SC-900 Practice Question: Describe the concepts of security, compliance, and identity
You are the security administrator for Contoso Corporation. The company uses Microsoft 365 E5 licenses, which include Microsoft Entra ID P2, Microsoft Purview, and Microsoft Defender XDR. Contoso has a hybrid identity environment with Microsoft Entra Connect syncing on-premises Active Directory to Microsoft Entra ID. The company recently experienced a data breach where an attacker compromised a user's credentials and exfiltrated sensitive customer data from SharePoint Online. The investigation revealed that the compromised user did not have MFA enabled and had admin consent to a malicious third-party OAuth app. To prevent future incidents, management has mandated the following requirements: (1) Enforce MFA for all users, especially those accessing sensitive data. (2) Block all OAuth apps that are not pre-approved by IT. (3) Detect and respond to identity-based threats in real-time. (4) Classify and protect sensitive data in SharePoint and Teams. You need to recommend a solution that meets all requirements. Which combination of Microsoft security solutions should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Conditional Access to enforce MFA, Microsoft Defender for Cloud Apps to block unapproved OAuth apps, Microsoft Defender for Identity to detect identity threats, and Microsoft Purview Information Protection to classify and protect sensitive data.
Conditional Access enforces MFA and can block OAuth apps; Defender for Cloud Apps provides OAuth app governance; Defender for Identity detects identity threats; Purview Information Protection classifies and protects data. Defender for Cloud is for cloud workload protection, not identity or OAuth. Intune is for device management. Sentinel is a SIEM but not specific for identity threat detection. The correct combination covers all four requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conditional Access to enforce MFA, Microsoft Intune to block OAuth apps, Microsoft Defender for Endpoint to detect identity threats, and Microsoft Purview Audit to classify data.
Why it's wrong here
This option is incorrect because several components are misaligned with their stated functions. While Conditional Access correctly enforces MFA, Microsoft Intune manages devices and applications *on* devices, not the blocking of OAuth apps at the identity level. Furthermore, Microsoft Defender for Endpoint protects *endpoints* from threats, rather than providing comprehensive identity threat detection across the entire directory infrastructure. Finally, Microsoft Purview Audit logs activities but does not classify data; that capability belongs to Information Protection.
- ✗
Security defaults to enforce MFA, Microsoft Defender for Cloud to block OAuth apps, Microsoft Sentinel to detect identity threats, and Microsoft Purview Data Loss Prevention to classify data.
Why it's wrong here
Security defaults are less flexible and do not address OAuth apps; Defender for Cloud is for cloud workloads, not OAuth; Sentinel is a SIEM but not specific for identity threats; DLP detects data but does not classify with labels.
- ✗
Microsoft Entra ID Protection to enforce MFA, Microsoft Defender for Identity to block OAuth apps, Microsoft Sentinel to detect identity threats, and Microsoft Purview Data Lifecycle Management to classify data.
Why it's wrong here
ID Protection detects risks but does not enforce MFA directly (needs Conditional Access); Defender for Identity does not block OAuth apps; Sentinel is not for data classification; Data Lifecycle Management is for retention, not classification.
- ✓
Conditional Access to enforce MFA, Microsoft Defender for Cloud Apps to block unapproved OAuth apps, Microsoft Defender for Identity to detect identity threats, and Microsoft Purview Information Protection to classify and protect sensitive data.
Why this is correct
This option correctly identifies the appropriate Microsoft security and compliance services for each requirement. Conditional Access policies effectively enforce multi-factor authentication based on various conditions, enhancing sign-in security. Microsoft Defender for Cloud Apps provides the necessary Cloud Access Security Broker (CASB) capabilities to discover, assess, and block unapproved or risky OAuth applications. Microsoft Defender for Identity accurately detects advanced identity-based threats by monitoring on-premises Active Directory signals. Lastly, Microsoft Purview Information Protection is specifically designed to classify, label, and protect sensitive data across its lifecycle.
Visual reference
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defender for Cloud
Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that provides unified security management and threat protection across hybrid and multi-cloud environments.
Key term
Microsoft Entra Connect
Microsoft Entra Connect is a tool that synchronizes on-premises Active Directory identities with Microsoft Entra ID (formerly Azure AD) to enable single sign-on and centralized identity management.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.