Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 151–225

Microsoft Purview Data Loss Prevention (DLP) is precisely engineered to identify, monitor, and protect sensitive information across an organization's digital estate, including cloud services, endpoints, and applications. DLP policies leverage a vast library of built-in sensitive information types, such as those for credit card numbers, to accurately detect specific data patterns. Upon detection, DLP can automatically apply predefined protective actions like blocking sharing, encrypting content, or notifying compliance officers, effectively preventing unauthorized data exfiltration.

The Microsoft Purview Information Protection scanner is specifically designed to discover, classify, and protect sensitive data residing on on-premises file shares and SharePoint servers. It scans content based on configured sensitive information types and automatically applies sensitivity labels, which can include visual markings, encryption, and content access restrictions. This proactive approach ensures that existing sensitive financial data is identified and secured without manual intervention, directly addressing the need for on-premises data protection.

Microsoft Entra ID Protection is the correct service for automatically detecting and alerting security teams about identity-based risks. It continuously monitors user sign-ins and identities for suspicious activities, such as sign-ins from unfamiliar locations, anonymous IP addresses, or leaked credentials. Upon detection, it can trigger automated responses like multi-factor authentication prompts, password resets, or blocking access, thereby protecting user accounts from compromise and preventing unauthorized access.

Correct. Encryption protects confidentiality, and RBAC protects integrity by controlling modifications.

Microsoft Purview Data Lifecycle Management (DLM) is the correct solution for retaining all customer communications, as it provides comprehensive capabilities for managing the entire lifecycle of information. DLM allows organizations to create and apply retention policies and retention labels across various Microsoft 365 services, including Exchange, SharePoint, OneDrive, and Teams. These policies ensure that data is preserved for a specific duration to meet regulatory and business requirements, and then automatically deleted when its retention period expires, effectively governing both retention and disposition.

Microsoft Entra hybrid joined devices are those that are joined to an on-premises Active Directory domain and simultaneously registered with Microsoft Entra ID. This configuration allows organizations to maintain existing on-premises management and group policies while enabling seamless single sign-on (SSO) to cloud resources and leveraging Microsoft Entra ID's conditional access policies. It effectively bridges the gap between traditional on-premises infrastructure and modern cloud services, providing a unified identity for devices across both environments.

Administrative Units (AUs) are the correct solution because they enable the delegation of administrative roles with a defined scope, such as specific sets of users, groups, or devices. This allows the IT help desk to be assigned administrative roles, like User Administrator, but with their permissions restricted to only manage users who are members of the 'UK Users' administrative unit, preventing them from affecting users outside that scope.

This Grant control is the precise mechanism within Conditional Access policies to enforce that only devices deemed compliant by a Mobile Device Management (MDM) solution, such as Microsoft Intune, are permitted to access protected resources. By selecting 'Require device to be marked as compliant,' the policy explicitly gates access, ensuring that devices meet organizational security standards before a user can proceed. It directly leverages Intune's compliance reporting to make real-time access decisions.

The rule blocks access when condition met.

In the context of the CIA triad, confidentiality is the principle that prevents unauthorized disclosure of information, ensuring only authorized entities can access sensitive data. Encrypting patient data with AES directly addresses this by transforming the data into an unintelligible format for anyone without the proper decryption key. This ensures that even if an attacker gains unauthorized access to the database files, the sensitive patient information remains protected from unauthorized viewing or exfiltration.

Integrity ensures that data remains unaltered and complete from its origin to its destination. Cryptographic hashing achieves this by generating a unique, fixed-size digital fingerprint (hash value) of the data. Any modification, even a single bit change, to the original data will result in a completely different hash value, making it immediately apparent if the data has been tampered with during transmission or storage. Comparing the computed hash of a downloaded file with a trusted, pre-published hash confirms the file's authenticity and lack of corruption.

The Azure Security Benchmark is a Microsoft-authored, Azure-specific set of guidelines and best practices for securing resources on Azure. It provides a comprehensive framework, including built-in policies within Azure Policy, that Defender for Cloud uses to assess the security posture of your environment and generate actionable network security recommendations. These recommendations are directly aligned with industry standards and regulatory compliance requirements, offering a foundational security baseline.

Creating a retention label with a 90-day retention period is the correct approach for this compliance requirement. Retention labels allow organizations to define how long content should be kept, and critically, what action should occur afterward, including automatic deletion. This ensures that data is retained for the necessary compliance duration and then systematically disposed of, aligning with GDPR's data minimization principles.

This recommendation lists VMs missing updates.

Microsoft Entra Identity Protection is a crucial security capability that automatically detects, remediates, and investigates identity-based risks in an organization. It identifies potential vulnerabilities affecting identities, such as leaked credentials, and detects suspicious actions like anomalous sign-in locations or impossible travel. These risk detections are fed directly into Microsoft Sentinel as incidents, enabling security analysts to correlate identity risk data with other security logs for comprehensive threat detection and response.

Microsoft Entra Privileged Identity Management (PIM) is specifically engineered to manage, control, and monitor access to important resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It enables just-in-time (JIT) access, allowing users to activate privileged roles for a limited, specified duration, often requiring approval and providing comprehensive audit trails. This capability directly addresses the need for controlled, temporary role elevation, aligning with the principle of least privilege.

The KQL query specifically targets DeviceFileEvents where the FileName contains "confidential," indicating potentially sensitive data. By then summarizing the count() of these events per DeviceName and filtering for EventCount > 5, the query effectively identifies devices exhibiting an unusually high volume of interactions with these specific files, which could signify suspicious activity or data exfiltration attempts.

When a security analyst downloads software, ensuring its integrity means verifying that the installer file has not been tampered with, corrupted, or maliciously altered during transit or storage. This is crucial to prevent the execution of unauthorized code or unintended software behavior. Comparing a cryptographic hash (like SHA256) provided by the vendor with the hash of the downloaded file is the primary method to confirm that the software's integrity remains uncompromised from its original source.

Safe Links is a core feature of Microsoft Defender for Office 365 specifically designed to protect users from malicious URLs. It operates by rewriting original links in emails and Office documents, replacing them with secure Microsoft Defender for Office 365 URLs. When a user clicks a rewritten link, Safe Links performs a real-time scan to determine if the destination website is malicious. If the link is deemed unsafe, the user is blocked from accessing the site, effectively preventing phishing attacks and drive-by downloads originating from embedded URLs.

Information Protection auto-labeling within Microsoft Purview is designed to automatically detect and classify sensitive data across an organization's digital estate. By leveraging auto-labeling policies, administrators can configure the system to identify specific Sensitive Information Types (SITs) or trainable classifiers within content. Upon detection, the appropriate sensitivity label is applied, enabling consistent data protection and governance without manual intervention, directly addressing the need for automatic classification.

Set the action to 'Block with override' [CORRECT]

An auto-labeling policy within Microsoft Purview automatically applies sensitivity labels to content based on specific conditions, such as the detection of sensitive information types (SITs), keywords, or trainable classifiers. This method is ideal for large-scale data classification, ensuring consistent application of labels without manual intervention, thereby enabling automated protection and governance. It directly addresses the need to classify data programmatically and efficiently.

Microsoft Entra External ID (B2C) is specifically engineered for Customer Identity and Access Management (CIAM) scenarios, enabling organizations to manage millions of customer identities for their public-facing applications. It natively supports sign-up and sign-in with a wide array of social identity providers like Google, Facebook, and LinkedIn, alongside local accounts. This service allows for extensive customization of user journeys, branding, and the integration of terms of use, making it ideal for consumer applications requiring flexible authentication and authorization for external users.

Microsoft Entra Conditional Access policies evaluate various signals, including user, location, application, and device state, to make real-time access decisions. By integrating with Microsoft Intune, Conditional Access can enforce that devices must be marked as compliant before users can access corporate resources, directly addressing the need for device-based access control. This mechanism ensures only trusted devices can connect.

Microsoft Defender for Cloud is the correct solution because it provides comprehensive Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities across Azure, on-premises, and multi-cloud environments. It delivers a secure score, actionable security recommendations, and advanced threat protection for virtual machines and servers, regardless of their hosting location. By integrating with Azure Arc, Defender for Cloud extends its security management and monitoring to on-premises servers, ensuring consistent security posture across the entire hybrid infrastructure.

Data Lifecycle Management, specifically through retention labels with auto-apply policies, is the precise solution. These labels can be configured to automatically identify financial records using keywords, sensitive information types, or specific content properties. Once applied, the label enforces a precise retention period, such as seven years, ensuring the content is preserved for the required duration and then automatically deleted, fulfilling both retention and deletion obligations for compliance.

Microsoft Entra ID provides robust identity governance capabilities, which are crucial for managing and auditing the identity lifecycle and access to resources. This includes features like access reviews, enabling periodic verification of user access to groups and applications, and entitlement management, which automates access request workflows and lifecycle for internal and external users. These tools ensure that users have only the necessary access for their roles, enhancing security and compliance.

Azure AD Conditional Access policies evaluate conditions such as user, location, application, and device state before granting access to cloud resources. By integrating with Microsoft Intune, Conditional Access can enforce that devices must be marked as compliant with organizational policies (e.g., encryption, OS version, antivirus) before users can access sensitive applications or data. This directly addresses the requirement to ensure only approved devices can access resources.

Auto-labeling with sensitivity labels is the precise solution for automatically classifying and protecting sensitive information across Microsoft 365 services without user intervention. This feature allows administrators to configure policies that automatically apply specific sensitivity labels, along with their predefined encryption, visual marking, and access restrictions, based on detected sensitive information types, keywords, or trainable classifiers within content. It directly addresses the need for both automatic classification and persistent protection.

For a cloud-based email service, which exemplifies Software as a Service (SaaS), the cloud provider is unequivocally responsible for the physical security of the entire underlying infrastructure. This encompasses securing the data centers, controlling physical access, maintaining environmental conditions, and protecting the servers, storage, and networking hardware that host the email application. Their robust security measures ensure the integrity and availability of the service at the foundational level.

A Data loss prevention (DLP) policy is specifically engineered to identify, monitor, and protect sensitive information across various locations, including Microsoft 365 services, endpoints, and cloud apps. DLP policies achieve this by detecting content that matches predefined sensitive information types or custom conditions and then enforcing actions like blocking, auditing, or notifying users and administrators to prevent unauthorized sharing, transfer, or use of that data. This directly addresses the need to prevent the use of specific data types.

eDiscovery (Premium) is the comprehensive solution for managing legal, regulatory, and internal investigations within Microsoft 365, providing end-to-end data preservation, collection, and analysis. It offers robust capabilities including integrated custodian management, targeted legal holds across various data sources, advanced indexing, conversation reconstruction for platforms like Microsoft Teams, and secure review sets with analytics. This allows for efficient identification, collection, processing, and analysis of relevant data, ensuring defensible preservation and streamlined review for complex legal matters.

Creating a Conditional Access policy is the recommended and most flexible method to enforce multi-factor authentication for all users while strategically excluding a break-glass account. Conditional Access allows administrators to define precise conditions, such as requiring MFA for 'All users,' and then apply specific 'Exclusions' for designated emergency access accounts, ensuring both comprehensive security and operational continuity.

The customer organization retains primary responsibility for securing their user identities, endpoint devices like laptops, and the data stored within Microsoft 365. This includes implementing strong authentication policies, managing device compliance, configuring data loss prevention, and enforcing access controls. These elements fall directly under the customer's administrative control and configuration within the cloud service.

This setting, configured within Microsoft Entra ID's Self-Service Password Reset (SSPR) policy, directly controls the security posture of the SSPR process. It dictates the number of distinct authentication factors a user must successfully provide to verify their identity before being allowed to reset their password. Setting this value to '2' ensures a multi-factor authentication approach for password resets, significantly enhancing security by requiring more than one proof of identity.

Microsoft Entra ID Protection provides automated responses to detected identity risks, such as suspicious sign-ins or compromised credentials. It can automatically block access, require multi-factor authentication, or prompt for a password change based on predefined policies and the assessed risk level. This capability significantly reduces the manual effort required to mitigate identity-related threats and enhances overall security posture by enforcing real-time remediation.

A Device restrictions profile in Microsoft Intune is the appropriate configuration profile for enforcing various security and functional settings on mobile devices, including device-level data encryption. This profile allows administrators to mandate specific encryption requirements, such as requiring storage encryption for the entire device, setting encryption types, or configuring related password policies necessary for unlocking encrypted data. It directly applies these security configurations to the device operating system.

In PaaS, Microsoft is responsible for maintaining and patching the host OS and infrastructure, freeing the customer from managing these layers.

This option accurately describes the combined effect of a DLP rule configured with `BlockAccess` and `UserNotification` enabled. The `BlockAccess` action ensures that the attempted sharing of sensitive content is prevented. Simultaneously, the `UserNotification` setting ensures that the user attempting the action receives a policy tip or email notification, explaining that their action was blocked due to a DLP policy violation.

Secure Score in Microsoft Defender for Cloud provides a quantifiable measure of an organization's security posture across its hybrid cloud environment. It aggregates findings from various security assessments, including those related to missing system updates, security misconfigurations, and other vulnerabilities. The platform generates specific, prioritized recommendations to address these issues, such as applying missing operating system patches or software updates, directly contributing to an improved security score and overall security posture.

Conditional Access policies are the definitive tool within Microsoft Entra ID for enforcing granular access controls based on various conditions, including user location. By configuring a policy with a 'Location' condition, administrators can specify trusted or untrusted IP ranges and block access from specific countries or regions. The ability to apply this policy to specific groups while excluding others provides the necessary flexibility to implement targeted access restrictions.

Reviewing and adjusting the auto-labeling rules within the sensitivity label policies directly addresses the root cause of incorrect label application. These rules are based on specific conditions, such as sensitive information types, keywords, or trainable classifiers. By refining these conditions, organizations can ensure that auto-labeling accurately identifies and applies the correct sensitivity labels only to truly confidential content, thereby optimizing data protection and compliance without sacrificing the efficiency of automation.

Microsoft Purview Data Lifecycle Management (formerly Information Governance) provides the necessary framework to manage data throughout its lifecycle. A retention policy, configured within this solution, can be precisely set to retain items for a specified duration, such as 7 years, to meet regulatory obligations. Upon the expiration of this retention period, the policy automatically triggers the deletion of the content, ensuring compliance with requirements for both preservation and eventual disposal without requiring manual intervention.

Microsoft Purview Audit (Premium) provides comprehensive, high-fidelity logging of user and admin activities across Microsoft 365 services, including detailed access events to sensitive data and resources. It offers extended log retention, advanced search capabilities, and intelligent insights, which are crucial for forensic investigations and demonstrating precise compliance to auditors regarding who accessed what, when, and from where. This capability directly enables an organization to prove that only authorized individuals accessed specific information.

PIM requires approval from designated approvers.

Microsoft Entra ID Access Reviews provide a systematic way for organizations to periodically review who has access to specific resources, such as group memberships or application assignments. Reviewers, often resource owners, can attest whether users still require their current access. This process helps enforce the principle of least privilege by automatically removing access for users whose permissions are no longer justified, enhancing security and compliance.

Compliance Manager offers a compliance score, detailed assessments, and recommended actions to improve adherence to various regulations.

Microsoft Purview Data Loss Prevention (DLP) policies are designed to provide policy tips to users directly within applications like Outlook, Teams, and SharePoint. These contextual notifications appear when users are about to perform an action that violates a DLP policy, such as sharing sensitive data externally. This feature educates users in real-time, helping them understand compliance requirements and correct their behavior before a data leak occurs.

Device compliance policies are specifically designed to define the security and health standards that managed devices must meet to be considered "compliant" with organizational policies. These policies actively monitor and evaluate device attributes, such as the presence of a passcode, encryption status, or minimum OS version. If a device fails to meet any defined requirement, the compliance policy marks it as "non-compliant," which can then be leveraged by Conditional Access policies to block access to corporate resources.

Integrity ensures that data has not been altered or tampered with during transit between the sender and receiver. TLS achieves this by incorporating Message Authentication Codes (MACs) or Hash-based Message Authentication Codes (HMACs) into its record protocol. These cryptographic checksums are computed over the data and a shared secret key, then appended to the encrypted message. Upon receipt, the client recalculates the MAC; if it doesn't match the received MAC, it signifies that the data has been modified, thereby preventing unauthorized changes and ensuring data trustworthiness.

Privileged Identity Management (PIM) is the dedicated Azure AD service designed to manage, control, and monitor access to important resources. It enables just-in-time (JIT) access, allowing users to activate privileged roles like Global Administrator only when needed and for a limited duration. This significantly reduces the attack surface by eliminating standing administrative access and provides robust auditing capabilities for all role activations.

The Admin consent workflow in Microsoft Entra ID allows users to request administrator approval for applications that require permissions necessitating admin consent. When a user attempts to access such an application, they are prompted to request approval, triggering a workflow where designated administrators can review the requested permissions and decide to grant or deny the organization-wide consent. This mechanism ensures that applications requiring elevated permissions are properly vetted before being authorized for use across the tenant, maintaining security and compliance.

This is the most plausible reason for no results. The query specifically filters for `AlertName has 'MFA'` or `AlertName has 'Suspicious sign-in'`. If the actual alert names in the system use slightly different terminology, such as "Azure AD MFA Activity" or "Unusual Sign-in Attempt," they would not contain the exact substrings specified and thus would not be returned by the query. The absence of results strongly suggests a mismatch between the queried strings and the actual alert naming conventions.

Records Management uses retention labels with a disposition review, and when a label is marked as a record, content cannot be modified or deleted. After the retention period, a disposition review can trigger permanent deletion.

Microsoft Entra External ID is the correct solution for managing external users, including customers, partners, and other guests, who need to access an organization's applications. It provides the capability to configure various identity providers, such as social accounts (e.g., Google, Facebook), enterprise accounts, or local accounts, allowing external users to sign in using their preferred credentials. This service is specifically designed to facilitate secure and seamless access for customer-facing applications by leveraging external identity sources.

Microsoft Defender for Office 365 is a core component of Microsoft Defender XDR, providing robust protection against sophisticated threats originating from email and collaboration tools. It safeguards against phishing, spam, malware, and business email compromise across Exchange Online, SharePoint, OneDrive, and Microsoft Teams, integrating critical threat signals into the unified XDR platform for comprehensive incident response and automated remediation.

Data Lifecycle Management in Microsoft Purview includes retention policies and retention labels. These labels can be configured for automatic application based on sensitive information types, keywords, or trainable classifiers, thereby automatically classifying data at rest to manage its retention and deletion throughout its lifecycle. This ensures compliance without manual intervention.

Microsoft Purview Communication Compliance is engineered to help organizations detect, investigate, and remediate policy violations in internal and external communications. It leverages machine learning and customizable policies to identify sensitive information, harassment, regulatory non-compliance, or other inappropriate content across platforms like Exchange, Teams, and Viva Engage, providing a robust workflow for review and investigation. This tool directly addresses the need for monitoring communication content.

Microsoft Purview retention policies are designed to apply retention and deletion rules broadly across entire locations, such as Exchange mailboxes, SharePoint sites, and Microsoft Teams. They ensure that content is retained for a specified period or deleted after a certain time, based on organizational or regulatory requirements, managing data at a container level.

Administrative units allow scoping of administrative roles (e.g., Helpdesk Administrator) to a specific subset of users, such as those in a particular region or department. This feature directly meets the requirement to delegate tasks limited to European users.

BitLocker full disk encryption directly addresses confidentiality by transforming data into an unreadable format, making it inaccessible to anyone without the correct decryption key. This mechanism prevents unauthorized disclosure of sensitive information stored on the laptop, even if the device is lost or stolen. By requiring authentication (e.g., TPM, PIN, USB key) to unlock the drive, BitLocker ensures that only authorized users or systems can access the plaintext data, thereby safeguarding its secrecy.

Anti-phishing policies, particularly those with impersonation protection in Microsoft Defender for Office 365, are specifically engineered to combat spear phishing by detecting sender impersonation. They leverage advanced machine learning models to analyze various email attributes, including sender address, display name, and domain reputation, to identify attempts to spoof trusted users within an organization or external legitimate domains. This targeted protection identifies and blocks emails where attackers spoof identities to trick recipients, directly addressing the core mechanism of spear phishing.

Auto-labeling applies the label automatically, and DLP provides the policy tip.

Microsoft Entra Privileged Identity Management (PIM) is the correct solution because it enables just-in-time (JIT) and time-bound access to resources and roles. Administrators can assign a vendor a specific role for a predefined duration, and PIM will automatically revoke that access once the assignment period expires. This ensures temporary access is granted only when needed and automatically removed, aligning perfectly with the requirement for automatic expiration.

Microsoft Purview Communication Compliance is specifically designed to help organizations meet stringent regulatory compliance requirements by proactively identifying and managing inappropriate communications. It leverages machine learning and predefined or custom policies to scan messages across various communication channels for specific keywords, phrases, and content patterns indicative of policy violations like insider trading, harassment, or regulatory breaches. Detected items are then routed for review and remediation, ensuring adherence to internal policies and external regulations.

The principle of least privilege dictates that users, processes, and applications should be granted the minimum level of access required to perform their authorized tasks and nothing more. This minimizes the attack surface by restricting potential damage if an account is compromised, ensuring that users can only interact with the resources essential for their specific roles. It's a foundational security concept for reducing risk.

Least privilege is a fundamental security principle dictating that users, programs, or processes should be granted only the minimum necessary access rights or permissions required to perform their specific job function or task. This directly aligns with the scenario where an employee's access is restricted precisely to what they need for their role, minimizing the potential impact if their account is compromised or misused. Implementing least privilege significantly reduces the attack surface and the blast radius of security incidents.

Microsoft Entra Conditional Access is a powerful policy engine that evaluates various conditions, such as user location, device compliance, and sign-in risk, in real-time before granting access to resources. It allows administrators to enforce specific controls, like multi-factor authentication, password changes, or blocking access, based on these conditions. When integrated with Identity Protection, Conditional Access policies can automatically respond to detected user and sign-in risks, ensuring adaptive security.

Conditional Access policies in Microsoft Entra ID are powerful "if-then" statements that define conditions under which users can access resources. It can specifically require that a device accessing corporate applications is marked as compliant by an MDM solution, such as Microsoft Intune, ensuring it meets security standards like having a PIN or being encrypted. This capability directly enforces device management requirements as a prerequisite for access, aligning perfectly with the company's goal.

CWP provides threat detection for workloads in Defender for Cloud.

Correct. Sensitivity labels with auto-labeling classify and protect personal data, DLP blocks sharing via email/Teams, eDiscovery handles DSRs, Data Lifecycle Management manages retention, and Audit Premium provides 1-year audit trail.

The 'Verify explicitly' principle is central to Zero Trust, requiring that all access requests are authenticated and authorized based on all available data points, rather than granting implicit trust. This includes evaluating user identity, device health, location, service, data classification, and potential anomalies continuously. It directly challenges traditional security models by explicitly rejecting the notion that network location alone can confer trustworthiness for any resource access.

Microsoft Purview eDiscovery solutions are specifically designed to enable organizations to identify, preserve, collect, process, review, and produce electronically stored information (ESI) in response to legal or regulatory requests. It provides advanced search capabilities across diverse data sources, allows for placing immutable legal holds to prevent data alteration, and facilitates the secure export of relevant data for legal proceedings. This functionality directly addresses the need to search for specific emails and manage them for litigation purposes.

Microsoft Secure Score is a robust measurement tool within the Microsoft 365 Defender portal designed to help organizations understand and improve their security posture. It aggregates security configurations and behaviors across various Microsoft services, providing a numerical score and actionable recommendations. These recommendations guide administrators in implementing best practices and mitigating risks, thereby enhancing overall tenant security over time.