Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 1201–1275

Microsoft Defender for Office 365 is the dedicated security service engineered to protect an organization's email, collaboration, and productivity tools within Microsoft 365 from advanced threats. It employs robust capabilities like Safe Attachments, which detonates suspicious attachments in a sandbox environment, and Safe Links, which rewrites and scans URLs at the time of click. This comprehensive protection specifically targets ransomware, phishing, business email compromise, and other sophisticated malware delivered via email or Microsoft Teams, making it the correct solution for detecting email-borne ransomware.

Microsoft Entra ID P1 is the minimum required license tier to enable Self-Service Password Reset (SSPR) with password writeback in a hybrid identity environment. This tier provides the necessary functionality to allow users to reset their passwords in the cloud, and then have those changes securely synchronized back to their corresponding accounts in the on-premises Active Directory. This ensures a consistent password across both environments and fulfills the requirements of the question.

Cloud Security Posture Management (CSPM) is the foundational capability within Microsoft Defender for Cloud that provides continuous, real-time assessment of an organization's security posture across its cloud environments. It automatically identifies misconfigurations, vulnerabilities, and compliance deviations against industry benchmarks like CIS and regulatory standards. CSPM generates a secure score, offering actionable recommendations to improve security and maintain compliance, making it the direct answer for assessing posture.

DLP evaluates Teams chat and channel messages against sensitivity labels and sensitive information types, then blocks or warns on policy matches. This provides automatic detection and prevention of accidental sensitive-data sharing in Teams, which is the exact control the scenario requires.

Compliance Manager continuously calculates a compliance score from your implemented controls against GDPR and ISO 27001 assessments, then supplies recommended improvement actions and tracks remediation progress over time, directly satisfying the continuous-assessment and scoring requirements in the stem.

Conditional Access policies, specifically when configured with session controls and leveraging Continuous Access Evaluation (CAE), are designed to provide real-time verification during an active user session. CAE allows Microsoft Entra ID to revoke access tokens almost instantly in response to critical security events, such as a user's account being disabled, a password change, or a change in MFA location. This ensures that access is continuously evaluated against policy requirements throughout the session, not just at initial sign-in, making it the correct solution for continuous verification.

Cloud Discovery analyses traffic logs from firewalls and proxies to identify unsanctioned cloud apps, directly satisfying the shadow IT discovery requirement. It builds an app catalogue with risk scores, letting you sanction or block usage. Other Defender for Cloud Apps features, such as app connectors or anomaly policies, govern known apps rather than reveal unknown ones.

A Conditional Access policy is the definitive control plane in Microsoft Entra ID for enforcing specific access requirements, such as multi-factor authentication (MFA), based on various conditions. By targeting 'All guest and external users' and requiring MFA, organizations can ensure that all external collaborators must satisfy this strong authentication method before accessing resources, regardless of their home tenant's policies. This provides a robust security posture for external access by integrating MFA directly into the sign-in flow.

Microsoft Purview DLP inspects Exchange Online mail flow, applying sensitive information type regex and checksum validation to detect credit card numbers, then enforcing policy tips, block or encrypt actions. This satisfies the stem's capability requirement for email-borne payment card data.

Microsoft Entra Conditional Access is the primary policy engine within Microsoft Entra ID for enforcing access decisions based on various conditions, including user location. By configuring "named locations," administrators can define specific trusted or untrusted IP address ranges. A Conditional Access policy can then be created to explicitly block sign-in attempts originating from these designated malicious IP ranges or from anonymous IP addresses, directly addressing the requirement to prevent access from specific unwanted network origins.

Explicit verification authenticates and authorises every access request using all available signals, regardless of network origin. This directly satisfies the zero-trust requirement to treat internal requests as untrusted, rather than granting implicit trust based on corporate network location.

Activity policies in Microsoft Defender for Cloud Apps are designed to monitor user and admin activities across connected cloud applications. They allow organizations to define specific conditions, such as access from a risky IP address or unusual download volumes, and then trigger alerts or automated governance actions when these conditions are met. This makes them ideal for detecting and responding to suspicious behavior or policy violations after an activity has occurred, providing crucial visibility into potential threats.

Microsoft Purview Communication Compliance is purpose-built to help organizations detect, investigate, and act on inappropriate messages within their Microsoft 365 environment. It leverages machine learning and customizable policies to identify potential policy violations, such as harassment, threats, or regulatory non-compliance, across various communication channels. This solution provides a structured workflow for reviewers to examine flagged communications and take appropriate remedial action.

Non-repudiation is the assurance that a party cannot legitimately deny having performed a specific action or sent a particular message. In the context of financial stock trades, a digital signature cryptographically binds the unique identity of the trader (via their private key) to the specific trade instruction. This creates undeniable, legally admissible proof that the trader authorized and executed that particular transaction, preventing them from later disavowing their actions.

Users and groups are a fundamental component of Conditional Access policies, defining the scope of identities to which a policy applies. This 'who' element allows administrators to target specific users, security groups, or directory roles, or to exclude certain identities from policy enforcement. By precisely defining the user scope, policies can be tailored to ensure appropriate access for different organizational segments while preventing unintended restrictions or permissions.

Defense in depth is a comprehensive cybersecurity strategy that employs multiple, overlapping security controls to protect assets and data. By deploying a firewall, the company is establishing a perimeter defense, which constitutes one critical layer in a multi-layered security architecture. This approach ensures that if one security control fails or is bypassed, other controls are already in place to prevent or detect an intrusion, significantly enhancing overall resilience against various threats.

Data integrity ensures that information remains accurate, complete, and unaltered throughout its lifecycle, protecting against unauthorized modification or destruction. In this scenario, an attacker directly modified patient diagnoses, which fundamentally compromises the trustworthiness and reliability of the medical records. This unauthorized alteration is a clear violation of the integrity principle, as the data no longer reflects its original, correct state.

ID Protection detects risk events such as sign-ins from malicious IP addresses and leaked credentials. It can be configured with risk policies to automatically block sign-ins or require password changes. It also generates alerts and reports. This directly matches the requirement to block malicious IP sign-ins and alert on leaked credentials.

This rule type is fundamental for proactive threat detection in Microsoft Sentinel, enabling security analysts to define and execute custom KQL queries against ingested log data on a recurring schedule. It allows for specifying a precise query interval and a lookback period, triggering an alert only when the query results meet a predefined numerical threshold. This makes it ideal for identifying specific patterns, event counts, or conditions over a chosen time window.

Microsoft Defender for Endpoint is specifically designed to provide comprehensive Endpoint Detection and Response (EDR), next-generation protection, automated investigation and remediation, and vulnerability management across endpoints. It offers advanced capabilities like threat hunting, attack surface reduction, and deep visibility into endpoint activities. This makes it the ideal solution for monitoring and proactively defending against advanced threats on servers, workstations, and cloud virtual machines.

Cloud Security Posture Management (CSPM) continuously monitors cloud environments (IaaS, PaaS, SaaS) for misconfigurations, policy violations, and deviations from security best practices. It provides actionable recommendations to remediate identified issues, thereby proactively improving the overall security posture and reducing the attack surface. Microsoft Defender for Cloud's core CSPM capabilities include Secure Score, asset inventory, and security recommendations.

A Data Loss Prevention (DLP) policy is purpose-built to identify, monitor, and protect sensitive information from being inappropriately shared, transferred, or used. These policies leverage predefined or custom rules to detect specific sensitive content, such as financial data or intellectual property, within documents across various locations and then enforce actions like blocking sharing, encrypting the data, or alerting administrators. DLP policies are highly effective in preventing unauthorized sharing of sensitive documents to external parties or unapproved cloud services, directly addressing the organization's protection requirement.

Microsoft Entra ID Identity Protection actively monitors and analyzes various signals in real-time to detect suspicious sign-in attempts. These signals include unfamiliar locations, impossible travel, infected devices, and anonymous IP addresses, indicating a potential compromise of user credentials. By identifying these risky sign-ins, Identity Protection helps organizations prevent unauthorized access and enforce adaptive access policies, such as requiring multi-factor authentication or blocking access.

Microsoft Defender for Identity (MDI) is purpose-built to detect advanced threats targeting on-premises Active Directory and hybrid identity environments. It monitors domain controllers and network traffic for suspicious activities, leveraging behavioral analytics to identify credential theft, lateral movement, and sophisticated attacks like Pass-the-Hash or Golden Ticket. MDI provides specialized insights into identity-based threats, enabling rapid investigation and response to protect critical authentication infrastructure.

Compliance management is the overarching discipline that ensures an organization adheres to external laws, regulations, and internal policies, such as HIPAA. It involves establishing frameworks, implementing controls, conducting risk assessments, monitoring adherence, and maintaining documentation to systematically meet all regulatory requirements and demonstrate due diligence to auditors and regulators.

Retention labels in Microsoft Purview Data Lifecycle Management are specifically designed to apply precise retention settings, such as a 7-year retention period, to individual items like documents or emails. This allows for granular control over the lifecycle of specific content types, ensuring that financial records, for instance, are retained for the exact required duration based on regulatory or business needs. Labels can also trigger actions like disposition reviews at the end of the retention period.

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) solution. It excels at collecting security data from virtually any source, including Azure services, on-premises infrastructure, other cloud providers (AWS, GCP), and third-party applications. Sentinel leverages AI and machine learning for intelligent threat detection, provides advanced analytics for correlating events, and enables automated responses through integrated SOAR playbooks, making it ideal for comprehensive security log analysis and incident management.

A common reason for portal access issues, especially after a password reset or if the user has new devices, is an outdated or missing multi-factor authentication (MFA) registration. If conditional access policies require MFA for portal access, and the user's registered methods (e.g., Microsoft Authenticator, phone number) are incorrect or not configured, they will be blocked from signing in. Verifying and potentially resetting these methods in Microsoft Entra ID is a critical troubleshooting step to restore access.

Auto-labelling policies run service-side scans against SharePoint Online content, detecting PII sensitive information types and applying the Confidential label without user action. This satisfies the stem's requirement for automatic labelling on save, which manual labelling cannot achieve.

The Security Score is a crucial feature within Microsoft Defender for Cloud that provides a quantifiable, aggregated metric reflecting an organization's overall security posture across its hybrid and multi-cloud environments. It is calculated based on the implementation status of security recommendations derived from continuous assessments against security benchmarks. This score helps prioritize security efforts by showing the potential impact of implementing specific recommendations on the overall security posture, enabling clear tracking of improvements over time.

A Conditional Access policy is the precise tool within Microsoft Entra ID that allows administrators to enforce specific access requirements based on various conditions. By configuring a policy to target desired cloud applications and setting the grant control to "Require multi-factor authentication," the organization can mandate MFA for all users attempting to access those applications, thereby directly addressing the requirement to enforce MFA for cloud apps.

Microsoft Defender for Endpoint is a comprehensive Endpoint Detection and Response (EDR) solution designed to protect devices from advanced threats. It offers robust capabilities for automated investigation and remediation, including isolating compromised endpoints from the network to contain threats. Furthermore, it provides advanced features like file rollback, crucial for recovering from ransomware attacks by restoring files to their pre-attack state using cloud-delivered protection.

Attack surface reduction (ASR) rules in Microsoft Defender for Endpoint are designed to block behaviors commonly used by malware, such as executing scripts or launching certain applications. By configuring ASR rules, you can reduce the attack surface on Windows 10 devices. This directly addresses the requirement to block applications and scripts.

Sign-in frequency is a session control that determines how often a user must provide authentication credentials again, such as after a set number of days or hours. It can be configured differently for trusted and untrusted devices.

Auto-labelling applies sensitivity labels automatically to content matching sensitive information types, satisfying the requirement to classify data at scale without manual intervention. Microsoft Purview Information Protection uses this client-side and service-side mechanism to detect and label items across Exchange, SharePoint, OneDrive and Office apps.

Just-in-time (JIT) access grants temporary, time-limited elevated permissions to users or systems only when explicitly requested and strictly for the duration required to complete a specific task. This approach minimizes the window of opportunity for misuse or compromise by ensuring that administrative privileges are not persistently held. The scenario directly describes this mechanism of on-demand, temporary access for server administration.

Role groups in Purview grant access to the compliance portal.

Encrypting data during transmission directly ensures that only authorized entities with the correct decryption key can access or read the information. This process transforms plaintext into ciphertext, making it unintelligible to any unauthorized interceptors who might intercept the data in transit. Therefore, the primary objective of such a security policy requirement is to prevent unauthorized disclosure of sensitive data while it traverses networks, directly upholding confidentiality.

Defense in depth is a comprehensive security strategy that layers multiple, independent security controls to protect assets across various domains. This approach ensures that if one security control fails or is bypassed, other controls are still in place to detect, prevent, or mitigate an attack, significantly increasing resilience against diverse threat vectors. It encompasses physical, technical, and administrative safeguards, creating a robust and redundant barrier.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and automatically protect sensitive information across various locations, including Microsoft 365 services, endpoints, and on-premises repositories. These policies leverage sensitive information types, trainable classifiers, and exact data match to detect content containing, for example, credit card numbers or health records. Upon detection, DLP can enforce actions such as blocking sharing, encrypting files, or notifying administrators to prevent unauthorized disclosure or exfiltration.

Microsoft 365 Defender serves as the unified Extended Detection and Response (XDR) solution, integrating signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, and Microsoft Defender for Cloud Apps. This comprehensive platform correlates alerts and incidents across these domains, enabling security operations teams to conduct cross-domain investigations and leverage automated response capabilities for a holistic security posture.

Microsoft Sentinel is fundamentally a cloud-native Security Information and Event Management (SIEM) solution. It provides centralized security data collection from various sources, including Microsoft 365, Azure, on-premises systems, and other cloud providers, ingesting logs and alerts at scale. Sentinel then uses analytics, machine learning, and threat intelligence to detect, investigate, and respond to threats across an organization's digital estate, offering a comprehensive view of security posture.

Microsoft Entra ID Password Protection directly addresses the goal of improving password security by enforcing policies that prevent users from creating weak, easily guessable, or commonly compromised passwords. It utilizes both a global banned password list, maintained by Microsoft, and allows administrators to configure a custom banned password list specific to their organization. This feature actively checks new or reset passwords against these lists, rejecting those that fail to meet the defined security standards and thereby reducing the risk of password-based attacks.

Anomaly detection policies in Microsoft Defender for Cloud Apps baseline normal user behaviour and alert on deviations such as mass file downloads. The 100-files-in-10-minutes threshold is a behavioural anomaly, not a signature or access rule, so this policy type satisfies the detection requirement.

Just-in-time VM access is a Defender for Cloud capability that blocks inbound management ports by default and opens them only on approved request for a limited time, reducing exposure of Azure and hybrid virtual machines to brute-force attacks.

Defense in depth fundamentally involves deploying a comprehensive array of security controls across various layers and domains within an IT environment. This layered strategy ensures that if one security control is compromised or bypassed, other independent controls are still in place to detect, prevent, or mitigate the attack. It encompasses physical, technical, and administrative safeguards, creating a resilient security posture that significantly increases the effort and resources required for an attacker to succeed.

This option is correct because the `Get-MSRiskDetection` cmdlet is used to retrieve risk detections from Azure AD Identity Protection. The `-Filter "riskEventType eq 'unfamiliarSignInProperties'"` parameter precisely targets and returns only those risk detection objects where the `riskEventType` property matches 'unfamiliarSignInProperties'. This accurately identifies sign-ins exhibiting characteristics outside a user's typical patterns, as indicated by the specified risk event type.

Configuring a Conditional Access policy with 'Sign-in risk' as a condition and 'Require multi-factor authentication' as a grant control is the correct solution. This policy leverages real-time risk detections from Microsoft Entra ID Protection, dynamically enforcing MFA only when a user's sign-in attempt is deemed risky. This approach provides adaptive security, ensuring that users are prompted for additional verification specifically when their access attempt presents a potential threat, aligning with a Zero Trust model.

For automatic sensitivity labeling of content in Exchange Online (emails), the `behavior` parameter in the auto-labeling policy must be set to `applyWithOverride`. The `apply` behavior is typically used for SharePoint and OneDrive content, where it applies the label without allowing users to change it. However, Exchange requires `applyWithOverride` to ensure the label is applied while still permitting users to manually modify or remove it if necessary, aligning with email workflow flexibility.

Access Reviews are a core ID Governance feature.

Microsoft Entra ID Password Protection applies both a global banned-password list and a custom banned list, blocking weak terms such as company names and their variants. It enforces this during password set or reset, satisfying the requirement to reject common and organisation-specific passwords.

Correct. Records Management uses retention labels that can be configured to mark items as records. When an item is a record, it cannot be deleted, edited, or modified by users during the retention period. This satisfies the requirement to prevent permanent deletion.

Safe Links is a critical feature of Microsoft Defender for Office 365 that provides real-time, time-of-click protection against malicious URLs. When a user clicks a link in an email, Microsoft Teams, or supported Office apps, Safe Links rewrites the URL and scans it to determine if it leads to a malicious site. If the link is deemed harmful, the user is blocked from accessing the site, even if the original link was benign at the time of email delivery but later became malicious. This proactive defense is essential for protecting against evolving phishing and targeted attacks.

Integrity ensures that data has not been tampered with or altered from its original state. Digital signatures achieve this by creating a unique cryptographic hash of the document, which is then encrypted with the sender's private key. Any subsequent modification to the document would result in a different hash value, immediately revealing that the data's integrity has been compromised upon verification.

Microsoft Entra External ID is the comprehensive solution designed for managing all external identities, including partners, customers, and other collaborators. It facilitates secure business-to-business (B2B) collaboration by allowing organizations to invite guest users from other Microsoft Entra tenants, social identity providers, or via email one-time passcodes. This enables external users to access internal applications and resources while maintaining their original identity provider.

eDiscovery in Microsoft Purview is specifically designed to identify, preserve, collect, process, review, and export electronically stored information (ESI). This functionality is crucial for responding to legal requests, regulatory investigations, and data subject access requests (DSARs) by allowing organizations to efficiently locate and retrieve relevant data across various Microsoft 365 services. It centralizes the search and collection process for compliance needs.

Microsoft Defender for Office 365 (MDO) is specifically designed to protect against threats originating from email and collaboration tools within Microsoft 365. Its Safe Attachments feature extends protection to files stored in SharePoint Online, OneDrive for Business, and Microsoft Teams, proactively scanning documents for malware and blocking access to malicious content. This ensures that business documents stored in these cloud locations are secured against advanced threats like zero-day malware. Furthermore, MDO provides Safe Links and anti-phishing capabilities to safeguard users from malicious URLs and impersonation attempts.

Creating a case is the mandatory first step in Microsoft Purview eDiscovery (Premium); holds on custodians' mailboxes and SharePoint sites cannot be applied until a case exists to contain them. The case defines the legal boundary, permissions and custodian scope, so every subsequent hold, search and review set is scoped within it.

Sensitivity labels auto-classify and protect personal data across SharePoint and OneDrive, while retention labels keep specified records for the mandated seven years. Together they satisfy both the GDPR protection requirement and the minimum retention period within Microsoft Purview.

Records Management in Microsoft Purview is specifically designed to help organizations meet their legal, regulatory, and business obligations for retaining and disposing of information. It enables the declaration of content as a record, applying immutable retention labels and policies to automatically retain items for a specified period or delete them defensibly when no longer required. This ensures that critical business information is preserved and disposed of according to a defined lifecycle, preventing accidental deletion and supporting compliance audits.

Microsoft Entra Conditional Access is a policy engine that evaluates various signals, including user identity, device state, sign-in location, and application, to make real-time access decisions. It directly enables the creation of granular policies to enforce requirements like multi-factor authentication (MFA) or compliant devices, or to block access entirely, based on specific conditions such as device compliance or trusted network locations, precisely meeting the stated requirements.

Conditional Access policies are a core security feature within Microsoft Entra ID, allowing organizations to enforce specific access controls based on various signals. These policies evaluate conditions such as user identity, device state, location, and application to determine whether to grant access, block access, or require additional authentication methods like multi-factor authentication. This capability is fundamental for implementing Zero Trust principles in Entra ID by ensuring only authorized users on compliant devices can access resources.

Entitlement Management is a robust capability within Microsoft Entra ID Governance that enables organizations to manage identity and access lifecycle at scale through access packages. It allows for automatic access removal based on various lifecycle events, such as a user's employment status change or removal from a connected organization. This makes it ideal for ensuring access to groups, applications, and SharePoint sites is revoked promptly and automatically when no longer needed, aligning perfectly with the need for automated access removal.

Microsoft Entra External ID (formerly Azure AD B2C) is a customer identity and access management (CIAM) solution specifically designed for managing consumer identities for customer-facing applications. By creating an External ID tenant, organizations can integrate various social identity providers, including Facebook, Google, and Microsoft accounts, allowing users to sign up and sign in using their existing social credentials. This capability directly addresses the requirement for enabling social login functionality for external users.

Microsoft Entra Privileged Identity Management (PIM) is the specific service designed to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It provides just-in-time (JIT) privileged access, allowing users to activate roles for a limited duration, often requiring multi-factor authentication and an approval workflow. This capability directly addresses the need for time-bound privilege elevation with comprehensive auditing and accountability, significantly reducing the attack surface.

In the Shared Responsibility Model for Infrastructure as a Service (IaaS), Microsoft is solely responsible for the physical security of the underlying data centers. This encompasses safeguarding the physical infrastructure, implementing robust access controls, deploying surveillance systems, and managing environmental factors like power, cooling, and fire suppression. Customers are relieved of these foundational infrastructure concerns, allowing them to focus on their virtualized workloads.

Full disk encryption (FDE) directly addresses confidentiality by rendering all data on a laptop unreadable to unauthorized individuals. If the device is lost or stolen, the encrypted data remains protected, preventing its disclosure without the correct decryption key. This ensures that only authorized users or processes can access and interpret the sensitive information stored on the drive.

A Communication Compliance policy with offensive-language conditions automates detection across Exchange Online and Teams, while user reporting and a five-year retention policy on source locations meet the review, reporting and retention requirements. Role-based access restricts data to designated reviewers, satisfying all five constraints.

Microsoft Purview Information Barriers enable organizations to segment users into distinct groups and define policies that prevent or allow communication between them. This is crucial for managing conflicts of interest or adhering to regulatory requirements within specific departments like finance or legal. It effectively restricts collaboration in Microsoft Teams, SharePoint, and Exchange Online, ensuring sensitive information remains within designated boundaries and preventing unwanted interactions.

Managing access controls and authentication for database users stays with the customer under the shared responsibility model. Microsoft secures the underlying Azure infrastructure, but identity management for Azure SQL Database remains yours. Configuring Microsoft Entra ID authentication and database-level permissions satisfies the stem's requirement for customer-retained security tasks.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically engineered to identify, monitor, and protect sensitive information across endpoints, cloud apps, and services. When a DLP policy detects sensitive data in a document, it can be configured to automatically apply protective actions, including the application of sensitivity labels that enforce encryption, thereby preventing unauthorized sharing or exfiltration and ensuring data protection.

Microsoft Purview Compliance Manager is specifically engineered to help organizations manage their compliance posture against various regulatory standards and industry certifications. It provides a dashboard to assess current compliance status, offers actionable recommendations to improve the compliance score, and tracks progress over time. This tool simplifies the complex task of understanding and implementing necessary controls to meet regulatory obligations, such as those relevant to healthcare.

In Microsoft security platforms, "Incident response" provides a unified view that aggregates related alerts from various security workloads, such as endpoints, identities, and cloud applications. This centralized incident queue allows SOC analysts to efficiently investigate the full scope of a security breach, understand the attack story, and coordinate remediation actions, making it the primary starting point for comprehensive incident investigation.

Microsoft Defender for Cloud provides comprehensive cloud security posture management (CSPM) and cloud workload protection (CWP) for Azure resources, including Azure SQL databases. Its advanced threat protection capabilities specifically monitor Azure SQL for suspicious activities such as SQL injection attempts, brute-force attacks, and unusual data access patterns. By leveraging built-in intelligence and behavioral analytics, Defender for Cloud proactively identifies and alerts on potential threats targeting the database layer, ensuring the security of customer data. This makes it the primary solution for native Azure SQL database threat detection.