SC-900 Multiple Select — 50 Questions

Question 1

Which TWO of the following are capabilities of Microsoft Purview Information Protection?

Accepted Answer

Applying sensitivity labels to documents and emails. Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Applying sensitivity labels to documents and emails (Option D) is a core MIP capability, as labels enforce protection actions like encryption or visual markings. Encrypting content with Azure Rights Management (Option E) is the underlying technology that MIP uses to apply persistent protection, making it a direct capability of the solution.

Answer

Searching for content in eDiscovery

Answer

Preventing data loss via policies

Answer

Setting retention periods for content

Question 2

Which TWO features are part of Microsoft Purview Information Protection?

Accepted Answer

Automatic classification based on sensitive content. Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Automatic classification based on sensitive content (Option C) is a core capability of MIP, using built-in or custom sensitive information types to detect and label data automatically. Sensitivity labels (Option D) are the primary mechanism in MIP to apply protection actions such as encryption, access restrictions, and visual markings to documents and emails.

Answer

Communication monitoring

Answer

Retention policies

Answer

Audit log investigation

Question 3

Which THREE Microsoft Purview solutions help protect sensitive data in Microsoft 365? (Choose three.)

Accepted Answer

Data Loss Prevention. Data Loss Prevention (DLP) is correct because it identifies, monitors, and automatically protects sensitive data across Exchange Online, SharePoint, OneDrive, and Teams by applying policies that block or warn users when sensitive content (e.g., credit card numbers or PII) is shared inappropriately. It uses deep content analysis, including keyword matches, regex patterns, and machine learning classifiers, to enforce protection actions.

Answer

Audit

Answer

eDiscovery

Question 4

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Session controls for real-time monitoring of app usage. Microsoft Defender for Cloud Apps provides session controls that enable real-time monitoring and control of app usage. These controls use reverse proxy architecture to enforce policies on user activities within cloud apps, such as blocking downloads or requiring multi-factor authentication during a session.

Answer

Mobile device management

Answer

Device compliance enforcement

Answer

Email filtering and anti-phishing

Question 5

Which TWO capabilities are part of Microsoft Entra ID Governance?

Accepted Answer

Entitlement Management. Entitlement Management is a core capability of Microsoft Entra ID Governance because it enables organizations to manage the lifecycle of access for internal and external users through access packages, catalogs, and policies. It automates the request, approval, and assignment of access to groups, apps, and SharePoint sites, ensuring governance over who gets what and for how long. Access Reviews is also a key governance feature because it allows administrators to periodically review and certify user access, automatically removing stale or inappropriate permissions to maintain compliance.

Answer

Identity Protection

Answer

Conditional Access

Answer

Self-Service Password Reset

Question 6

Which TWO Microsoft Purview solutions can be used to identify and protect sensitive data in Microsoft 365?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is correct because it uses content analysis (e.g., keyword matching, regex patterns, and machine learning classifiers) to detect and automatically protect sensitive data like credit card numbers or PII across Exchange, SharePoint, OneDrive, and Teams. Sensitivity labels are correct because they classify and protect data at rest and in transit by applying encryption, visual markings, and access restrictions based on label policies, enabling persistent protection even when data leaves Microsoft 365.

Answer

Communication compliance

Answer

Insider risk management

Answer

eDiscovery

Question 7

Which TWO of the following are capabilities of Microsoft Purview Insider Risk Management? (Select TWO.)

Accepted Answer

Identify anomalous user activities such as mass file downloads. Microsoft Purview Insider Risk Management uses predefined risk indicators to detect anomalous user activities, such as mass file downloads, which may signal data theft or policy violations. These indicators are based on user behavior analytics and can be customized to align with organizational risk tolerance.

Answer

Review communications for policy violations

Answer

Conduct eDiscovery searches for legal cases

Answer

Block sharing of sensitive data via email

Question 8

A cybersecurity analyst uses Microsoft Sentinel to detect threats. Which THREE types of analytics rules can be created?

Accepted Answer

Scheduled query rules. Scheduled query rules are correct because they allow you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) to detect threats by analyzing log data from multiple sources. This is a core analytics rule type in Microsoft Sentinel for proactive threat detection based on time-based patterns.

Answer

Hunting rules

Answer

Machine learning rules

Question 9

Your organization uses Microsoft Entra ID. Which THREE authentication methods can be used for passwordless sign-in?

Accepted Answer

Microsoft Authenticator (phone sign-in). Microsoft Authenticator (phone sign-in) enables passwordless authentication by using a cryptographic key pair tied to the user's device. When signing in, the user approves a notification on their phone, and the Authenticator app signs the challenge with the private key, eliminating the need for a password.

Answer

SMS-based verification

Answer

Time-based one-time password (TOTP)

Question 10

Which TWO of the following are capabilities of Microsoft Purview Communication Compliance? (Select TWO.)

Accepted Answer

Enforce company policies on communication channels. Microsoft Purview Communication Compliance allows organizations to enforce company policies on communication channels such as email, Microsoft Teams, and third-party platforms. It does this by scanning communications for policy violations (e.g., insider trading, harassment) and enabling designated reviewers to take remediation actions like escalating or archiving messages.

Answer

Automatically apply sensitivity labels to documents

Answer

Prevent sharing of credit card numbers via email

Answer

Place legal holds on user mailboxes

Question 11

Which THREE components are part of Microsoft Entra Permissions Management (CIEM)?

Accepted Answer

Activity trail. Activity trail (A) is correct because Microsoft Entra Permissions Management (CIEM) captures a detailed log of all user actions and resource access events across multi-cloud environments (AWS, Azure, GCP). This trail is essential for forensic analysis and identifying anomalous behavior, directly supporting the CIEM goal of providing visibility into permissions usage.

Answer

Identity Protection

Answer

Access reviews

Question 12

Your organization is deploying Microsoft Purview. You need to automatically apply a sensitivity label to documents that contain passport numbers. Which TWO components must you configure?

Accepted Answer

Sensitive information type for passport numbers. A sensitive information type (SIT) for passport numbers defines the pattern and validation logic that Microsoft Purview uses to detect passport numbers in content. An auto-labeling policy then applies the specified sensitivity label automatically when the SIT is matched, enabling automated classification and protection without user intervention.

Answer

Retention label

Answer

Data loss prevention (DLP) policy

Answer

Trainable classifier

Question 13

Which THREE are features of Microsoft Defender for Cloud?

Accepted Answer

Just-in-time VM access. Just-in-time (JIT) VM access is a feature of Microsoft Defender for Cloud that reduces exposure to brute-force attacks by locking down inbound traffic to VMs. It allows you to control when specific ports (e.g., RDP port 3389 or SSH port 22) are opened on demand, based on role-based access control (RBAC) and approved requests, and automatically closes them after a configured time window.

Answer

Data classification

Answer

Incident investigation

Question 14

Which TWO of the following are benefits of using Microsoft Entra ID for identity management?

Accepted Answer

Single sign-on (SSO) to cloud applications. Single sign-on (SSO) and multi-factor authentication (MFA) are key benefits of Entra ID. Password hash synchronization is a feature of Entra Connect, not a direct benefit. On-premises Active Directory is a separate service. Security incident detection is more aligned with Microsoft Sentinel or Defender.

Answer

Password hash synchronization

Answer

Automated security incident detection

Answer

Replacement of on-premises Active Directory

Question 15

Which THREE are benefits of using Microsoft Purview Compliance Manager?

Accepted Answer

View a compliance score that indicates your overall compliance posture.. Compliance Manager provides a compliance score to indicate your overall compliance posture (B), suggests improvement actions to achieve compliance (D), and allows you to assign compliance tasks to other users (C). Option A is incorrect because Data Loss Prevention policies are created in the Microsoft Purview compliance portal, not directly in Compliance Manager. Option E is incorrect because automatically applying sensitivity labels is done through auto-labeling policies, not Compliance Manager.

Answer

Create Data Loss Prevention policies.

Answer

Automatically apply sensitivity labels to documents.

Question 16

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security Information and Event Management (SIEM). Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that collects and analyzes security data from across an enterprise. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response. These two core functions—SIEM and SOAR—are explicitly listed as features of Sentinel.

Answer

Data loss prevention

Answer

Endpoint detection and response

Answer

Identity governance

Question 17

A company wants to enforce multifactor authentication for all users. Which TWO Microsoft Entra ID features can be used together to achieve this?

Accepted Answer

Conditional Access. Conditional Access policies allow you to enforce multifactor authentication (MFA) based on specific conditions such as user, location, or device state. Authentication methods define the MFA verification options (e.g., Microsoft Authenticator, SMS, OATH tokens) that users can register and use. Together, Conditional Access triggers the MFA requirement, while Authentication methods control which verification methods are available.

Answer

Identity Protection

Answer

Security defaults

Answer

Password protection

Question 18

Which TWO capabilities are part of Microsoft Entra ID Protection? (Choose two.)

Accepted Answer

Risk-based conditional access policies. Risk-based conditional access policies (B) are a core capability of Microsoft Entra ID Protection, allowing organizations to automatically enforce access controls based on detected risk levels from user and sign-in activities. Reports on risky users and sign-ins (D) provide the foundational telemetry that Entra ID Protection uses to identify and investigate potential identity compromises, making both integral to the service.

Answer

Passwordless authentication

Answer

Just-in-time privileged access

Answer

Conditional access policies for device compliance

Question 19

Which TWO of the following are Microsoft Purview solutions that help protect sensitive data?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is a Microsoft Purview solution that helps protect sensitive data by identifying, monitoring, and automatically enforcing policies to prevent accidental or unauthorized sharing of sensitive information such as credit card numbers, social security numbers, or health records across services like Exchange, SharePoint, OneDrive, and Teams. Sensitivity labels are another Purview solution that protect sensitive data by allowing administrators to classify and apply protection (encryption, visual markings) to documents and emails, and enforce controls like 'Do Not Forward' or 'Encrypt-Only' based on the label's configuration.

Answer

Communication Compliance

Answer

eDiscovery

Answer

Insider Risk Management

Question 20

Which THREE are features of Microsoft Purview Data Lifecycle Management (formerly Records Management)? (Choose three.)

Accepted Answer

Retention policies. Retention policies are a core feature of Microsoft Purview Data Lifecycle Management because they allow administrators to apply retention settings at the container level (e.g., entire SharePoint site, Exchange mailbox, or OneDrive account) to automatically retain or delete content based on a defined schedule. This ensures that organizational data is kept for the required period and then removed, supporting compliance and governance requirements without manual intervention.

Answer

Data loss prevention

Answer

Sensitivity labels