Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 901–975

The PowerShell script utilizes the `New-MgUserAuthenticationPhoneMethod` cmdlet, which is specifically designed to add a new phone authentication method to a specified user's authentication methods in Microsoft Entra ID. This action registers a phone number, making it available for use in scenarios such as SMS-based multifactor authentication or passwordless sign-in, but does not inherently enable MFA itself. It's a foundational step for phone-based authentication.

Conditional Access policies are the primary method in Microsoft Entra ID for enforcing granular access controls, including multi-factor authentication (MFA). They evaluate conditions such as user, device, location, and application to determine if access should be granted, blocked, or require additional authentication methods like MFA, making them highly flexible for enforcing specific security requirements across an organization.

This option accurately describes the combined effect of common DLP policy actions. A Microsoft Purview DLP policy can be configured with multiple actions for a single rule. When BlockAccess is specified, it actively prevents the sharing attempt, ensuring the sensitive information remains within the defined boundaries. Concurrently, the NotifyUser action ensures that the individual attempting the prohibited action receives an immediate notification, explaining why their action was blocked and often providing guidance on compliance.

Auto-labeling automatically classifies documents based on content patterns.

Defense in depth is a cybersecurity strategy that employs multiple, overlapping security controls to protect information and systems. This layered approach ensures that if one security mechanism fails or is bypassed, other controls are in place to prevent or detect unauthorized access. The deployment of firewalls and intrusion detection systems, as described, exemplifies this strategy by creating successive barriers against threats.

Auto-labeling provides consistent classification and protection with minimal manual effort.

Microsoft Purview Information Barriers operate by defining distinct user segments based on specific user attributes and then applying policies to restrict communication and collaboration between these segments. To allow an employee to legitimately communicate and collaborate with others in the 'Traders' segment, their user account must be correctly assigned to that 'Traders' segment. This is typically achieved by updating the relevant user attribute in Microsoft Entra ID that defines the 'Traders' segment, ensuring compliance with the established IB policies.

Correct. Smart card login is authentication; then limiting access to department file shares is authorization.

Microsoft Defender SmartScreen is a security feature integrated into Microsoft Edge and other Windows components that provides real-time protection against phishing sites, malicious websites, and potentially unwanted software downloads. It actively checks websites and files against a dynamic list of reported malicious content, alerting users or blocking access to help prevent them from falling victim to social engineering attacks or malware infections. This direct, browser-level intervention is precisely what's needed to block users from accessing phishing websites.

Cloud Discovery, a core component of Microsoft Defender for Cloud Apps (MDCA), is specifically designed to analyze traffic logs from firewalls, proxies, and other network devices to identify all cloud applications accessed by users. This process enables organizations to gain comprehensive visibility into 'shadow IT' – unsanctioned cloud applications – and assess their associated risks, providing crucial insights into usage patterns across the environment.

Microsoft Purview Audit (Standard and Premium) is specifically designed to capture, retain, and enable searching of user and administrator activities across Microsoft 365 services via the unified audit log. This capability is crucial for security investigations, allowing organizations to identify who performed what action, when, and from where. It provides the necessary historical data to understand the scope and timeline of a security incident, directly addressing the need to investigate security events.

The shared responsibility model correctly defines the split of security tasks between the cloud provider and the customer based on the service model (IaaS, PaaS, SaaS). In this SaaS example, the provider handles infrastructure, and the customer handles data and access.

Microsoft Defender for Office 365 (MDO) is the correct solution as it provides advanced threat protection specifically for email and collaboration tools like Exchange Online, SharePoint, OneDrive, and Microsoft Teams. Its Safe Links feature proactively rewrites URLs in emails and Office documents, scanning them at the time of click to prevent access to malicious websites. Additionally, Safe Attachments sandboxes email attachments to detect and neutralize zero-day malware before it reaches user inboxes, directly addressing concerns about malicious content.

This option correctly assigns the distinct capabilities of each solution. Microsoft Purview Communication Compliance leverages machine learning and predefined or custom policies to proactively detect inappropriate content, including harassment, threats, and discriminatory language, across various communication channels. Concurrently, Microsoft Purview Data Loss Prevention (DLP) is precisely designed to identify and prevent the unauthorized sharing or leakage of sensitive information, such as credit card numbers, by applying policies that can block, warn, or encrypt data based on its content and context.

Microsoft Purview Data Loss Prevention (DLP) is specifically designed to automatically detect sensitive information types, such as credit card numbers or national IDs, across various Microsoft 365 services and endpoints. It then enforces policy-driven actions, including blocking email transmission, encrypting files, or notifying administrators, to prevent unauthorized sharing or leakage. This proactive capability directly addresses the requirement to automatically detect and protect sensitive information in real-time by preventing its inappropriate use or transfer.

Microsoft Intune's Mobile Device Management (MDM) capabilities are fundamental for organizations to enroll, configure, and secure a diverse range of corporate and personal devices, including Windows, iOS/iPadOS, Android, and macOS. This core feature enables the enforcement of device-level security policies, deployment of settings and certificates, and remote actions like wiping or locking, ensuring devices meet organizational compliance before accessing sensitive resources.

A Conditional Access policy in Microsoft Entra ID is the robust enforcement mechanism that evaluates various signals, including device compliance status reported by Intune, before granting access to cloud apps like email. It acts as the gatekeeper, allowing administrators to define conditions under which users can access resources. If a device is marked as non-compliant by Intune, a Conditional Access policy can then block access to sensitive applications, effectively linking device health to resource access.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It is explicitly designed to ingest security logs from diverse sources, including on-premises servers, network devices, and cloud services, through various data connectors like the Log Analytics agent. This centralized collection is fundamental for comprehensive threat detection, investigation, and automated response across hybrid environments.

Conditional Access can block or allow access based on device compliance status.

This policy type in Microsoft Purview is specifically designed to automatically apply sensitivity labels to content at scale, both at rest and in transit. It leverages conditions based on sensitive information types, keywords, or trainable classifiers to identify specific content patterns, ensuring consistent classification and protection without manual intervention. This directly fulfills the requirement for automatic data management.

Conditional Access policies are the primary mechanism in Azure AD for enforcing specific access controls based on various conditions, including user attributes, device state, location, and client applications. To effectively block legacy authentication, a Conditional Access policy can be configured to target 'Other clients' or 'Exchange ActiveSync clients' and then apply a 'Block access' grant control. This prevents older protocols such as POP, IMAP, and SMTP from authenticating, thereby mitigating associated security risks by forcing the use of modern authentication.

Regulatory records provide the highest level of protection, preventing deletion and modification.

Placing relevant sites on litigation hold, also known as an eDiscovery hold, is the precise and legally recognized mechanism within Microsoft Purview to preserve electronically stored information (ESI) indefinitely for legal or investigative purposes. This action overrides all existing retention policies and user deletion actions, ensuring that all content, including documents, emails, and versions, remains immutable and discoverable for the entire duration of the legal matter, regardless of any other retention settings.

For a Conditional Access policy to effectively target and block specific client application types, such as "Exchange ActiveSync clients" or "Other clients" (which often represent legacy authentication protocols), the `ClientAppTypes` condition must be explicitly configured. If this condition is empty or not selected, the policy will not apply to any particular client application type, thus failing to block legacy authentication attempts originating from those specific clients.

SMS-based authentication in Azure AD allows users to sign in to cloud applications by entering their registered phone number instead of a traditional username and password. Upon entering the phone number, a one-time passcode (OTP) is sent via SMS to that number, which the user then enters to complete authentication. This method provides a convenient, passwordless experience, directly leveraging the ubiquity of mobile phones and SMS for identity verification and fulfilling the requirement to sign in using a phone number.

Within Microsoft Entra Permissions Management, the Activity trail component meticulously records all user and resource actions performed across connected cloud environments, including AWS, Azure, and GCP. This comprehensive log details who accessed what resource, when, and how, providing critical visibility into the actual usage of granted permissions. It is essential for detecting anomalous behavior, identifying potential misuse of entitlements, and understanding the real-world impact of permission policies.

A regex pattern can detect the 'EMP-XXXXX' pattern.

Microsoft Defender for Office 365 is specifically engineered to protect against advanced threats in email and collaboration services like Exchange Online, SharePoint, OneDrive, and Microsoft Teams. Its Safe Links feature proactively rewrites URLs in emails and Office documents, then scans them at the time of click to prevent users from accessing malicious websites. Additionally, Safe Attachments sandboxes suspicious attachments, ensuring comprehensive protection against phishing and malware delivered via email.

Records Management for regulatory records and Data Lifecycle Management for non-records.

Installing a sensor on a domain controller is the correct action for deploying Microsoft Defender for Identity. The Defender for Identity sensor passively monitors network traffic to and from the domain controller, as well as Windows events directly from the domain controller itself. This strategic placement allows it to detect suspicious activities, lateral movement paths, and advanced persistent threats targeting Active Directory, providing critical insights into identity-based attacks.

Phone call (voice call) is a supported multi-factor authentication method where Microsoft Entra ID initiates an automated voice call to a user's registered phone number. To complete authentication, the user must answer the incoming call and typically press a specific key, such as the # key, on their phone's keypad to confirm their identity. This directly fulfills the requirement of a phone call for user verification.

Microsoft 365 Communication Compliance is specifically designed to proactively detect, investigate, and remediate policy violations within an organization's communications, including Microsoft Teams chats. It leverages machine learning to identify sensitive information, regulatory compliance issues, or inappropriate conduct based on customizable policies. This tool enables organizations to monitor ongoing conversations for potential risks and take corrective actions before they escalate.

Auto-labeling policies are specifically engineered to automatically apply sensitivity labels to content based on predefined conditions, such as the presence of specific sensitive information types, keywords, or patterns. These policies can be configured to apply labels to files at rest in SharePoint and OneDrive, or to emails and documents in Exchange, ensuring consistent classification without manual intervention. This direct application of labels fulfills the requirement for automatically classifying highly confidential information.

Microsoft Entra Conditional Access policies are the primary mechanism for enforcing access controls based on specific conditions, such as user location, device state, or application being accessed. By defining a policy that targets all users and requires MFA, an administrator can then create an exception for trusted IP ranges, effectively bypassing MFA when users are on the corporate network. This granular control over access based on real-time signals is central to Microsoft Entra ID P2 security capabilities.

The "Block with user notification" action is a robust enforcement mechanism that actively prevents the sharing of sensitive information, such as blocking an email from being sent or a file from being shared. Simultaneously, it displays a policy tip to the end-user, clearly informing them why the action was blocked and providing guidance on how to comply with organizational policies or remediate the issue. This combination effectively enforces data protection while educating users on acceptable data handling practices.

Advanced hunting allows deep search across data sources.

Digital signatures achieve non-repudiation by cryptographically binding a sender's identity to a message. The sender uses their unique private key to sign a hash of the document, creating a verifiable digital fingerprint. This signature, which can be validated by anyone with the sender's corresponding public key, provides irrefutable proof of origin and consent, ensuring the sender cannot legitimately deny having sent the message or performed the action.

Microsoft Defender for Office 365 is the correct solution because it provides advanced protection against sophisticated email and collaboration threats, including phishing, business email compromise, and malware delivered via email, Microsoft Teams, SharePoint, and OneDrive. It utilizes capabilities like Safe Attachments and Safe Links to scan content in real-time and includes automated investigation and response (AIR) for email-borne attacks, directly addressing the need to protect against email threats.

A sensitivity label, once created and configured, must be explicitly published through a label policy to become active and available for users or automatic application. Without being included in a policy and assigned to specific users or groups, the label remains in a draft state and cannot be applied, either manually or automatically, to documents or emails. This publishing step is critical for the label's operational deployment and is the most common reason for a configured label not being applied.

Enabling password hash synchronization in Microsoft Entra Connect is correct because it allows Microsoft Defender for Identity to analyze NTLM hashes and detect pass-the-hash attacks.

The Microsoft Defender XDR portal, accessible at security.microsoft.com, is the centralized console for managing and responding to threats across an organization's entire digital estate. It provides a unified security dashboard by integrating signals from Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps. This comprehensive view enables security analysts to correlate alerts, investigate incidents, and automate responses, making it the ideal solution for a unified security experience within Microsoft 365 E5.

Microsoft Purview Audit (Premium) is the correct solution because it provides advanced auditing capabilities specifically designed to capture and retain detailed user and admin activities across Microsoft 365 services. It offers extended retention of audit logs for up to one year (or 10 years with an add-on license) and access to crucial audit events like file and folder activities, enabling organizations to perform forensic investigations, respond to regulatory requests, and proactively monitor changes to sensitive files with high fidelity.

Defender for Cloud offers unified CSPM and threat protection for hybrid environments, including a regulatory compliance dashboard with built-in standards like NIST SP 800-53.

A KQL query that aggregates and counts EventID 4625 (failed login attempts) for individual user accounts within a specific timeframe is highly effective for detecting potential brute-force attacks. A significantly elevated number of failed login attempts against a single account or a small set of accounts strongly indicates an attacker systematically trying multiple password combinations. This pattern is a hallmark of brute-force activity.

Microsoft Defender for Endpoint is purpose-built for comprehensive endpoint security, offering advanced capabilities like Endpoint Detection and Response (EDR), vulnerability management, and automated investigation and remediation. It provides security operations teams with the tools to proactively hunt for threats across Windows devices, respond to incidents, and maintain a strong security posture against sophisticated cyberattacks, directly addressing the need for device protection and threat hunting.

Microsoft Purview DLP policies offer granular control, allowing administrators to define distinct policies for different service locations. By creating one policy specifically scoped to Exchange Online with a "block" action and a separate policy for Microsoft Teams with an "audit-only" action, the company can precisely meet the requirement. This approach leverages DLP's ability to apply varied enforcement levels based on the communication channel, ensuring sensitive data is protected appropriately in each context.

The 'Verify explicitly' principle is a cornerstone of the Zero Trust model, mandating that every access request to any resource must be fully authenticated, authorized, and validated based on all available contextual signals. This includes user identity, device health, location, service, and data classification, ensuring no implicit trust is ever granted. It requires continuous, real-time evaluation before granting access, regardless of whether the request originates inside or outside the traditional network perimeter.

Microsoft Entra Application Proxy is the correct solution for securely publishing on-premises web applications to external users. It achieves this by deploying a lightweight connector within the on-premises network, which establishes an outbound connection to Azure, creating a secure tunnel. This allows users to access internal web apps remotely with single sign-on capabilities, leveraging Entra ID's conditional access policies without requiring a VPN or opening inbound firewall ports.

This is the fundamental and most direct method to control which users or groups are authorized to access a specific enterprise application in Microsoft Entra ID. By assigning a group like 'SalesTeam' to the CRM application, you explicitly provision access for all members of that group, ensuring only authorized individuals can sign in and utilize the application. This method establishes the baseline access permissions for the application.

Microsoft Entra B2B (Business-to-Business) collaboration is the appropriate solution for enabling partner users to access applications and resources within your organization using their existing corporate or social identities. This feature creates guest user objects in your directory, allowing external users to authenticate with their home identity provider while granting them controlled access to your Microsoft Entra ID-protected resources without requiring complex federation setup.

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information such as credit card numbers across various locations. A DLP policy can be precisely configured to detect this sensitive data within documents and then automatically enforce actions like blocking external sharing. Furthermore, it can provide immediate, user-facing policy tips to educate individuals about the policy violation, making it the ideal solution for both prevention and user notification.

Microsoft Purview Data Estate Insights provides a comprehensive, high-level view of an organization's entire data landscape, including data sources like Azure SQL. It offers pre-built reports and metrics that highlight data classification, sensitivity label distribution, data ownership, and glossary adherence across the data estate. This enables organizations to monitor and demonstrate compliance with data privacy regulations by understanding where sensitive data resides and how it's governed.

Microsoft Defender for Office 365 is specifically engineered to protect an organization from sophisticated threats in email, links, and collaboration tools like Microsoft Teams. It leverages advanced anti-phishing, anti-malware, and Safe Attachments/Safe Links technologies to detect and block threats. Crucially, it includes Automated Investigation and Response (AIR) capabilities that automatically investigate alerts, determine the scope of a threat, and take recommended or approved remediation actions for email-borne attacks, directly addressing the requirement.

Zero Trust is the security model that fundamentally assumes no user, device, or application should be automatically trusted, regardless of its location inside or outside the network perimeter. It mandates explicit verification for every access request, ensuring identity and device health are validated before granting access. This model strictly enforces least privilege access and operates under an 'assume breach' mentality, continuously monitoring and re-validating trust throughout a session.

Retention policies enforce data retention for a defined period.

Access Reviews are specifically designed for periodically reviewing user access to resources, including guest users. By configuring an Access Review to auto-apply results, access can be automatically revoked if reviewers do not respond or deny access. Crucially, the 'Delete users' setting within the review can be enabled to automatically remove guest user objects from Microsoft Entra ID after a specified number of days if their access is denied or not re-certified, directly addressing the need for automated guest cleanup.

This is the correct approach because Microsoft Entra Conditional Access policies, combined with authentication strengths, are designed to enforce specific authentication methods. By configuring a policy to 'Require authentication strength' and selecting 'Passwordless MFA', administrators can explicitly mandate that users authenticate using only passwordless methods, such as FIDO2 security keys or Windows Hello for Business. This effectively blocks any sign-in attempt that relies on a password as the primary credential, thereby achieving a truly passwordless environment.

Microsoft Entra External ID (B2C) is specifically engineered to manage customer identities for consumer-facing applications and services, such as an e-commerce website. It enables users to sign up and sign in using their preferred social identity providers, such as Google, Facebook, or Apple, or by creating a local account. This service provides highly customizable user experiences for registration, sign-in, and profile management, scaling to millions of users while integrating seamlessly with your platform.

Conditional Access policies evaluate various signals, including user location, device compliance, and sign-in risk, to determine if access should be granted or blocked. A policy configured to restrict access to sensitive documents from untrusted or unapproved geographic locations would explicitly override any inherent sensitivity label permissions, directly causing the user's inability to access the document.

Microsoft Entra lifecycle workflows are specifically designed to automate user lifecycle events, including offboarding. These workflows can be configured to automatically disable a user account, remove them from specified groups, and revoke application access immediately upon a termination event, often triggered by changes synced from an HR system. This ensures timely, consistent, and comprehensive removal of access, directly addressing the requirement for efficient and secure offboarding.

This action effectively prevents data loss by blocking the transmission of the message containing sensitive information, ensuring the policy is enforced. Simultaneously, it provides a policy tip to the user, explaining why the message was blocked and offering guidance on how to remediate the issue or comply with organizational policies. This combination both enforces security and educates the user, aligning perfectly with robust data loss prevention objectives.

Microsoft Purview Data Loss Prevention (DLP) is specifically engineered to identify, monitor, and protect sensitive information across Microsoft 365, including email communications. It leverages sensitive information types, keywords, and trainable classifiers to detect specific content patterns. Upon detection, DLP policies can automatically enforce a range of protective actions, such as blocking email delivery, encrypting messages, applying specific retention labels, or providing policy tips to users, directly addressing the need for automatic detection and enforcement.

Microsoft 365 Defender is an Extended Detection and Response (XDR) solution that unifies security signals from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. It correlates alerts across these domains into consolidated incidents, providing a comprehensive view of attacks and enabling automated, cross-domain response actions. This integrated approach significantly enhances an organization's ability to detect, investigate, and remediate sophisticated multi-stage threats.

App registration in Microsoft Entra ID is the essential process for integrating an application to use Entra ID as its identity provider. By registering an application, administrators define how users authenticate, grant necessary permissions, and configure single sign-on (SSO) protocols like OpenID Connect or SAML. This direct integration enables users to access the registered application seamlessly using their existing Entra ID credentials without re-entering them, thereby providing a unified SSO experience.

Litigation hold is specifically designed to preserve all electronically stored information (ESI) within a user's mailbox, including active items, deleted items, and even items modified after the hold is placed. It places an indefinite hold on content, preventing users from permanently deleting items and ensuring data immutability for legal discovery or investigation purposes. This mechanism is crucial for meeting eDiscovery requirements by ensuring no relevant data is lost.

Azure AD Application Proxy securely publishes on-premises web applications, making them accessible to remote users without requiring a VPN or inbound firewall rules. It leverages a lightweight connector installed within the corporate network, which establishes an outbound-only connection to the Azure AD Application Proxy service. This allows users to pre-authenticate with Entra ID, apply Conditional Access policies, and then access the internal application via a secure proxy URL, providing single sign-on capabilities.

Device state condition can be set to require a device to be compliant (as defined in Intune) or hybrid Microsoft Entra ID joined. This is the correct condition to enforce access based on device compliance.

Microsoft Purview Communication Compliance is specifically designed to help organizations detect, investigate, and remediate policy violations in communications. It leverages machine learning and customizable dictionaries to identify problematic content, such as potential insider trading code words, across various communication channels. This solution provides a structured workflow for supervisory review, allowing designated personnel to examine flagged messages, assign them for further investigation, and take appropriate action, directly addressing the need for content flagging and review.

Sensitivity labels allow organizations to classify and protect sensitive content by applying persistent encryption, visual markings, and access restrictions directly to documents and emails. This ensures the financial reports are encrypted regardless of where they are stored or shared. Data Loss Prevention (DLP) policies then complement this by detecting sensitive information and actively preventing its unauthorized forwarding or sharing based on predefined rules, thus providing comprehensive protection.

Auto-labeling applies sensitivity label; retention label retains personal data for 5 years; DLP blocks cross-border sharing; manual label provides encryption and watermark; audit logging tracks access.

Authorization is the critical security process that determines what an authenticated user is permitted to do or access within a system. After a user successfully authenticates with a smart card, the system consults predefined policies, roles, and permissions to evaluate whether that user has the necessary rights to perform a specific action, such as accessing a particular database. This evaluation directly leads to the decision of whether access is granted or denied.

Conditional Access evaluates signals like device compliance to enforce access controls.

Microsoft Defender for Cloud Apps functions as a Cloud Access Security Broker (CASB), providing comprehensive visibility and control over both sanctioned and unsanctioned cloud applications, including Microsoft 365 and third-party SaaS. It excels at detecting anomalous user behavior through advanced analytics, such as impossible travel. This capability specifically identifies suspicious sign-ins originating from geographically disparate locations within an unusually short timeframe, directly addressing the need for detecting such anomalies across various cloud services.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It excels at collecting security data from diverse sources across an organization's entire digital estate, including Azure, on-premises, and other clouds, through built-in data connectors. Sentinel then uses AI and machine learning to detect, investigate, and respond to threats efficiently, making it ideal for comprehensive security event collection and analysis.

Mail flow rules, also known as transport rules in Exchange Online, are powerful tools that allow administrators to inspect, modify, or route email messages based on specific conditions. These rules operate at the transport layer, enabling actions such as adding disclaimers, blocking messages, encrypting content, or redirecting mail before it reaches the recipient's inbox. Applying a standardized disclaimer to all external emails is a classic and direct application of a mail flow rule's capabilities.