option A is wrong because Safe Attachments scans attachments, not links. Option C is wrong because anti-phishing policies protect against spoofing and impersonation but do not block links at click time. Option D is wrong because anti-spam policies filter spam, not malicious links.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Anti-phishing policy

Question 15

You are a security administrator for a company that uses Microsoft 365. The compliance team needs to automatically classify and protect sensitive data such as credit card numbers in emails and documents. Which Microsoft Purview solution should you recommend?

Accepted Answer

Microsoft Purview Information Protection. A is correct because Microsoft Purview Information Protection (formerly Azure Information Protection) provides automatic classification of sensitive data, such as credit card numbers, by applying sensitivity labels based on rules and patterns. It also offers protection through encryption or access restrictions. This solution directly addresses the compliance team's requirement for both automatic classification and protection. Data Loss Prevention (DLP) enforces protective actions after classification but does not perform the classification itself.

Answer

Microsoft Purview Records Management

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Data Loss Prevention