Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 301–375

Microsoft Purview Audit (Premium) provides advanced auditing capabilities, including extended retention of audit logs (up to 10 years), intelligent insights, and access to high-value audit events crucial for forensic investigations. It captures a comprehensive record of user and admin activities across Microsoft 365 services, enabling organizations to track who accessed what, when, and from where, which is essential for security and compliance audits.

Data Loss Prevention (DLP) is the correct solution because it is specifically designed to identify, monitor, and protect sensitive information across Microsoft 365 services, including email, SharePoint, and OneDrive. DLP policies leverage sensitive information types (SITs) to detect patterns like Medical Record Numbers (MRNs) within content. Upon detection, these policies can be configured to automatically block sharing with external recipients, provide policy tips to users, and generate alerts for administrators, thereby preventing unauthorized data exfiltration.

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various Microsoft 365 services, including applications integrated with Microsoft 365 Copilot. DLP policies can detect sensitive information types (e.g., credit card numbers, PII) and enforce actions such as blocking sharing, notifying users, or encrypting content, thereby preventing accidental or intentional data exfiltration when Copilot generates or processes content.

Microsoft Intune assesses device compliance against organizational policies, such as requiring encryption or specific OS versions. Azure AD Conditional Access then leverages this compliance status as a condition within its policies. This allows organizations to enforce that only devices marked as 'compliant' by Intune are granted access to sensitive cloud applications and data, creating a robust security gate.

Safe Attachments is a crucial component of Microsoft Defender for Office 365 that provides advanced protection against unknown malware and zero-day threats in email attachments. It uses a virtual environment, or sandbox, to "detonate" (open and analyze) attachments in real-time before they reach the user's inbox. This process identifies malicious behavior and prevents the delivery of harmful files, even if their signatures are not yet known to traditional antivirus solutions.

Microsoft Purview Audit (Premium) is the correct choice because it provides advanced capabilities essential for investigating a data breach. It offers extended retention of audit logs, granular logging of user and admin activities across Microsoft 365 services like SharePoint, OneDrive, and Exchange, and the ability to create custom alert policies. These features enable security teams to conduct thorough forensic analysis, track suspicious activities, and identify the scope and impact of a potential breach.

Azure AD Application Proxy provides secure remote access to on-premises web applications for internal users without requiring a VPN or opening inbound firewall ports. It acts as a reverse proxy, publishing internal applications through Azure AD, allowing employees to authenticate with their Azure AD credentials. This solution enables seamless and secure access to corporate resources from any location, making it the ideal choice for the scenario described.

Microsoft Entra Access Reviews provide a systematic and efficient way for organizations to manage and attest to group memberships, access to enterprise applications, and privileged role assignments. They enable resource owners or designated reviewers to periodically verify who still requires access, and critically, can be configured to automatically revoke access for users who are not approved or fail to respond to the review, directly addressing the requirement to remove access if not approved.

Retention labels are applied directly to individual items like emails or documents, allowing for granular control over their retention and disposition based on content type or business function. Retention policies, conversely, are applied to entire locations such as Exchange mailboxes, SharePoint sites, or Teams channels, enforcing a baseline retention schedule for all content within that location. Together, these mechanisms ensure that data is retained for its required lifecycle and then appropriately disposed of, meeting regulatory and organizational compliance obligations.

This option directly addresses all specified requirements. Creating Conditional Access policies allows for precise enforcement: one policy can require MFA for the finance application, and another can mandate a passwordless authentication strength for the IT group. Enabling Microsoft Entra ID Protection ensures that sign-in risks are continuously logged and monitored, providing essential security insights. Finally, creating an access review for guest users fulfills the requirement for systematic management of external access.

Microsoft Entra Privileged Identity Management (PIM) enables organizations to manage, control, and monitor access to important resources. It provides just-in-time (JIT) access, allowing users to activate privileged roles for a limited time period. This activation often requires multi-factor authentication (MFA) and an approval workflow, ensuring that elevated permissions are granted only when necessary and with proper oversight, significantly reducing the attack surface for privileged accounts.

Implementing multiple layers of security controls is the core principle of defense in depth. This strategy involves strategically placing diverse, independent security mechanisms—such as physical security, network segmentation, host-based firewalls, application security, and data encryption—to create redundancy. Each layer is designed to detect, delay, or prevent an attacker from reaching critical assets, even if a preceding layer is compromised.

Microsoft Entra Access Reviews, a component of Entra ID Governance, are specifically designed to manage the lifecycle of access to resources by enabling organizations to periodically review who has access to groups, applications, or roles. This feature allows for scheduled reviews, automated notifications to reviewers, and the automatic removal of access for users who no longer require it, directly addressing the need for periodic access validation and cleanup.

Insider Risk Management in Microsoft Purview is specifically designed to identify, analyze, and act on potential insider risks, including data exfiltration to unauthorized locations like personal cloud services. It leverages machine learning and customizable policies to detect risky activities based on behavioral indicators, enabling organizations to proactively address potential data loss before it escalates into a major incident.

Information Protection is the correct solution because it specifically provides capabilities to classify and label sensitive data within documents, whether manually by users or automatically based on content inspection. This service, often delivered through Microsoft Purview Information Protection (MPIP), enables organizations to apply sensitivity labels that not only categorize data but also enforce protective actions like encryption, access restrictions, and visual markings, directly addressing the need to classify documents containing specific information.

The Microsoft Authenticator app provides a secure and convenient passwordless sign-in experience by leveraging the biometric capabilities (fingerprint or facial recognition) inherent to the user's mobile device. When a user attempts to sign in to an Azure AD-connected application, a notification is sent to the Authenticator app, prompting for approval using the device's native biometrics. This method securely verifies the user's identity on their registered mobile device, eliminating the need to type a password and enhancing security against phishing attacks. It directly addresses the requirement for mobile biometric authentication.

Microsoft Purview Data Loss Prevention (DLP) proactively identifies, monitors, and protects sensitive information across Microsoft 365 services like Exchange Online, SharePoint Online, and OneDrive for Business. It uses policies to detect specific sensitive information types, such as credit card numbers or financial account details, within content. Upon detection, DLP can automatically block sharing, encrypt files, notify administrators, or provide policy tips to users, thereby preventing unauthorized data exfiltration and ensuring regulatory compliance.

Sign-in logs provide historical data about past authentication attempts, detailing success or failure, and any Conditional Access policies that were applied at that specific time. However, they do not offer a predictive capability to simulate a new sign-in scenario with hypothetical conditions, which is crucial for proactively diagnosing why a user *might* be blocked before they even attempt access under new circumstances.

Scheduled analytics rules in Microsoft Sentinel allow you to run KQL queries at regular intervals to detect specific events. You can include logic in the query to exclude events that occur during approved maintenance windows, for example by checking the timestamp against a known schedule. This enables precise detection of unauthorized group membership changes.

Records Management with a retention label marked as a regulatory record permanently locks the content, preventing any modification or deletion during the retention period. It also supports disposition workflows to require approval before permanent deletion.

Microsoft Defender for Endpoint is the correct solution because it provides comprehensive, next-generation endpoint protection specifically designed for devices like Windows 10 laptops. It includes capabilities such as antivirus, behavioral analysis, endpoint detection and response (EDR) for advanced threat hunting, and automated investigation and remediation to protect against sophisticated malware and zero-day attacks. Furthermore, it offers vulnerability management and device isolation to contain threats effectively.

Microsoft Entra Conditional Access, a core component of Microsoft E (Enterprise Mobility + Security), enables organizations to define granular access policies based on various conditions, including network location. By configuring trusted IP ranges or blocking specific countries/regions, administrators can prevent unauthorized access attempts from untrusted geographical locations, significantly reducing the attack surface and enhancing security posture. This directly leverages the adaptive capabilities of Entra.

Microsoft Purview Communication Compliance is a powerful solution designed to actively scan and analyze communications, such as Microsoft Teams chats and emails, for policy violations. It leverages machine learning and predefined or custom policies to detect inappropriate sharing of sensitive information, harassment, or regulatory non-compliance. This solution enables organizations to identify risky content, investigate potential issues, and take remediation actions, directly addressing the protection of sensitive data within communication channels.

Microsoft Defender for Office 365 provides advanced threat protection for email and collaboration tools. It includes anti-phishing policies that use machine learning and impersonation detection to protect against executive impersonation. This directly addresses the requirement for real-time protection against phishing attacks targeting executives.

This property precisely specifies the sensitive information types (SITs) that, when detected in content, will trigger the automatic application of this sensitivity label. These SITs act as conditions, allowing the system to identify and classify documents or emails containing specific patterns, such as credit card numbers or national identification numbers, without requiring manual user intervention, thereby enforcing data protection policies automatically.

A playbook, built on Azure Logic Apps, supplies the connectors that create the ServiceNow incident and post the Teams notification, while the automation rule triggers that playbook automatically when the incident is created. This satisfies the requirement for automatic response without manual analyst intervention.

Conditional Access policies can include a 'Block legacy authentication' condition. This allows administrators to create a policy that blocks all sign-ins from clients that do not support MFA, effectively stopping attacks that rely on legacy protocols while preserving modern authentication.

Customer Lockbox for Microsoft 365 provides an explicit, auditable workflow for customer approval when a Microsoft engineer needs to access customer content to resolve a support issue. This feature ensures that no Microsoft support personnel can gain access to customer data without the customer's designated approver, such as a compliance officer, granting explicit permission for each specific access request. It directly addresses the requirement for a financial institution to control and approve any potential access to their sensitive data by external parties, including Microsoft support.

The New-MgInvitation or New-AzureADMSInvitation cmdlet, when executed with appropriate parameters like InvitedUserEmailAddress and SendInvitationMessage -eq $true, specifically facilitates Microsoft Entra B2B collaboration. This action creates a new guest user object in the inviting tenant's Microsoft Entra ID, representing the external user. Concurrently, an invitation email containing a unique redemption link is automatically dispatched to the specified external email address, enabling the invited user to accept the invitation and gain access.

Guided response steps walk analysts through recommended containment and remediation actions for the specific incident, drawing on Microsoft's threat intelligence and the incident's evidence. This directly supports incident response by reducing the time spent deciding what to do next.

Multifactor authentication (MFA) is the security method that requires a user to provide two or more distinct verification factors from different categories to prove their identity. These factors typically include something the user *knows* (like a password), something the user *has* (like a phone or token), and/or something the user *is* (like a fingerprint). By combining multiple independent factors, MFA significantly enhances security by making it much harder for unauthorized users to gain access, even if one factor is compromised.

Self-Service Password Reset (SSPR) settings in Microsoft Entra ID directly control the user experience for password resets, including the authentication methods users must register and use. Administrators can configure the "Number of methods required to reset" and specify which "Methods available to users." Crucially, SSPR also offers an "Enforce registration" option, which can prompt users to register for SSPR (and thus their chosen authentication methods, including MFA options) at their next sign-in, ensuring they are prepared before a reset is needed.

Digital signatures achieve non-repudiation by cryptographically linking a message to its sender in a way that cannot be legitimately denied later. When a sender signs an email with their unique private key, they are essentially creating an unforgeable proof of origin. This signature, verifiable by anyone using the sender's public key, confirms that only the holder of that specific private key could have sent the message, thereby preventing the sender from disavowing their actions.

Advanced anti-phishing policies in Microsoft Defender for Office 365 are specifically engineered to detect and mitigate sophisticated phishing attacks, including adversary-in-the-middle (AiTM) threats. These policies leverage machine learning, behavioral analysis, and real-time signal detection to identify anomalous authentication flows, suspicious login patterns, and impersonation attempts. By analyzing various indicators, these advanced controls can effectively block phishing campaigns aimed at hijacking user sessions or stealing credentials via proxying techniques.

The 'Device state' Conditional Access condition specifically evaluates whether a device is marked as compliant by a Mobile Device Management (MDM) solution like Microsoft Intune. This condition enforces that the device meets predefined security baselines, such as requiring disk encryption, an up-to-date operating system, or active anti-malware protection. By leveraging Intune's compliance reporting, this condition ensures only trusted and healthy devices can access corporate resources.

Microsoft Purview eDiscovery (Premium) is the advanced solution specifically engineered to manage complex eDiscovery workflows, including the crucial capability of automatic legal holds. It enables organizations to identify custodians, automatically place legal holds on their associated data sources (e.g., Exchange mailboxes, SharePoint sites, OneDrive accounts, Teams chats), and manage these holds centrally. This automation ensures that relevant data is preserved efficiently and consistently across the organization, significantly reducing manual effort and the risk of data spoliation during litigation or investigations.

Advanced hunting runs KQL queries over up to 30 days of raw endpoint telemetry, letting you search for file hashes, IP addresses and process indicators across all onboarded endpoints, satisfying the requirement to locate IOCs estate-wide.

Microsoft Entra External ID is the comprehensive suite of capabilities within Entra ID that enables organizations to securely interact with external users, including partners, customers, and other collaborators. It facilitates various forms of external access, such as B2B collaboration, allowing partners to use their own corporate credentials through federation or other identity providers to access resources in your tenant.

Microsoft Entra ID Protection is a critical signal source for Conditional Access, enabling the creation of policies that automatically respond to detected risks. These policies can enforce actions like requiring multi-factor authentication, password change, or blocking access entirely when a user or sign-in is deemed risky by ID Protection's machine learning algorithms. This capability allows organizations to dynamically protect resources based on real-time threat intelligence.

Microsoft Entra Temporary Access Pass (TAP) is a time-limited passcode issued by an administrator, specifically designed to enable passwordless onboarding and account recovery. It allows users to sign in without their primary password, register passwordless authentication methods like FIDO2 security keys or Microsoft Authenticator, and then expire, ensuring a secure transition to a fully passwordless state. This mechanism is crucial for new employees or users who have lost their primary authentication method, providing a secure initial access point.

The Microsoft Entra ID MFA registration campaign policy is specifically designed to drive user adoption of multi-factor authentication by actively prompting users to register their MFA methods. This feature allows administrators to configure a grace period, expressed as a specific number of days, during which users are repeatedly prompted to register before MFA becomes mandatory for all sign-ins. It directly addresses the need to enforce registration within a customizable, set number of days.

Microsoft Purview Auto-labeling policies are specifically engineered to automatically apply sensitivity labels to content at rest or in transit across Microsoft 365 services. These policies leverage conditions such as sensitive information types, keywords, or trainable classifiers to identify specific content patterns. Upon a match, the designated sensitivity label, like 'confidential,' is automatically applied, ensuring consistent data classification without manual user intervention.

Running an Information Barriers policy in test mode is the correct approach because it simulates the policy's enforcement without actually blocking any communications. This mode generates a detailed report outlining which users and communications would be affected by the policy, allowing administrators to review potential impacts, identify unintended restrictions, and refine the policy configuration before full activation. It provides a safe, non-disruptive method to validate the policy's effectiveness and accuracy against the organization's requirements.

A Data Lifecycle Management retention policy is the correct solution because it allows an organization to define how long content should be retained and, optionally, when it should be deleted across various Microsoft 365 services. These policies can be applied broadly to entire locations, such as all Exchange mailboxes or SharePoint sites, ensuring automatic and consistent retention of all customer data according to organizational or regulatory requirements.

DLP can automatically apply encryption and show policy tips.

Microsoft Defender for Office 365 is the specialized security solution designed to protect organizations from sophisticated threats in email, links, and collaboration tools like Microsoft Teams, SharePoint, and OneDrive. It offers advanced anti-phishing, anti-malware, and anti-spam capabilities, along with Safe Attachments and Safe Links to neutralize threats. Crucially, it includes Automated Investigation and Response (AIR) capabilities that automatically investigate and remediate email-borne threats such as Business Email Compromise (BEC), making it the correct choice for this scenario.

Session controls are a core capability of Microsoft Defender for Cloud Apps, functioning as a Cloud Access Security Broker (CASB). These controls enable real-time monitoring and intervention for user sessions accessing cloud applications, allowing organizations to enforce policies such as blocking downloads of sensitive data, requiring step-up authentication, or protecting uploads of unclassified files. This ensures data protection and compliance even when users are accessing apps from unmanaged devices.

SSPR allows users to reset their own passwords after verifying their identity through one or more authentication methods, such as a code sent to a registered mobile phone. You can require users to register for SSPR at next sign-in, and you can restrict reset to only users who have the required methods. This directly matches the scenario.

Microsoft Defender for Identity is purpose-built to protect hybrid identity environments, specifically monitoring on-premises Active Directory domain controllers. It deploys lightweight sensors directly on domain controllers to profile network traffic and event logs, detecting advanced threats like Pass-the-Hash, Golden Ticket attacks, and DCSync. This specialized focus allows it to identify suspicious user and entity behavior patterns indicative of compromise within the AD infrastructure, providing critical alerts for security teams.

Safe Links policies provide real-time, click-time protection by dynamically rewriting URLs in emails and supported Office documents. When a user clicks a rewritten link, it is scanned against continuously updated reputation lists and, if necessary, detonated in a sandbox, blocking access to malicious sites. This ensures dynamic protection against evolving web-based threats and provides detailed reporting for security teams.

An auto-labeling policy in Microsoft Purview Information Protection is specifically designed to automatically apply sensitivity labels to content that matches predefined conditions. These conditions can include the presence of specific sensitive information types (e.g., credit card numbers, national ID numbers), keywords, or even content identified by trainable classifiers. This proactive approach ensures consistent classification and protection of sensitive data at scale, reducing reliance on manual user labeling.

Custom detection rules in Microsoft 365 Defender run scheduled KQL queries against advanced hunting tables, letting analysts encode multi-stage patterns such as phishing click followed by script execution. They generate alerts automatically, satisfying the requirement to detect and schedule this attack chain.

Data residency specifically refers to the geographic location where data is stored, which is crucial for compliance with regulations like GDPR that may require data to remain within certain jurisdictions. In this scenario, understanding data residency helps the corporation ensure that EU citizen data is stored in appropriate regions. This definition aligns with Microsoft compliance offerings that allow customers to choose data residency locations.

Cloud Discovery, a core feature of Microsoft Defender for Cloud Apps (MDCA), is specifically designed to identify all cloud applications accessed by users within an organization. It achieves this by analyzing network traffic logs from firewalls, proxies, and other network devices, correlating IP addresses and URLs to known cloud services. This process provides a comprehensive overview of both sanctioned and unsanctioned "shadow IT" applications, which is precisely what a security team needs for initial discovery.

Privileged Identity Management (PIM) is a cornerstone feature of Microsoft Entra ID P2, designed to mitigate the risks associated with excessive, unnecessary, or misused access permissions. It enables just-in-time (JIT) access to resources, meaning users are granted elevated roles only when needed and for a limited duration. PIM also facilitates just-enough-administration (JEA) by requiring approval or justification for role activation, significantly enhancing an organization's security posture against privilege escalation attacks.

Just-in-time VM access is a Defender for Cloud capability that blocks inbound management ports by default and opens them only on approved, time-bound requests, reducing the attack surface of Azure and multicloud virtual machines against brute-force and scanning attempts.

Conditional Access policies are the primary tool within Microsoft Entra ID for enforcing specific access controls based on various conditions evaluated at sign-in. These policies allow administrators to define "if-then" statements, such as "if a user is accessing a specific cloud application, then require multi-factor authentication." This capability directly addresses the requirement to enforce MFA for designated applications, providing granular control over access.

Microsoft Entra Identity Protection actively monitors for various risk detections, including leaked credentials, which are identified through dark web monitoring and other sources. A user risk policy, configured within Identity Protection, can then automatically enforce remediation actions like requiring a password change when a user's aggregated risk level (e.g., medium or high) indicates potential compromise. This direct linkage ensures that detected credential compromises are promptly addressed.

Microsoft Defender for Endpoint is the correct solution as it provides comprehensive endpoint detection and response (EDR), vulnerability management, and threat protection specifically for Windows servers and clients. It actively monitors for malicious activity, automates investigations, and can isolate compromised devices, directly addressing the need to protect servers from various threats.

Microsoft Entra ID serves as a comprehensive Identity as a Service (IDaaS) solution, providing a cloud-based platform for managing digital identities and controlling access to various cloud applications. It enables organizations to centralize user accounts, enforce authentication policies, and provision users to Software as a Service (SaaS) applications and custom cloud applications. This capability streamlines identity management operations and enhances security across diverse cloud environments.

Automation rules configured to trigger upon the creation of an alert have a specific limitation regarding their direct actions. While they can successfully execute a playbook, which in turn can create an incident, the automation rule itself cannot directly perform a 'createIncident' action. This distinction is crucial for understanding the flow of operations, as direct incident creation is typically reserved for rules triggered by incident-related events.

Regulatory compliance standards in Microsoft Defender for Cloud provide continuous assessment of your cloud environment against a wide array of industry and regulatory benchmarks, such as ISO 27001, SOC 2, and PCI DSS. It automatically maps security recommendations to specific controls within these standards, offering a compliance score and detailed reports. This feature helps organizations understand their current compliance posture and provides actionable insights to remediate non-compliant resources, simplifying the audit preparation process.

An incident aggregates multiple related alerts and entities (users, devices, mailboxes, IP addresses) into a single investigation unit. This holistic view is crucial for understanding the scope, impact, and attack chain, preventing siloed investigations of individual alerts. It allows for comprehensive threat hunting and response planning, making it the most effective initial step for a security analyst.

Microsoft Entra Entitlement Management is designed to streamline the lifecycle of access for both internal and external users, particularly for external partners needing access to specific applications or resources. It utilizes access packages, which bundle resources and define policies for requesting access, including approval workflows, mandatory reviews, and automatic expiration dates. This ensures that external access is granted only when needed, for a specific duration, and with appropriate oversight, making it ideal for managing B2B collaboration securely and efficiently.

Enterprise applications in Microsoft Entra ID provide the central framework for integrating various applications, including Software as a Service (SaaS) applications. The pre-integrated gallery apps offer ready-to-use templates with pre-configured settings for popular SaaS applications, significantly simplifying the process of enabling Single Sign-On (SSO). This allows employees to access corporate applications using their existing Microsoft Entra credentials without needing to re-authenticate, streamlining access and enhancing security.

The Azure Monitor Agent (AMA) is the correct and recommended solution for collecting security logs from both Windows and Linux servers, including on-premises, for ingestion into Microsoft Sentinel. It offers a more secure, efficient, and flexible data collection experience compared to its predecessor, allowing granular control over which logs are collected via Data Collection Rules (DCRs). AMA supports a wide range of log types, including security events, performance counters, and Syslog, making it ideal for comprehensive security monitoring.

Microsoft Entra Privileged Identity Management (PIM) is specifically designed to manage, control, and monitor access to important resources within an organization by implementing just-in-time (JIT) access. It enables users to activate privileged roles only when needed and for a limited, predefined duration, often requiring an approval workflow. PIM also provides automatic expiration of assignments and comprehensive auditing, significantly reducing the attack surface associated with standing privileged access.

PIM provides just-in-time privileged access. By configuring role settings for Privileged Role Administrator, you can require MFA on activation, require a justification, and require approval from specified approvers. This exactly matches the scenario: the controls apply only when the user activates the role, not at every sign-in.

In the Azure Shared Responsibility Model, particularly for Infrastructure as a Service (IaaS) deployments, the cloud provider (Microsoft) is solely responsible for the physical security of the underlying data centers. This includes implementing robust access controls, continuous surveillance, environmental monitoring, and fire suppression systems to protect the hardware and infrastructure where customer data resides. Customers do not have any control or responsibility over the physical facilities.

Group-based access control allows permissions to be assigned to groups rather than individuals, simplifying management. This directly matches the scenario where a user gains access because they belong to a group that has been granted access.

Verify explicitly satisfies Zero Trust by requiring every access request to be authenticated and authorised using all available signals — user identity, device health, location and risk — before granting resource access. This directly implements the model's core premise that no request is trusted by default, even from inside the corporate network perimeter.

Microsoft Purview's auditing capabilities, including Audit (Standard) and Audit (Premium), fundamentally rely on the Unified Audit Log (UAL). The UAL captures a comprehensive record of user and administrator activities across various Microsoft 365 services, making it essential for forensic investigations, compliance, and regulatory adherence. Without the UAL enabled, Purview cannot collect the necessary activity data to provide audit insights or support eDiscovery.

Microsoft Purview Audit (Standard or Premium) is the essential service for investigating user and administrator activities across Microsoft 365 services, including potential data leaks. It provides access to the unified audit log, which records a vast array of events such as file access, sharing, deletions, and email activities. Investigators can use the Audit log search tool to pinpoint specific actions, users, and timeframes related to a suspected leak, with Premium offering extended retention and advanced capabilities for in-depth forensic analysis.