SC-900 Describe the capabilities of Microsoft security solutions Practice Test 22 — 15 Questions

Question 1

A company uses Microsoft Intune to manage its devices. The security team wants to enforce that all devices running Windows 11 must have BitLocker enabled and a minimum operating system build version. Which Intune policy type should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Compliance policy. Compliance policies in Microsoft Intune define the rules and settings that devices must meet to be considered compliant, such as requiring BitLocker encryption and a minimum OS build version. When a device fails to meet these conditions, Intune can mark it as non-compliant and trigger conditional access policies to block access to corporate resources. This makes compliance policy the correct choice for enforcing security baselines like BitLocker and OS version requirements.

Answer

Configuration profile

Answer

Enrollment restriction

Answer

App protection policy

Question 2

Your organization uses Microsoft Defender XDR. You need to investigate a potential lateral movement attack where a compromised user account is used to access multiple workstations. Which feature should you use to visualize the attack path?

Accepted Answer

Attack graph. Attack graph in Microsoft Defender XDR is the correct feature because it automatically maps and visualizes the potential paths an attacker could take to move laterally across devices using compromised credentials. It correlates alerts and incidents to show the sequence of events, such as a user account authenticating to multiple workstations, enabling security teams to identify the scope and entry point of the attack.

Answer

Microsoft Sentinel workbooks

Answer

Threat analytics in Microsoft 365 Defender

Answer

Incident queue

Question 3

A company uses Microsoft Purview to classify and label data. The compliance team needs to automatically apply a 'Highly Confidential' sensitivity label to any document containing a passport number that is stored in SharePoint Online. The label should also encrypt the document. What should the compliance team configure?

Accepted Answer

Create an auto-labeling policy for sensitivity labels. Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents based on conditions such as the presence of sensitive information types (e.g., passport numbers). When configured, the policy can also enforce encryption as part of the label's protection settings, ensuring that any document stored in SharePoint Online containing a passport number is automatically labeled 'Highly Confidential' and encrypted.

Answer

Create a retention label with a retention rule

Answer

Create a data loss prevention (DLP) policy

Answer

Create a manual sensitivity label and train users

Question 4

Your organization wants to enable passwordless authentication for users. Which Microsoft Entra ID feature should you use?

Accepted Answer

Passwordless authentication methods. Passwordless authentication methods is the correct feature because it is the specific Microsoft Entra ID capability that allows users to sign in without a password, using methods such as Windows Hello for Business, the Microsoft Authenticator app, FIDO2 security keys, or phone sign-in. This directly enables the organization's goal of passwordless authentication.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 5

A security analyst in your organization receives an alert from Microsoft Defender XDR indicating that a user's device may be infected with ransomware. The analyst needs to immediately isolate the device from the network to prevent further spread. What should the analyst do?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation. Microsoft Defender for Endpoint includes a built-in device isolation capability that can be triggered directly from the Microsoft Defender XDR portal. This action immediately disconnects the device from all network communications (except the Defender service) to contain a confirmed ransomware infection, preventing lateral movement while allowing forensic analysis.

Answer

Revoke the user's session in Microsoft Entra ID

Answer

Open Microsoft Sentinel and run a playbook

Answer

Use Microsoft Intune to wipe the device

Question 6

Your company uses Microsoft 365 Copilot to assist employees with drafting emails and documents. The security team needs to ensure that when Copilot accesses sensitive data, it respects the organization's sensitivity labels and does not expose highly confidential information to unauthorized users. What should the security team configure?

Accepted Answer

Apply Microsoft Purview sensitivity labels to data and enable Copilot data protection. Microsoft Purview sensitivity labels are integrated with Microsoft 365 Copilot to enforce data protection. When sensitivity labels are applied to data, Copilot respects those labels and restricts access to authorized users only. Option A is incorrect because Microsoft Defender for Cloud Apps session policies govern access to cloud apps, not Copilot's handling of labeled data. Option C is incorrect because disabling Copilot for all users would prevent any use, not just sensitive data access. Option D is incorrect because data loss prevention policies block sharing of sensitive data but do not control Copilot's internal access to labeled content.

Answer

Configure Microsoft Defender for Cloud Apps session policies

Answer

Disable Copilot for all users

Answer

Create a data loss prevention policy that blocks Copilot

Question 7

A company uses Microsoft Purview Data Lifecycle Management. To comply with regulatory requirements, the company must retain financial records for 7 years and then delete them. Which THREE actions should the company configure? (Select THREE.)

Accepted Answer

Create a retention label with a retention period of 7 years. A retention label with a 7-year retention period allows you to apply specific retention and deletion rules to individual documents, such as financial records, rather than to an entire site. This granularity is necessary when only a subset of content within a SharePoint site must be retained for compliance.

Answer

Create a data loss prevention policy

Answer

Create a retention policy for the entire SharePoint site

Question 8

Your organization, Contoso Ltd., uses Microsoft 365 and Microsoft Defender XDR. You are a security administrator. Recently, a user named John Doe reported that his account is sending phishing emails internally. You suspect his account is compromised. You need to contain the threat immediately while preserving forensic data. The company has the following security solutions: Microsoft Entra ID P2, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, Microsoft Sentinel, and Microsoft Purview. You need to prevent the compromised account from causing further damage. Which action should you take first?

Accepted Answer

Disable the user account in Microsoft Entra ID. Disabling the user account in Microsoft Entra ID immediately prevents the compromised account from initiating any new actions, including sending phishing emails. This is the fastest containment step while preserving forensic data. Option A (reset password) is incorrect because it does not terminate active sessions; the attacker may still have a valid token. Option B (revoke refresh tokens) is a useful step but is not as immediate as disabling the account, and it may not stop all sessions. Option D (create mail flow rule) is too slow and may not affect sessions already authenticated.

Answer

Reset the user's password and require a password change

Answer

Revoke all refresh tokens for the user in Microsoft Entra ID

Answer

Create a mail flow rule in Exchange Online to block the user's emails

Question 9

You are a compliance officer at a healthcare organization that uses Microsoft 365. The organization must comply with HIPAA regulations. You have Microsoft Purview, Microsoft Defender for Cloud Apps, and Microsoft Intune. You need to ensure that all devices accessing patient health information (PHI) are compliant with the organization's security policies, which require device encryption, a minimum OS version, and the use of a compliant mobile device management (MDM) provider. Currently, some devices are not managed by Intune. You need to enforce that only compliant devices can access PHI stored in SharePoint Online. What should you do?

Accepted Answer

Configure a conditional access policy in Microsoft Entra ID to require compliant devices. A conditional access policy in Microsoft Entra ID can be configured to require that devices accessing SharePoint Online be marked as compliant. Device compliance is determined by Intune compliance policies (covering encryption, OS version, MDM enrollment) but the enforcement is done via conditional access. Option A is wrong because creating a compliance policy alone does not enforce the requirement; you need a conditional access policy to block non-compliant devices. Option B is wrong because app protection policies manage data access at the app level but do not enforce device compliance (e.g., OS version or device encryption). Option D is wrong because DLP policies focus on preventing data leakage, not on device compliance.

Answer

Create a device compliance policy in Microsoft Intune and assign it to all users

Answer

Deploy an app protection policy in Microsoft Intune to restrict data access

Answer

Create a DLP policy in Microsoft Purview to block access from non-compliant devices

Question 10

Your company is adopting Microsoft Copilot for Microsoft 365 to improve productivity. The security team is concerned about data leakage, as Copilot can access emails, documents, and other content. You need to ensure that sensitive data, such as credit card numbers and social security numbers, is not inadvertently exposed by Copilot. The organization uses Microsoft Purview sensitivity labels and DLP. You need to configure a solution that automatically detects and prevents Copilot from accessing or generating content containing these sensitive data types. What should you do?

Accepted Answer

Create a DLP policy in Microsoft Purview that detects sensitive data types and blocks Copilot actions. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive data types (e.g., credit card numbers, social security numbers) and automatically block or warn when Copilot for Microsoft 365 attempts to access or generate content containing such data. Option A is incorrect because Microsoft Defender for Cloud Apps is designed to control cloud app usage, but it does not integrate directly with Copilot for content-level data loss prevention. Option B is incorrect because disabling Copilot for certain users is a blunt approach that impacts productivity and does not provide targeted protection against data leakage. Option C is incorrect because while sensitivity labels help classify data, they alone do not prevent Copilot from accessing or generating sensitive content; DLP policies are required to enforce protection based on those labels.

Answer

Configure Microsoft Defender for Cloud Apps to control Copilot

Answer

Disable Copilot for users who handle sensitive data

Answer

Apply sensitivity labels to all documents containing sensitive data

Question 11

Your organization uses Microsoft Defender for Cloud Apps to monitor cloud app usage. You discover that a user is accessing a sanctioned app from an unmanaged device. You need to ensure that when users access this app from unmanaged devices, they are prompted for additional authentication and their session is monitored. What should you configure?

Accepted Answer

Create a Conditional Access policy that uses the 'Require session control' grant and target 'All cloud apps' and 'Unmanaged devices' as conditions.. You need to use a Conditional Access policy with the 'Require session control' grant, targeting 'All cloud apps' and 'Unmanaged devices' as conditions. This integrates with Microsoft Defender for Cloud Apps to enforce additional authentication (via Microsoft Entra ID) and enable session monitoring, such as real-time activity logging and download blocking, for the sanctioned app when accessed from unmanaged devices.

Answer

Enable Microsoft Entra ID Identity Protection and configure a sign-in risk policy.

Answer

Create a Conditional Access policy that requires device compliance and block access for non-compliant devices.

Answer

Create a session policy in Microsoft Defender for Cloud Apps that blocks downloads for all devices.

Question 12

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive information. You need to create a policy that prevents users from sharing credit card numbers via email, but allows them to share internally with other employees. The policy should also notify the user when an attempt is made to share externally. What should you configure?

Accepted Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Block external sharing' but allow internal sharing, and enable user notifications.. Microsoft Purview DLP allows you to configure a policy that blocks external sharing of sensitive data (credit card numbers) while permitting internal sharing, and user notifications can be enabled to alert users when they attempt to share externally. This meets the requirement to prevent external sharing, allow internal sharing, and notify the user.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Block access to content' for all recipients.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Allow override' with a business justification.

Answer

Create a DLP policy with the condition 'Content contains credit card number' and action 'Notify user with policy tip' but no blocking.

Question 13

You are reviewing a Microsoft Purview DLP policy configuration as shown in the exhibit. What is the expected behavior when a user sends an email containing a credit card number to an external recipient?

Accepted Answer

The email is blocked, and the user receives a policy tip notification.. The DLP policy is configured to block external sharing when credit card numbers are detected. When a user sends an email with a credit card number to an external recipient, the email is blocked and the user receives a policy tip notification. Option A is incorrect because the email is not delivered. Option B is incorrect because the email is blocked, not delivered with a justification prompt. Option C is incorrect because the policy blocks external recipients regardless of internal allowance.

Answer

The email is delivered, but the user receives a warning.

Answer

The email is delivered, and the user is asked to provide a business justification.

Answer

The email is blocked, but only if the recipient is external and internal recipients are allowed.

Question 14

You are a security administrator for a company that uses Microsoft 365. The company has a Microsoft Purview Data Loss Prevention (DLP) policy that blocks sharing of Social Security Numbers (SSNs) externally. Recently, a user accidentally sent an email containing SSNs to an external partner after overriding the policy by selecting a business justification. Management wants to prevent users from overriding the policy for SSNs. You need to update the DLP policy to ensure that users cannot override the block for SSNs. What should you do?

Accepted Answer

Modify the rule to set 'Allow override' to 'No' in the policy tip configuration.. The 'Allow override' setting in the policy tip configuration directly controls whether users can bypass a DLP block action by providing a business justification. Setting this to 'No' prevents any override for the rule that blocks SSNs, ensuring that the block is enforced without exception. This is the specific mechanism in Microsoft Purview DLP to disable user overrides for a given rule.

Answer

Increase the rule priority to ensure it is enforced before other rules.

Answer

Remove the policy tip from the rule to prevent users from overriding.

Answer

Change the action from 'Block with override' to 'Block' and remove the policy tip.

Question 15

Your organization has implemented Microsoft Defender for Cloud to protect Azure resources. You are responsible for security posture management. You need to ensure that all Azure VMs have the latest security updates installed. You have enabled automatic VM patching via Azure Update Manager. However, some VMs are not receiving updates because they are not registered with the Update Manager. You need to identify which VMs are missing updates and ensure they are patched. What should you do?

Accepted Answer

Use the Microsoft Defender for Cloud recommendation 'System updates should be installed on your machines' to identify VMs missing updates, then enable auto-patching for those VMs.. Microsoft Defender for Cloud provides the recommendation 'System updates should be installed on your machines' that identifies VMs missing updates, including those not registered with Azure Update Manager. Option A is incorrect because Azure Policy can enforce compliance but does not directly identify missing updates. Option C is incorrect because Azure Update Manager's compliance view shows update status for registered VMs but may not show unregistered VMs. Option D is incorrect because security alerts are for threats, not missing updates.

Answer

Create an Azure Policy to enforce automatic updates on all VMs.

Answer

Review Microsoft Defender for Cloud security alerts for 'Missing system updates'.

Answer

Use Azure Update Manager's compliance view to export a list of VMs with missing updates.