SC-900 Which Command Should the Administrator Use Practice Questions

Explanation: The principle of least privilege states that users should be granted only the minimum level of access (permissions) needed to perform their job functions. Role-based access control (RBAC) is often used to enforce this principle. Defense in depth uses multiple layers of security. Separation of duties prevents a single individual from having conflicting roles (e.g., authorizing and executing a transaction). Zero trust is a broader security model that assumes no implicit trust and requires continuous verification.

Explanation: A retention policy in Microsoft Purview can be applied to a SharePoint site to enforce a specified retention period (e.g., 5 years) and then automatically delete the content. Retention policies prevent users from permanently deleting content before the retention period ends. A sensitivity label is used for classification and protection (encryption, access control), not retention alone. A data loss prevention (DLP) policy prevents sharing of sensitive data but does not enforce retention. An audit policy enables logging but does not enforce retention or deletion.

Explanation: The principle of least privilege dictates that users should be granted the minimum level of access required to accomplish their tasks. This reduces the risk of accidental or malicious misuse of permissions. Segregation of duties involves splitting critical tasks among multiple people to prevent fraud. Defense in depth uses multiple layers of security controls. Zero Trust is a broader security model that assumes no implicit trust. The scenario directly describes least privilege.

Explanation: Microsoft Entra hybrid join allows a device to be joined to both an on-premises Active Directory domain and Microsoft Entra ID. This enables single sign-on to both on-premises and cloud resources and allows Conditional Access policies based on the device. Microsoft Entra joined devices are cloud-only, registered devices are only registered but not joined, and on-premises domain join alone does not integrate with Azure AD.

Explanation: eDiscovery (Premium) in Microsoft Purview includes features such as holds, which allow organizations to preserve content relevant to legal cases. A hold overrides any deletion policies (e.g., from Data Lifecycle Management) and ensures that the content is retained until the hold is removed. Data Lifecycle Management is used for routine retention and deletion based on policy, but holds take precedence. Audit (Premium) tracks activities but does not preserve data. Communication Compliance monitors communications for policy violations but does not prevent deletion.