SC-900 Describe the capabilities of Microsoft security solutions Practice Test 15 — 15 Questions

Question 1

A user reports that they cannot access a sensitive document in SharePoint Online. The document has a 'Highly Confidential' sensitivity label. You verify the label is applied correctly. What is the most likely reason for the access issue?

Accepted Answer

The label's encryption settings restrict access to specific users. Option C is correct because sensitivity labels can have encryption and rights management that restrict access. Option A is wrong because the label is applied correctly, not missing. Option B is wrong because retention policies do not block access. Option D is wrong because DLP policies block sharing, not access by authorized users.

Answer

The sensitivity label is missing

Answer

A DLP policy is blocking access

Answer

A retention policy is blocking access

Question 2

Which TWO Microsoft security solutions can be used to detect and respond to identity-based threats? (Choose two.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (option C) is a cloud-based security solution that uses on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It specifically focuses on identity-based attacks such as pass-the-hash, Kerberos golden ticket, and brute-force attempts by analyzing network traffic and behavior.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview

Answer

Microsoft Defender for Endpoint

Question 3

Which THREE are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Detect sensitive information in documents and emails. Options A, C, and D are correct. DLP can detect sensitive info, block sharing, and apply policies in Microsoft 365 apps. Option B is wrong because DLP does not classify automatically (auto-labeling is separate). Option E is wrong because DLP does not manage encryption keys.

Answer

Automatically classify and label data

Answer

Manage encryption keys for data at rest

Question 4

Which TWO are features of Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Cloud Discovery to identify shadow IT. Options A and D are correct. Cloud Discovery identifies shadow IT. App governance controls OAuth apps. Option B is wrong because sensitivity labels are in Purview. Option C is wrong because email attack investigation is in Defender for Office 365. Option E is wrong because endpoint vulnerability management is in Defender for Endpoint.

Answer

Apply sensitivity labels to files

Answer

Investigate email-borne attacks

Answer

Vulnerability management for endpoints

Question 5

You are reviewing a Microsoft Purview auto-labeling policy configuration. Based on the exhibit, what happens when a document contains a credit card number and is labeled 'Confidential'?

Accepted Answer

Access is blocked. Option B is correct because the rule specifies action 'blockAccess' when condition 'contains Credit Card Number' and label 'Confidential'. Option A is wrong because it blocks, not allows. Option C is wrong because it does not apply encryption; it blocks access. Option D is wrong because it does not notify admin.

Answer

Access is allowed

Answer

Encryption is applied to the document

Answer

An administrator is notified

Question 6

Your organization uses Microsoft Intune to manage mobile devices. You need to ensure that devices with a jailbroken or rooted OS cannot access corporate resources. What should you configure?

Accepted Answer

A device compliance policy in Microsoft Intune. Option A is correct because a compliance policy in Intune can detect jailbroken devices and mark them as noncompliant. Option B is wrong because a configuration policy sets settings, not compliance. Option C is wrong because an app protection policy manages app data, not device state. Option D is wrong because a conditional access policy in Entra ID uses compliance results but does not detect jailbreak.

Answer

An app protection policy in Microsoft Intune

Answer

A device configuration policy in Microsoft Intune

Answer

A conditional access policy in Microsoft Entra ID

Question 7

You are troubleshooting a Conditional Access policy in Microsoft Entra ID. The policy in the exhibit is not blocking some sign-ins that you expected to block. What is the most likely reason?

Accepted Answer

The policy only blocks based on user risk, not sign-in risk. Option B is correct because the policy only blocks based on user risk level 'high', not sign-in risk. Sign-ins with high sign-in risk but low user risk are not blocked. Option A is wrong because there is no exclude clause. Option C is wrong because the policy does block. Option D is wrong because the policy is not assigned to a user group in this snippet.

Answer

The policy is not assigned to any users

Answer

The grant control is set to allow access

Answer

The policy excludes certain users

Question 8

A company wants to protect against malware and phishing attacks in email and collaboration tools like Microsoft Teams. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Option B is correct because Microsoft Defender for Office 365 protects against threats in email and collaboration tools. Option A is wrong because Defender for Endpoint focuses on devices. Option C is wrong because Defender for Cloud Apps is a CASB. Option D is wrong because Defender for Identity protects on-premises Active Directory.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Question 9

A security administrator needs to block legacy authentication protocols across all applications in Microsoft Entra ID. Which conditional access policy setting should they configure?

Accepted Answer

Under 'Conditions', configure 'Client apps' to block legacy authentication. Option D is correct because legacy authentication protocols (such as POP3, IMAP4, SMTP, and older Office clients) do not support modern authentication methods like MFA or conditional access. By configuring the 'Client apps' condition in a Conditional Access policy to block legacy authentication, the administrator can prevent these insecure sign-in attempts across all applications in Microsoft Entra ID.

Answer

Under 'Grant', select 'Block access'

Answer

Under 'Conditions', configure 'Locations' to block all locations

Answer

Set 'Sign-in frequency' to 1 hour

Question 10

An organization uses Microsoft Sentinel for security information and event management (SIEM) and security orchestration automated response (SOAR). They want to automatically respond to a specific incident by running a playbook. What should they configure?

Accepted Answer

Automation rule. Option D is correct because automation rules in Sentinel trigger playbooks based on incidents. Option A is wrong because analytics rules generate alerts, not responses. Option B is wrong because workbooks visualize data. Option C is wrong because hunting queries proactively search for threats.

Answer

Workbook

Answer

Hunting query

Answer

Analytics rule

Question 11

Refer to the exhibit. You are creating a Microsoft Purview sensitivity label for HR data. The JSON shows a label configuration. What is the likely effect of setting the sensitivity value to 90?

Accepted Answer

The label will be applied with higher priority than labels with lower sensitivity values. Option B is correct because in Microsoft Purview, higher sensitivity values indicate higher priority, and labels with higher sensitivity can auto-classify and override lower labels. Option A is wrong because sensitivity doesn't directly control encryption. Option C is wrong because sensitivity doesn't affect retention. Option D is wrong because sensitivity doesn't determine audit logging.

Answer

The label automatically encrypts the document

Answer

The label triggers auditing for 90 days

Answer

The label sets a 90-day retention period

Question 12

A company uses Microsoft Intune to manage devices. They want to ensure that only devices with a specific minimum operating system version can access corporate email. What should they configure?

Accepted Answer

Create a device compliance policy specifying minimum OS version. Option A is correct because compliance policies in Intune define rules for device compliance, including OS version. Option B is wrong because configuration policies set settings but don't enforce access. Option C is wrong because conditional access in Entra ID integrates with Intune compliance. Option D is wrong because app protection policies manage app-level security.

Answer

Deploy an app protection policy for the email app

Answer

Create a device configuration profile for OS settings

Answer

Configure a conditional access policy in Entra ID to block non-compliant devices

Question 13

An organization wants to detect and respond to threats across their cloud infrastructure, including Azure, AWS, and GCP. Which Microsoft security solution should they centralize their security monitoring in?

Accepted Answer

Microsoft Sentinel. Option B is correct because Microsoft Sentinel is a cloud-native SIEM that can ingest logs from multiple clouds. Option A is wrong because Defender for Cloud focuses on Azure and hybrid workloads. Option C is wrong because Defender for Cloud Apps is a CASB. Option D is wrong because Purview is for data governance.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Cloud Apps

Question 14

Refer to the exhibit. You run the PowerShell command to retrieve a conditional access policy's conditions. The output shows Applications: All, Users: All, and Locations: All trusted. You need to ensure that only trusted locations are used when accessing Microsoft 365. What change should you make?

Accepted Answer

Modify the Locations condition to include all trusted locations and exclude untrusted locations. Option C is correct because the current policy applies to all locations (including untrusted) but requires trusted? Actually the condition says Locations: All trusted, meaning it only applies to trusted locations? The stem says 'ensure that only trusted locations are used' meaning block untrusted. The exhibit says Locations: All trusted? That would apply only to trusted locations. To enforce only trusted locations, you should change Locations to 'All' and then grant access only from trusted locations. Wait, re-reading: 'All trusted' likely means the condition includes all trusted locations? The right answer is to modify the condition to exclude untrusted locations. Option C is correct: modify the Locations condition to include trusted and exclude untrusted. Option A is wrong because blocking legacy auth doesn't affect locations. Option B is wrong because grant controls are not about location. Option D is wrong because sign-in frequency doesn't control locations.

Answer

Add a condition to block legacy authentication

Answer

Under Grant, require multi-factor authentication

Answer

Set sign-in frequency to 4 hours

Question 15

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to improve their secure score. What should they do?

Accepted Answer

Implement the security recommendations. Option D is correct because a higher secure score is achieved by implementing security recommendations. Option A is wrong because disabling services lowers score. Option B is wrong because removing compute resources doesn't improve score. Option C is wrong because increasing budget is unrelated.

Answer

Remove all virtual machines from the subscription

Answer

Increase the Azure budget

Answer

Disable Microsoft Defender for Cloud