SC-900 Describe the capabilities of Microsoft security solutions Practice Test 20 — 15 Questions

Question 1

Your company uses Microsoft 365 Copilot to assist employees with drafting emails and documents. The security team needs to ensure that when Copilot accesses sensitive data, it respects the organization's sensitivity labels and does not expose highly confidential information to unauthorized users. What should the security team configure?

Accepted Answer

Apply Microsoft Purview sensitivity labels to data and enable Copilot data protection. Option D is correct because Microsoft Purview sensitivity labels are integrated with Microsoft 365 Copilot to enforce data protection. Option A is wrong because Copilot is already integrated with Microsoft 365. Option B is wrong because data loss prevention policies block sharing but do not control Copilot access. Option C is wrong because Microsoft Defender for Cloud Apps is for cloud app security, not Copilot.

Answer

Configure Microsoft Defender for Cloud Apps session policies

Answer

Disable Copilot for all users

Answer

Create a data loss prevention policy that blocks Copilot

Question 2

Your organization is planning to use Microsoft Sentinel as a SIEM solution. Which TWO of the following are required components for Sentinel? (Select TWO.)

Accepted Answer

A Log Analytics workspace. Options A and C are correct: A Log Analytics workspace is the underlying data store, and data connectors are needed to ingest logs. Option B is wrong because a playbook is optional automation. Option D is wrong because a KQL query is used for analysis but not a required component. Option E is wrong because a workbook is optional visualization.

Answer

A playbook for automated response

Answer

A workbook for dashboards

Answer

A KQL query for threat detection

Question 3

A company uses Microsoft Purview Data Lifecycle Management. To comply with regulatory requirements, the company must retain financial records for 7 years and then delete them. Which THREE actions should the company configure? (Select THREE.)

Accepted Answer

Create a retention label with a retention period of 7 years. Options A, B, and D are correct: Create a retention label for 7 years, auto-apply the label to financial content, and configure a disposition review for deletion. Option C is wrong because a DLP policy is for preventing data loss, not lifecycle management. Option E is wrong because a retention policy is for the entire location, not specific content.

Answer

Create a data loss prevention policy

Answer

Create a retention policy for the entire SharePoint site

Question 4

Your organization wants to implement a Zero Trust security model. Which TWO principles are part of the Zero Trust model? (Select TWO.)

Accepted Answer

Assume breach. Options A and D are correct: Zero Trust assumes breach and verifies explicitly. Option B is wrong because implicit trust is not part of Zero Trust. Option C is wrong because network perimeter is the traditional model. Option E is wrong because perimeter-based access is not Zero Trust.

Answer

Grant access based on IP address

Answer

Rely on network perimeter security

Answer

Use implicit trust for internal traffic

Question 5

Your organization, Contoso Ltd., uses Microsoft 365 and Microsoft Defender XDR. You are a security administrator. Recently, a user named John Doe reported that his account is sending phishing emails internally. You suspect his account is compromised. You need to contain the threat immediately while preserving forensic data. The company has the following security solutions: Microsoft Entra ID P2, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, Microsoft Sentinel, and Microsoft Purview. You need to prevent the compromised account from causing further damage. Which action should you take first?

Accepted Answer

Disable the user account in Microsoft Entra ID. Option A is correct because disabling the user account in Microsoft Entra ID is the quickest way to stop the compromised account from sending emails. Option B is wrong because resetting password does not immediately revoke active sessions; tokens may still be valid. Option C is wrong while useful, revoking sessions is not as immediate as disabling the account; also, disabling the account is a stronger containment step. Option D is wrong because creating a mail flow rule takes time and may not stop the account if it's already authenticated.

Answer

Reset the user's password and require a password change

Answer

Revoke all refresh tokens for the user in Microsoft Entra ID

Answer

Create a mail flow rule in Exchange Online to block the user's emails

Question 6

You are a compliance officer at a healthcare organization that uses Microsoft 365. The organization must comply with HIPAA regulations. You have Microsoft Purview, Microsoft Defender for Cloud Apps, and Microsoft Intune. You need to ensure that all devices accessing patient health information (PHI) are compliant with the organization's security policies, which require device encryption, a minimum OS version, and the use of a compliant mobile device management (MDM) provider. Currently, some devices are not managed by Intune. You need to enforce that only compliant devices can access PHI stored in SharePoint Online. What should you do?

Accepted Answer

Configure a conditional access policy in Microsoft Entra ID to require compliant devices. Option B is correct because conditional access policies in Microsoft Entra ID can require devices to be compliant (managed by Intune) and meet compliance policies before accessing SharePoint. Option A is wrong because DLP policies do not enforce device compliance. Option C is wrong because app protection policies apply to mobile apps but do not require device management. Option D is wrong because device compliance policies require devices to be enrolled in Intune first; conditional access is needed to enforce the requirement.

Answer

Create a device compliance policy in Microsoft Intune and assign it to all users

Answer

Deploy an app protection policy in Microsoft Intune to restrict data access

Answer

Create a DLP policy in Microsoft Purview to block access from non-compliant devices

Question 7

Your company is adopting Microsoft Copilot for Microsoft 365 to improve productivity. The security team is concerned about data leakage, as Copilot can access emails, documents, and other content. You need to ensure that sensitive data, such as credit card numbers and social security numbers, is not inadvertently exposed by Copilot. The organization uses Microsoft Purview sensitivity labels and DLP. You need to configure a solution that automatically detects and prevents Copilot from accessing or generating content containing these sensitive data types. What should you do?

Accepted Answer

Create a DLP policy in Microsoft Purview that detects sensitive data types and blocks Copilot actions. Option C is correct because Microsoft Purview Data Loss Prevention policies can be configured to monitor Copilot interactions and block or warn when sensitive data is detected. Option A is wrong because sensitivity labels help but do not prevent Copilot from accessing data; DLP is needed. Option B is wrong because disabling Copilot is not a targeted solution. Option D is wrong because Microsoft Defender for Cloud Apps is for cloud apps, not specifically for Copilot in Microsoft 365.

Answer

Configure Microsoft Defender for Cloud Apps to control Copilot

Answer

Disable Copilot for users who handle sensitive data

Answer

Apply sensitivity labels to all documents containing sensitive data

Question 8

Your organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. You discover that a user is accessing a sanctioned app from an unmanaged device. You need to ensure that when users access this app from unmanaged devices, they are prompted for additional authentication and their session is monitored. What should you configure?

Accepted Answer

Create a Conditional Access policy that uses the 'Require session control' grant and target 'All cloud apps' and 'Unmanaged devices' as conditions.. Option D is correct because you need to use a Conditional Access policy with the 'Require session control' grant, targeting 'All cloud apps' and 'Unmanaged devices' as conditions. This integrates with Microsoft Defender for Cloud Apps to enforce additional authentication (via Microsoft Entra ID) and enable session monitoring, such as real-time activity logging and download blocking, for the sanctioned app when accessed from unmanaged devices.

Answer

Enable Microsoft Entra ID Identity Protection and configure a sign-in risk policy.

Answer

Create a Conditional Access policy that requires device compliance and block access for non-compliant devices.

Answer

Create a session policy in Microsoft Defender for Cloud Apps that blocks downloads for all devices.

Question 9

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive information. You need to create a policy that prevents users from sharing credit card numbers via email, but allows them to share internally with other employees. The policy should also notify the user when an attempt is made to share externally. What should you configure?

Accepted Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.. Option B is correct because it uses the credit card number sensitive info type, restricts external sharing, and allows internal sharing. Option A is wrong because it blocks all sharing. Option C is wrong because it only provides user education, not blocking. Option D is wrong because it requires user override, but still blocks internal sharing.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Block access to content' for all recipients.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Allow override' with a business justification.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Notify user with policy tip' but no blocking.

Question 10

Which TWO of the following are capabilities of Microsoft Defender for Cloud?

Accepted Answer

Enable just-in-time access to virtual machines. Microsoft Defender for Cloud provides cloud security posture management (CSPM) and workload protection. Option B is correct because it offers CSPM via secure score. Option D is correct because it provides just-in-time VM access. Option A is wrong because that is Microsoft Defender for Identity. Option C is wrong because that is Microsoft Sentinel. Option E is wrong because that is Microsoft Intune.

Answer

Centralize security event log analysis from multiple sources

Answer

Monitor domain controllers for malicious activity

Answer

Manage mobile devices and enforce compliance policies

Question 11

Which THREE of the following are features of Microsoft Purview Communication Compliance?

Accepted Answer

Provide policy tips to users when they send potentially non-compliant messages. Microsoft Purview Communication Compliance helps detect policy violations in communications. Option A is correct because it can analyze Microsoft Teams messages. Option C is correct because it allows custom keyword dictionaries. Option E is correct because it provides policy tips to users. Option B is wrong because it is a feature of Microsoft Defender for Office 365. Option D is wrong because it is a feature of Microsoft Entra ID.

Answer

Automatically quarantine emails that contain malware

Answer

Enforce multi-factor authentication for sensitive roles

Question 12

Which TWO of the following are capabilities of Microsoft Defender for Office 365?

Accepted Answer

Scan email attachments in a sandbox environment before delivery. Option A is correct because Microsoft Defender for Office 365 includes Safe Attachments, which detonates email attachments in a virtual sandbox environment before delivery to the user's mailbox. This allows the service to analyze the file for malicious behavior without risking the recipient's device.

Answer

Enforce device compliance policies for mobile devices

Answer

Place a legal hold on mailboxes for eDiscovery

Answer

Monitor user behavior for compromised accounts

Question 13

You are reviewing a Microsoft Purview DLP policy configuration as shown in the exhibit. What is the expected behavior when a user sends an email containing a credit card number to an external recipient?

Accepted Answer

The email is blocked, and the user receives a policy tip notification.. The policy has a rule that blocks access for external sharing when credit card numbers are detected. Option A is correct because the policy blocks the email and notifies the user with a policy tip. Option B is wrong because the policy blocks external sharing. Option C is wrong because the policy does not allow override. Option D is wrong because the policy does not allow internal sharing.

Answer

The email is delivered, but the user receives a warning.

Answer

The email is delivered, and the user is asked to provide a business justification.

Answer

The email is blocked, but only if the recipient is external and internal recipients are allowed.

Question 14

You are a security administrator for a company that uses Microsoft 365. The company has a Microsoft Purview Data Loss Prevention (DLP) policy that blocks sharing of Social Security Numbers (SSNs) externally. Recently, a user accidentally sent an email containing SSNs to an external partner after overriding the policy by selecting a business justification. Management wants to prevent users from overriding the policy for SSNs. You need to update the DLP policy to ensure that users cannot override the block for SSNs. What should you do?

Accepted Answer

Modify the rule to set 'Allow override' to 'No' in the policy tip configuration.. Option A is correct because the 'Allow override' setting in the policy tip configuration directly controls whether users can bypass a DLP block action by providing a business justification. Setting this to 'No' prevents any override for the rule that blocks SSNs, ensuring that the block is enforced without exception. This is the specific mechanism in Microsoft Purview DLP to disable user overrides for a given rule.

Answer

Increase the rule priority to ensure it is enforced before other rules.

Answer

Remove the policy tip from the rule to prevent users from overriding.

Answer

Change the action from 'Block with override' to 'Block' and remove the policy tip.

Question 15

Your organization has implemented Microsoft Defender for Cloud to protect Azure resources. You are responsible for security posture management. You need to ensure that all Azure VMs have the latest security updates installed. You have enabled automatic VM patching via Azure Update Manager. However, some VMs are not receiving updates because they are not registered with the Update Manager. You need to identify which VMs are missing updates and ensure they are patched. What should you do?

Accepted Answer

Use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs.. Option A is correct because Microsoft Defender for Cloud provides a recommendation 'System updates should be installed on your machines' that identifies VMs missing updates. Option B is wrong because Azure Policy can enforce compliance but does not directly identify missing updates. Option C is wrong because Azure Update Manager's compliance view shows update status, but it may not show unregistered VMs. Option D is wrong because security alerts are for threats, not missing updates.

Answer

Create an Azure Policy to enforce automatic updates on all VMs.

Answer

Review Microsoft Defender for Cloud security alerts for 'Missing system updates'.

Answer

Use Azure Update Manager's compliance view to export a list of VMs with missing updates.