SC-900 Describe the capabilities of Microsoft security solutions Practice Test 20 — 15 Questions

Question 1

An organization is deploying Microsoft Intune for mobile device management. They need to ensure that all iOS devices must have a passcode of at least 6 characters and the device must be encrypted. What should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A device compliance policy. Device compliance policies in Intune define the rules that devices must meet to be considered compliant, such as requiring a passcode of at least 6 characters and device encryption. Option A is incorrect because Conditional Access policies use compliance status to enforce access controls, but do not define the compliance rules themselves. Option B is incorrect because device configuration profiles push settings to devices but do not enforce compliance; they are used for configuring device settings. Option C is incorrect because app protection policies manage how apps access and handle data, not device-level requirements like passcode and encryption.

Answer

A Conditional Access policy

Answer

A device configuration profile

Answer

An app protection policy

Question 2

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to identify resources that are missing system updates. Which feature should they use?

Accepted Answer

Secure Score recommendations. Secure Score recommendations in Microsoft Defender for Cloud include a specific recommendation for 'System updates should be installed on your machines' (or similar naming). This recommendation identifies Azure resources, particularly VMs, that are missing critical or security system updates by integrating with the Update Management solution or Microsoft Defender for Cloud's built-in vulnerability assessment. Selecting this recommendation allows the security team to view and remediate missing updates, directly addressing the requirement to assess security posture regarding system updates.

Answer

Just-in-time VM access

Answer

Vulnerability assessment solutions

Answer

Adaptive application controls

Question 3

Your organization uses Microsoft Entra ID and wants to automatically block sign-ins from users located in countries that are not approved for business operations. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access with Named Locations. Conditional Access with Named Locations allows you to define geographic locations (e.g., countries) and then create a policy that blocks sign-ins from locations that are not approved for business operations. This is the correct feature because it directly enforces access controls based on the user's physical location at the time of authentication, using IP address ranges or country/region mapping.

Answer

Privileged Identity Management

Answer

Terms of Use

Answer

Identity Protection user risk policy

Question 4

A security administrator needs to enforce that all Microsoft 365 documents containing credit card numbers are automatically encrypted before being shared externally. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically detect sensitive data types, such as credit card numbers, in Microsoft 365 documents and enforce protective actions like encryption before external sharing. DLP policies use sensitive information types (e.g., Credit Card Number) and conditions to trigger encryption via Azure Information Protection, ensuring data is protected at rest and in transit.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Information Protection

Question 5

Your organization is planning to deploy Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that logs from your network proxy servers are ingested. Which method should you use to connect the logs?

Accepted Answer

Log collector. Microsoft Defender for Cloud Apps uses log collectors to ingest traffic logs from network proxy servers for shadow IT discovery. The log collector is a dedicated component that parses and uploads proxy logs (e.g., from Squid, Blue Coat, or Zscaler) to Defender for Cloud Apps for analysis. This method is specifically designed for log-based discovery of unsanctioned cloud app usage.

Answer

Conditional Access App Control

Answer

Microsoft Sentinel data connector

Answer

App connector API

Question 6

A company wants to allow users to reset their own passwords from the login screen without contacting IT. Which Microsoft Entra ID feature enables this?

Accepted Answer

Self-Service Password Reset. Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own passwords from the login screen without contacting IT. It is specifically designed to reduce helpdesk workload by enabling password changes or unlocks through a verified authentication method, such as a phone call, text message, or the Microsoft Authenticator app.

Answer

Conditional Access

Answer

Multifactor authentication

Answer

Identity Protection

Question 7

Your organization uses Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from a single IP address within 5 minutes. Which rule type should you use?

Accepted Answer

Scheduled query rule. A scheduled query rule is correct because it allows you to define a KQL query that counts failed sign-ins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type supports custom aggregation and threshold-based alerting, which is exactly what the requirement specifies.

Answer

Fusion rule

Answer

Near-real-time (NRT) rule

Answer

ML Behavior Analytics rule

Question 8

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel analytics rule. What is the primary purpose of this rule?

Accepted Answer

To detect when a file labeled 'Highly Confidential' is shared externally. The KQL query filters for activities where a file labeled 'Highly Confidential' is shared externally, using the `SensitivityLabel` property and the `SharingType` field set to 'ExternalUser'. The rule's primary purpose is to detect such sharing events, not to block them or list all alerts. Option C correctly identifies this detection goal.

Answer

To identify all files shared externally regardless of sensitivity

Answer

To automatically block external sharing of sensitive files

Answer

To list all alerts generated by the rule

Question 9

Your organization wants to prevent users from installing unapproved apps on company-managed Windows devices. Which Microsoft Intune feature should you use?

Accepted Answer

App control policies. App control policies in Microsoft Intune allow administrators to create and enforce rules that control which applications users can run on managed Windows devices. By configuring a baseline policy (e.g., using Windows Defender Application Control), you can block unapproved apps while allowing only trusted or explicitly permitted software, directly preventing users from installing unauthorized applications.

Answer

Device configuration profiles

Answer

Conditional Access

Answer

Device compliance policies

Question 10

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default filters. You need to create a custom mail flow rule to block similar emails based on specific keywords in the subject line. Which tool should you use?

Accepted Answer

Exchange admin center. To create a custom mail flow rule (also known as a transport rule) that blocks emails based on specific keywords in the subject line, you must use the Exchange admin center (EAC). Mail flow rules are processed by the Exchange Online transport pipeline and are configured within the EAC or via Exchange Online PowerShell, not through the Microsoft 365 Defender portal, which focuses on threat policies and incident response rather than transport-level rule creation.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Defender for Cloud Apps portal

Answer

Microsoft Entra admin center

Question 11

Which TWO Microsoft Purview solutions can help detect and prevent data exfiltration?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management (A) is correct because it uses behavioral analytics and machine learning to identify risky user activities that may indicate data exfiltration, such as copying files to unauthorized cloud services or external devices. Microsoft Purview Data Loss Prevention (DLP) (C) is correct because it enforces policies that inspect content in transit and at rest, blocking or alerting on sensitive data being shared outside the organization via email, endpoints, or cloud apps.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview eDiscovery

Question 12

Refer to the exhibit. You run the Azure PowerShell command for a storage account. What is the current network access configuration?

Accepted Answer

The storage account is not accessible from any network.. The Azure PowerShell command `Update-AzStorageAccountNetworkRuleSet -ResourceGroupName 'RG1' -StorageAccountName 'stgacc1' -DefaultAction Deny` sets the default network access rule to Deny. When the default action is Deny, no traffic is allowed unless explicitly permitted by a network rule (e.g., from a specific virtual network or IP address). Since no such rules are shown in the exhibit, the storage account is effectively not accessible from any network.

Answer

The storage account is accessible only from specific virtual networks.

Answer

The storage account is accessible from all networks.

Answer

The storage account is accessible only from specific IP addresses.

Question 13

Your organization needs to monitor and respond to security threats across on-premises, cloud, and hybrid environments. Which Microsoft solution provides a unified SIEM and SOAR capability?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct answer because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR) solution. It provides unified threat monitoring, detection, and response across on-premises, cloud, and hybrid environments by ingesting data from various sources, using built-in analytics, and enabling automated playbooks.

Answer

Microsoft Defender XDR

Answer

Microsoft Defender for Cloud

Answer

Microsoft Intune

Question 14

Refer to the exhibit. You are reviewing an ARM template for an Azure resource. Assuming the resource is a Key Vault, what is the effect of the networkAcls configuration?

Accepted Answer

The Key Vault is accessible only from the 10.0.0.0/24 subnet.. The networkAcls configuration in the ARM template defines IP firewall rules for the Key Vault. By specifying a defaultAction of 'Deny' and a single ipRule with a value of '10.0.0.0/24', the Key Vault is configured to allow traffic only from the 10.0.0.0/24 subnet. All other traffic, including traffic from other networks and Azure services, is denied by default.

Answer

The Key Vault is accessible from any network.

Answer

The Key Vault is accessible from all Azure services.

Answer

The Key Vault is not accessible from any network.

Question 15

Your company uses Microsoft Intune to manage devices. You need to ensure that only devices that are compliant with your security policies can access corporate email via Microsoft Outlook. What should you implement?

Accepted Answer

Conditional Access policies. Conditional Access policies (D) are the correct choice because they evaluate device compliance status—determined by Intune compliance policies—as a condition for granting access. By configuring a Conditional Access policy that requires compliant devices, only devices meeting your security policies can authenticate to Microsoft Outlook and access corporate email. This is the Azure AD/Entra ID mechanism that enforces access control based on compliance state.

Answer

Windows Information Protection

Answer

Device compliance policies

Answer

App protection policies