Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 526–600

Microsoft Entra Privileged Identity Management (PIM) is a robust feature designed to manage, control, and monitor access to critical resources within Microsoft Entra ID, Azure, and other Microsoft Online Services. It provides just-in-time (JIT) and just-enough-administration (JEA) access, significantly reducing the attack surface by limiting the duration and scope of elevated permissions. This advanced capability for privileged access governance is a cornerstone feature of Microsoft Entra ID P2.

Microsoft Purview Communication Compliance uses machine-learning classifiers to detect offensive language in Microsoft Teams messages, then routes flagged items to reviewers for triage and remediation. This directly satisfies the requirement to flag offensive content for review, unlike retention or eDiscovery solutions, which preserve or search content without policy-based offensive-language detection.

Automation rules are the core mechanism within Microsoft Sentinel for orchestrating and automating incident response workflows. They are designed to automatically apply actions to incidents upon creation or update, based on specified conditions like severity, tactics, or associated entities. These rules can trigger playbooks, which are logic apps that perform complex tasks such as integrating with external systems like ServiceNow for ticketing, sending email notifications to security teams, or isolating compromised hosts. This capability makes automation rules essential for efficient SOAR operations.

DLP policies evaluate Teams chat and channel messages for sensitive information types, blocking or warning on sharing. This protects sensitive data in Teams because policy tips and enforcement act at the point of message transmission, satisfying the requirement to safeguard content within that workload.

Passwordless sign-in with Microsoft Authenticator is a core feature that allows users to sign into Microsoft Entra ID-connected applications without entering a password. When a user attempts to sign in, they are presented with an option to scan a QR code displayed on the sign-in screen using the Microsoft Authenticator app on their mobile device. The app then securely approves the sign-in request, often after a number match confirmation, providing a seamless and secure authentication experience.

Communication Compliance policies define supervised communication channels, and Microsoft Teams chat and channel messages must be selected as a supervised channel for those messages to be scanned. Without adding Teams, the policy only covers Exchange email and other configured sources.

Microsoft Entra External ID, specifically its B2B collaboration capabilities, is the correct solution for enabling external users to access an organization's resources using their existing social identity provider accounts. This feature allows organizations to invite guests who can then sign in using their Google, Facebook, or other configured social accounts, federating these external identities with the inviting Microsoft Entra tenant. It streamlines access for partners and customers without requiring them to create new credentials.

This option is correct because the user's insertion of a smart card and input of a PIN constitute a multi-factor authentication process, verifying their claimed identity. Following successful authentication, the operating system then performs an authorization check, determining whether the authenticated user has the necessary permissions to access the requested folder. The denial of access clearly demonstrates an authorization decision based on established access controls.

Creating a Conditional Access policy that requires a compliant device directly addresses access issues stemming from device non-compliance. This policy evaluates the device's security posture, as determined by an MDM solution like Microsoft Intune, ensuring it meets predefined organizational security standards (e.g., OS version, encryption, antivirus status). Access to protected resources is then granted only if the device is marked as compliant, thereby enforcing a secure endpoint environment.

Privileged Identity Management (PIM) in Microsoft Entra ID Governance is specifically designed to manage, control, and monitor access to important resources. It enables just-in-time (JIT) activation of privileged roles, allowing users to activate administrative permissions only when needed and for a predefined, limited duration. This includes requiring approval for activation and providing comprehensive audit trails, directly addressing the requirement for temporary, time-bound administrative access.

Improvement actions are the discrete tasks Compliance Manager generates against assessed controls; each can be assigned to an owner, given a due date and tracked to completion, which directly raises the compliance score for the SOC 2 assessment.

Microsoft Purview Data Loss Prevention (DLP) policies are specifically designed to identify and prevent the unauthorized sharing of sensitive information, including via email. These policies can detect specific sensitive information types, such as credit card numbers or national ID numbers, within email content or attachments. Upon detection, a configured DLP policy can automatically block the email from being sent, thereby preventing the exfiltration of critical data.

Azure Network Security Groups (NSGs) are fundamental for implementing a Zero Trust network architecture by enabling microsegmentation. NSGs allow administrators to define granular inbound and outbound security rules that filter network traffic to and from Azure resources within a virtual network, such as VMs and subnets. This capability ensures that only explicitly authorized traffic can flow between specific workloads, enforcing the 'never trust, always verify' principle at the network layer and significantly reducing the attack surface.

Sign-in frequency is a session control that forces reauthentication after a set interval, here 60 minutes, irrespective of device compliance state. MFA is then re-enforced at each reauthentication, matching the requirement for periodic MFA regardless of compliance.

Conditional Access policies evaluate specific conditions, such as device state, before granting access to cloud applications like the company portal. By requiring a device to be marked as compliant by Microsoft Intune, these policies ensure that only devices meeting organizational security standards (e.g., OS version, encryption, antivirus) can access sensitive resources. This directly addresses a user's inability to access the portal if their device fails compliance checks, making it the correct solution.

Verify explicitly is a core Zero Trust principle: every access request is authenticated and authorised using all available signals — identity, device, location and risk — before granting access. This satisfies the model's requirement to never trust implicitly based on network location alone.

While a sensitivity label defines the specific protection settings, such as encryption and access controls, its mere existence does not automatically apply it to content. For automatic application, a distinct auto-labeling policy must be created and configured within Microsoft Purview to identify sensitive information based on specific conditions and then apply this particular label. The label definition itself is separate from its deployment via an auto-labeling policy.

The Microsoft Purview Data Map is the foundational component that automatically discovers, scans, and classifies data across hybrid environments, including Azure, on-premises, and multi-cloud sources. It creates a unified, graph-based metadata store of an organization's entire data estate, enabling comprehensive understanding and governance. This core capability is essential for building a holistic view of data assets and their relationships, which is fundamental to managing data across Azure.

Integrity guarantees that data remains accurate, complete, and unaltered throughout its entire lifecycle, especially during transmission. This means preventing unauthorized or accidental modification, deletion, or corruption of data. Mechanisms such as cryptographic hashing (e.g., SHA-256) and digital signatures are commonly employed to detect any tampering, ensuring the data received is identical to the data sent.

Anomaly detection policies in Microsoft Defender for Cloud Apps use behavioural analytics and threat intelligence to flag unusual activity such as impossible travel, mass downloads or suspicious admin operations across connected cloud applications, satisfying the anomalous-behaviour detection requirement.

Microsoft Purview Information Protection applies sensitivity labels that enforce encryption and visual markings, and its protection persists with the file so access can be revoked when documents leave the organisation. This directly satisfies the classification, marking and revocation requirements in the stem.

asmith's sign-in was indeed likely from an application or service principal, as indicated by the 'NonInteractiveUser' sign-in type. This specific type signifies that the authentication request originated from a client application, script, or service principal, rather than a direct interactive session initiated by a human user, facilitating automated access to resources.

Authorization is the security process that determines what actions an authenticated user or system is permitted to perform on a resource. After a user successfully proves their identity, the system evaluates their assigned rights and privileges, often based on roles or group memberships. In this scenario, denying access to a folder because the user lacks the necessary group membership is a direct application of an authorization policy, enforcing access control based on established permissions.

Conditional Access policies are the primary mechanism in Microsoft Entra ID for enforcing access decisions based on various conditions, including user location. Administrators can define "Named locations" using IP ranges or countries/regions, then create policies that require specific controls, such as multi-factor authentication (MFA), when users attempt to access applications from outside these trusted locations. This directly addresses the requirement to enforce location-based MFA for application access.

Microsoft Entra External ID (B2B Collaboration) is the correct solution, specifically designed for securely collaborating with external business partners. It allows guest users from partner organizations to use their existing corporate or social identities to access specific applications and resources within your Microsoft Entra tenant. This integrates partners directly into your organization's access management framework, providing controlled and managed access to internal systems.

Microsoft Defender for Cloud Apps' Cloud Discovery feature is specifically engineered to provide comprehensive visibility into all cloud applications accessed by users within an organization. It accomplishes this by ingesting and analyzing traffic logs from firewalls and proxy servers, extracting details about accessed URLs and IP addresses. This process enables the identification of both sanctioned and unsanctioned (shadow IT) cloud services, building a complete catalog of an organization's cloud app landscape and assessing associated risks.

Microsoft Entra External ID (formerly Azure AD External ID) fully supports social identities, enabling users to sign in to applications using their existing credentials from popular social identity providers like Google, Facebook, and Microsoft accounts. This capability simplifies the registration and login process for external users, leveraging their familiar accounts. These identities are managed by the respective social providers, with claims securely passed to the application via standard protocols like OpenID Connect.

Sensitivity labels with auto-labeling are specifically designed within Microsoft Purview Information Protection to automatically classify and apply protective measures to documents. They leverage sensitive information types and trainable classifiers to identify content, then enforce encryption, visual markings, and access restrictions, ensuring proactive data protection from creation and throughout its lifecycle.

Creating a new Data Loss Prevention (DLP) policy is the direct and most effective method for preventing the unauthorized sharing of sensitive data. By selecting the Finance user location, the policy is precisely scoped to the relevant individuals, and adding the credit card number condition ensures that the policy specifically targets and enforces actions against this critical sensitive information type, directly addressing the company's objective.

Access reviews are a capability within Microsoft Entra Identity Governance that allows organizations to efficiently manage group memberships, access to enterprise applications, and roles. They enable administrators, or even resource owners, to periodically review who has access to what resources, ensuring that only authorized users maintain appropriate permissions and helping to prevent privilege creep. This systematic validation of access rights is a core component of maintaining a strong security posture and meeting compliance requirements.

Microsoft Entra registered devices are typically personal devices (Bring Your Own Device - BYOD) that users want to access corporate resources from. This identity type allows devices to be enrolled in Mobile Device Management (MDM) solutions like Microsoft Intune, enabling conditional access policies and selective wipe capabilities to protect organizational data without fully controlling the user's personal device.

This scenario exemplifies Microsoft Entra B2B collaboration, where an organization extends access to its internal resources, such as a SharePoint Online site, to an external user from a partner organization. By inviting the partner user, a guest account is created in the inviting organization's Microsoft Entra tenant, allowing the external user to authenticate with their existing corporate credentials and securely access the shared resource. This facilitates secure inter-organizational cooperation.

Each component maps to one requirement: Data Lifecycle Management applies retention labels for the 7-year PII hold; DLP blocks external email sharing with justification override; Insider Risk Management detects out-of-hours access; Compliance Manager scores GDPR and ISO 27001 posture.

Microsoft Defender for Cloud Apps' anomaly detection policies leverage machine learning and User Behavior Analytics (UBA) to identify unusual activities that deviate from a user's learned baseline. These policies are specifically designed to detect sophisticated threats like impossible travel, where a user logs in from geographically distant locations in an impossibly short timeframe, or unusual login locations, failed logins, and suspicious activities, by continuously monitoring and analyzing user and entity behavior.

Cross-tenant access settings offer granular control over how users from other Microsoft Entra ID tenants interact with your resources. By configuring inbound trust settings, your tenant can be explicitly set to accept multi-factor authentication claims issued by the partner's home tenant. This crucial capability eliminates redundant MFA prompts for guest users, allowing your organization to leverage the partner's security controls and provide a seamless, yet secure, access experience.

"Assume breach" is a foundational Zero Trust principle that mandates organizations operate under the constant premise that their network and resources have already been compromised or will inevitably be. This mindset drives proactive security measures such as micro-segmentation, continuous threat detection, robust incident response planning, and regular security posture assessments. It shifts focus from perimeter defense to protecting individual resources and minimizing the blast radius of any successful attack, making it central to a resilient Zero Trust architecture.

Microsoft Entra Privileged Identity Management (PIM) directly addresses the risk of privileged account misuse by implementing just-in-time (JIT) access. It enables users to activate privileged roles only when needed, for a limited duration, and often requires an explicit approval workflow before elevation. This significantly reduces the attack surface by eliminating standing privileged access and provides comprehensive auditing of all privilege activations.

A regulatory record in Microsoft Purview is specifically designed to meet stringent regulatory compliance requirements for absolute immutability. Once an item is declared a regulatory record, it becomes permanently locked, preventing any modification or deletion by any user, including global administrators. This level of unalterable preservation ensures the content's integrity and authenticity throughout its lifecycle, making it suitable for the most demanding legal and regulatory obligations.

Data Loss Prevention in Microsoft Purview inspects email content for sensitive information types such as credit card numbers, blocks messages to external recipients, and shows policy tips to the sender. This matches the PCI DSS requirement to prevent outbound card data automatically.

The incident investigation graph in Microsoft Sentinel is a crucial tool that provides security analysts with a visual, interactive representation of an alert or incident's scope and context. It dynamically maps entities like users, hosts, and IP addresses, showing their relationships and connections to related alerts and events. This graphical view is essential for understanding the attack chain, identifying affected assets, and effectively determining the overall impact and progression of a security event.

Microsoft Entra access reviews are a critical component of identity governance, specifically designed to enable organizations to efficiently manage access by regularly reviewing who has access to what resources. They allow designated reviewers, such as group owners or managers, to periodically attest to the continued necessity of access for users to groups, applications, or roles. This process ensures that access remains appropriate, adheres to the principle of least privilege, and helps maintain compliance with organizational policies and regulatory requirements.

Conditional Access enforces the compliance requirement at authentication time, granting or denying access based on Intune device state, so jailbroken devices flagged non-compliant are blocked. Intune compliance policies supply that device signal, while Microsoft Entra join with seamless SSO satisfies the seamless sign-in constraint. Entra ID P1 licences cover Conditional Access.

Conditional Access evaluates signals such as user, device and location to grant, block or challenge access at sign-in. This satisfies the question's requirement for a Microsoft-recommended identity security practise, enforcing least-privilege access through policy rather than static permissions.

Microsoft Purview Information Protection (MPIP) is a foundational component that enables organizations to identify, categorize, and apply sensitivity labels to data across various locations, including Microsoft 365 services, on-premises file shares, and third-party cloud apps. This classification helps in understanding the data landscape and applying appropriate protection measures, making it a core capability.

Conditional Access policies offer granular control over client applications. If a policy requiring MFA is specifically configured to apply only to 'Browser' client apps, then sign-ins originating from 'Mobile Apps and Desktop clients' would be explicitly excluded from that policy's enforcement. This allows the sign-in to proceed without triggering the MFA requirement, as the policy's scope does not encompass that particular client type. Such exclusions are common for compatibility or specific use cases.

Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations, including SharePoint Online. By configuring DLP policies, organizations can automatically detect content containing sensitive information types, such as credit card numbers or national ID numbers, and then apply protective actions. These actions can include blocking external sharing, notifying administrators, or even encrypting the content, thereby directly preventing unauthorized data exfiltration.

The Device health report within Microsoft Defender for Endpoint provides a comprehensive overview of the security posture and operational status of managed devices. This report specifically includes critical information such as the status of security updates, antivirus protection, firewall configuration, and sensor health. Organizations can leverage this report to quickly identify devices that are missing essential security updates, thereby addressing potential vulnerabilities and ensuring compliance.

Combining a password with a one-time code sent to the user's phone verifies identity through two different factors, which is authentication. Authorisation governs what a verified user may access, so this process satisfies the requirement of proving who the user is.

Passwordless phone sign-in with Microsoft Authenticator leverages the user's mobile device as a second factor and a cryptographic key. When attempting to sign in, the user receives a notification on their Authenticator app, which they approve by matching a number or using biometrics, effectively eliminating the need to type a password. This method offers a convenient, secure, and widely applicable passwordless experience across various applications and services integrated with Azure Active Directory.

Microsoft Priva (Privacy Management) is purpose-built to streamline the complex process of responding to Subject Rights Requests (SRRs). It offers automated data discovery across Microsoft 365, Azure, and other connected data sources, identifying personal data relevant to a specific data subject. Priva provides a comprehensive workflow for review, redaction, collaboration, and secure fulfillment, ensuring compliance with global privacy regulations like GDPR and and CCPA.

Microsoft Purview Information Protection (MPIP) is the correct solution because it enables organizations to classify, label, and protect sensitive data across its lifecycle and various locations. Sensitivity labels, a core component of MPIP, can be configured with automatic labeling policies that detect specific sensitive information types (SITs) or trainable classifiers. Upon detection, these labels can apply visual markings, encryption, and access restrictions, ensuring that sensitive data in Microsoft Teams is consistently protected regardless of where it resides or travels.

Microsoft Entra Global Secure Access is Microsoft's unified Security Service Edge (SSE) solution, designed to extend identity-centric security to network access. It functions as a cloud-delivered proxy, routing both internet-bound and private application traffic through Microsoft's global network security perimeter. This capability enables comprehensive traffic inspection, policy enforcement, and threat protection for all network flows, directly addressing the need for secure traffic routing and robust network security for an organization's users and devices.

DLP policies are fundamental to protecting sensitive information transmitted via email. These policies scan email content, attachments, and subject lines for sensitive information types (SITs) or custom keywords before messages are sent or received. Upon detection, a policy can block the email, quarantine it for review, or simply warn the sender, thereby preventing unauthorized sharing of confidential data outside the organization. This capability is a core feature of Microsoft Purview Data Loss Prevention.

A Microsoft Entra ID conditional access policy with the compliant device grant control blocks unmanaged devices from SharePoint Online, enforcing encryption, minimum OS version and MDM enrolment. Intune compliance policies supply the device state that the policy evaluates.

Microsoft Defender for Cloud provides advanced threat protection and security posture management for hybrid cloud workloads, including Windows Server virtual machines. Its Just-in-Time (JIT) VM access feature specifically addresses the requirement by allowing temporary, controlled access to management ports like RDP. This significantly reduces the attack surface by keeping these ports closed by default, only opening them for a limited time upon approval, which is crucial for securing critical applications.

Microsoft Defender for Cloud provides a unified secure score, recommendations, and misconfiguration detection across Azure and Azure Arc-connected servers, plus JIT VM access and file integrity monitoring. This satisfies the single-dashboard and advanced threat protection requirements for both environments.

Microsoft Purview Audit (Standard) provides access to the unified audit log, enabling organizations to search for user and administrator activities across various Microsoft 365 services, including SharePoint Online. This service allows compliance officers to investigate past events, such as unusual file downloads, and to create custom alert policies based on specific activity patterns or thresholds. Its capability to search historical audit data and configure alerts for suspicious behaviors directly addresses the need for both investigation and proactive monitoring.

Access reviews are a core component of Microsoft Entra ID Governance, enabling organizations to periodically review access rights for users, including guests. When combined with connected organizations, which define external partners, access reviews can be configured to automatically remove guest accounts or their access to resources if their access is no longer justified or if reviewers fail to attest to their continued need. This directly addresses the requirement for automated removal of guest access.

A retention policy with a retention period of 7 years and then delete is the correct solution because retention policies are designed to automatically apply retention and deletion actions across entire locations, such as SharePoint sites or Exchange mailboxes. This policy ensures that content is retained for the specified 7 years and then permanently deleted without requiring any manual intervention, directly fulfilling the requirement for automatic disposition.

Multi-Factor Authentication (MFA) is the security feature specifically designed to enhance account security by requiring users to provide two or more distinct verification factors to prove their identity. These factors typically come from different categories, such as something you know (password), something you have (phone, authenticator app), or something you are (biometrics). MFA directly implements and provides the additional authentication factor beyond the primary password, making it the correct choice for adding a second verification method.

Microsoft Entra ID Protection is specifically designed to detect and remediate identity-based risks. It analyzes sign-in and user behavior to identify threats like impossible travel, leaked credentials, or unfamiliar sign-in properties. Crucially, it allows administrators to configure user risk policies that can automatically enforce actions such as requiring a password reset or blocking access when a user's risk level is deemed high, directly addressing the need for automated remediation.

The Password Administrator role in Microsoft Entra ID is specifically designed for helpdesk personnel who need to reset passwords for users and manage service requests related to identity issues. This role grants the necessary permissions to perform password resets without conferring broader administrative rights, such as the ability to create or delete user accounts, modify group memberships, or manage other user properties. It perfectly adheres to the principle of least privilege by providing only the capabilities essential for password management tasks.

In Microsoft Purview, sensitivity labels are assigned a priority order, typically based on their sensitivity value. When multiple auto-labeling policies might apply different labels to the same content, the label with the higher sensitivity value (and thus higher priority) will be applied. This ensures that the most restrictive or appropriate classification and protection settings are consistently enforced.

Microsoft Entra Application Proxy is the correct solution because it provides secure remote access to on-premises web applications by acting as a reverse proxy. It integrates these applications with Microsoft Entra ID, allowing users to authenticate using their Entra ID credentials, including multi-factor authentication and Conditional Access policies. The Application Proxy connector, installed on the on-premises network, establishes an outbound-only connection to the Entra ID cloud service, eliminating the need for inbound firewall rules or a VPN.

Microsoft Entra Access Reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and roles. They help ensure that users only have the access they need, reducing the risk of excessive or stale permissions. These reviews can be scheduled periodically or triggered on demand, requiring reviewers (e.g., group owners, managers) to attest to continued access necessity.

Microsoft Defender for Identity provides robust identity threat detection by continuously monitoring on-premises Active Directory signals and cloud identities for suspicious activities and anomalous behaviors. It leverages behavioral analytics and machine learning to identify advanced attacks such as pass-the-hash, golden ticket, and brute-force attempts, offering real-time insights into potential compromises across hybrid environments. This capability is a core component of Microsoft Defender XDR, integrating with other Defender services to provide a comprehensive view of identity-related risks and incidents.

Just-in-Time (JIT) VM access significantly reduces the attack surface by ensuring that management ports, such as RDP and SSH, remain closed by default. It dynamically opens these ports only for a limited time and from specified source IP addresses when an authorized request is made. This temporary, conditional access minimizes the window of opportunity for malicious actors to exploit open ports, thereby enhancing the security posture of virtual machines.

Self-Service Password Reset lets users reset or unlock their accounts from the sign-in page after proving identity via authentication methods, removing IT involvement. This directly satisfies the stem's requirement for login-screen resets without contacting the service desk.

Microsoft Purview Data Loss Prevention (DLP) is precisely designed to identify, monitor, and protect sensitive information across various locations, including cloud services, endpoints, and on-premises. DLP policies use sophisticated rules to detect sensitive data and automatically apply remediation actions, such as blocking sharing, encrypting content, or notifying administrators, effectively preventing unauthorized disclosure and ensuring compliance.

Correct. Microsoft Purview Customer Key allows customers to provide and manage their own encryption keys using Azure Key Vault, providing an additional layer of encryption on top of the baseline. Data is encrypted using these keys, and the customer can control key access.

Defense in depth is a comprehensive cybersecurity strategy that employs a series of diverse and overlapping security mechanisms and controls to protect valuable assets. By implementing multiple layers—such as physical security, network segmentation, firewalls, intrusion detection systems, endpoint protection, and data encryption—organizations create a robust and resilient defense. This multi-layered approach ensures that if one security control fails or is bypassed, subsequent layers are still in place to detect and prevent a breach, significantly increasing the effort and time required for an attacker to succeed.

Automation rules in Microsoft Sentinel are specifically engineered to manage and respond to incidents automatically, serving as the orchestrator for automated actions. By configuring an automation rule to trigger a specific playbook (an Azure Logic App) when a high-severity ransomware incident is created, organizations can execute predefined, automated response steps. This capability is central to Security Orchestration, Automation, and Response (SOAR), ensuring rapid and consistent handling of critical threats.

When a Microsoft Purview DLP policy is configured to block the sharing of sensitive information, the system actively prevents the email from being sent or delivered. Simultaneously, a policy tip notification is displayed to the sender within their email client or application. This notification informs the user about the policy violation, explains why the action was taken, and often provides guidance on how to resolve the issue, ensuring immediate feedback and education.