SC-900 Practice Questions

Question 1

Which THREE of the following are components of the Zero Trust security model?

Accepted Answer

Use least privilege access. The Zero Trust security model is built on three core principles, and option E 'Verify explicitly' is one of them: every access request must be authenticated and authorized based on all available data points (identity, device, location, workload, etc.) rather than trusting anything implicitly. Option A 'Use least privilege access' is also a core Zero Trust principle, implemented through just-in-time and just-enough-access (JIT/JEA), risk-based adaptive policies, and data protection to limit user and workload permissions. Option D 'Assume breach' is the third core principle, requiring organizations to minimize blast radius, segment access, verify end-to-end encryption, use analytics for threat detection, and design as if a breach has already occurred. Option B 'Single sign-on (SSO)' is an authentication convenience/identity mechanism that can support Zero Trust but is not itself one of its defining components, and option C 'Network perimeter security' is the traditional castle-and-moat model that Zero Trust explicitly rejects in favor of identity-centric, perimeter-less controls.

Answer

Single sign-on (SSO)

Answer

Network perimeter security

Question 2

A company wants to allow its partners to access a specific SharePoint Online site using their own corporate credentials. The company does not want to manage partner accounts. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (formerly Azure AD B2B) allows organizations to grant external partners access to resources like SharePoint Online using their own corporate or social identities. This eliminates the need to create and manage separate user accounts for partners, as they authenticate through their home identity provider via federation or invitation redemption.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 3

Refer to the exhibit. The JSON snippet shows an app registration in Microsoft Entra ID. The password credential endDateTime is set to 2025-12-31. What will happen when that date is reached?

Accepted Answer

The app will be unable to authenticate using that secret.. When the password credential (client secret) reaches its endDateTime, the secret expires and becomes invalid. Microsoft Entra ID does not automatically renew secrets; the application must use a valid secret to authenticate. Once expired, any authentication attempt using that secret will fail, preventing the app from obtaining tokens.

Answer

The secret will renew automatically.

Answer

The app registration will be automatically deleted.

Answer

The app will be blocked from signing in.

Question 4

A security administrator is configuring permissions for a new cloud-based expense reporting application. The administrator assigns each employee only the permissions they need to perform their job functions. For example, employees in the Sales department can view expense reports but cannot approve or modify financial data. Which security principle is the administrator implementing?

Accepted Answer

Least privilege. The administrator is granting each employee only the permissions necessary to perform their job functions, such as Sales being able to view but not approve or modify financial data. This directly implements the principle of least privilege, which restricts access rights to the minimum required for legitimate tasks. In cloud-based applications like expense reporting systems, least privilege reduces the attack surface and limits potential damage from compromised accounts.

Answer

Defense in depth

Answer

Separation of duties

Answer

Zero trust

Question 5

Your organization uses Microsoft Defender XDR. The security team wants a central dashboard showing the overall security posture and recommended actions. Which tool should they use?

Accepted Answer

Microsoft Secure Score. Microsoft Secure Score is the dashboard within Microsoft Defender XDR that quantifies an organization's security posture and provides prioritized, actionable improvement recommendations. It aggregates signals from Microsoft 365 services and Defender workloads, assigning points for implemented controls so the security team can track posture over time.

Answer

Microsoft Purview

Answer

Microsoft Entra ID

Answer

Microsoft Sentinel

Question 6

A financial company needs to prevent any communication between their mergers and acquisitions (M&A) team and the trading desk across all Microsoft 365 channels, including email, Microsoft Teams, and SharePoint. They must ensure that no user in one group can send emails to or chat with users in the other group. Which Microsoft Purview solution should they implement?

Accepted Answer

Information Barriers. Information Barriers (IB) is the correct solution because it is specifically designed to prevent communication and collaboration between two user groups across Microsoft 365 services, including email, Teams, and SharePoint. By defining policies that block segments (e.g., M&A team and trading desk), IB enforces restrictions at the transport, chat, and document level, ensuring no email, chat, or file sharing occurs between the groups. This directly addresses the requirement to isolate the M&A team from the trading desk across all channels.

Answer

Communication Compliance

Answer

Data Lifecycle Management

Answer

Data Loss Prevention (DLP)

Question 7

Which TWO of the following are capabilities of Microsoft Purview Information Protection?

Accepted Answer

Applying sensitivity labels to documents and emails. Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Applying sensitivity labels to documents and emails (Option D) is a core MIP capability, as labels enforce protection actions like encryption or visual markings. Encrypting content with Azure Rights Management (Option E) is the underlying technology that MIP uses to apply persistent protection, making it a direct capability of the solution.

Answer

Searching for content in eDiscovery

Answer

Preventing data loss via policies

Answer

Setting retention periods for content

Question 8

Your organization uses Microsoft Purview Communication Compliance to detect harassing messages. You receive an alert for a message that appears to be a joke between colleagues. What should you do to prevent similar false positives?

Accepted Answer

Refine the policy conditions to exclude certain keywords or users. Microsoft Purview Communication Compliance policies are configurable to reduce false positives. You can refine the policy by adding conditions to exclude specific keywords (e.g., 'joke' or 'just kidding') or specific users (e.g., known colleagues) from triggering alerts, without disabling the policy or relying on user behavior changes.

Answer

Train users not to joke about sensitive topics

Answer

Delete the alert and ignore future similar messages

Answer

Turn off the policy and use a different solution

Question 9

Refer to the exhibit. An administrator creates a Conditional Access policy in Microsoft Entra ID. What will this policy do?

Accepted Answer

Require MFA for Global Administrators accessing any application. The policy targets 'Global Administrators' and the 'All cloud apps' condition, then requires 'Require multi-factor authentication' as the access control. This means any Global Administrator attempting to access any application (not just the Entra admin center) must satisfy MFA. Option C correctly captures this scope.

Answer

Block access for Global Administrators unless they use MFA

Answer

Require MFA for all users

Answer

Require MFA for users accessing the Microsoft Entra admin center only

Question 10

A multinational corporation must comply with regulations that require them to keep financial records for 7 years and then permanently delete them. However, they are currently involved in litigation that requires preservation of all documents related to a specific project. They use Microsoft Purview. Which combination of features should they use to meet both requirements?

Accepted Answer

Data Lifecycle Management to retain for 7 years then delete, and eDiscovery (Premium) to place a legal hold on the project documents. Data Lifecycle Management (DLM) allows you to create retention labels that enforce a 7-year retention period followed by automatic deletion, satisfying the regulatory requirement. eDiscovery (Premium) provides the ability to place a legal hold on specific documents, which overrides the deletion policy to preserve data relevant to ongoing litigation. This combination ensures both compliance with the retention/deletion mandate and the preservation obligation.

Answer

Data Lifecycle Management to retain for 7 years then delete, and Sensitivity labels to mark documents

Answer

Audit (Premium) to log access and eDiscovery (Premium) to search

Answer

Information Protection to classify data and Data Lifecycle Management to retain

Question 11

You are reviewing a Conditional Access policy configuration in Microsoft Entra ID. Based on the exhibit, what is the effect of this policy?

Accepted Answer

Blocks sign-ins that have a high sign-in risk level. The policy is configured to target 'All users' and 'All cloud apps' with a condition of 'Sign-in risk level: High' and an access control of 'Block access'. This means any sign-in attempt that Microsoft Entra ID detects as having a high sign-in risk (e.g., from a compromised token or anonymous IP) will be blocked. Option B correctly identifies this effect.

Answer

Blocks sign-ins for users with high user risk

Answer

Blocks all sign-ins for the assigned users

Answer

Requires multi-factor authentication for high-risk sign-ins

Question 12

Your organization wants to label emails and documents as 'Confidential' automatically based on content patterns. Which Microsoft Purview feature should you use?

Accepted Answer

Auto-labeling (sensitivity labels). Auto-labeling (sensitivity labels) in Microsoft Purview can automatically apply 'Confidential' labels to emails and documents based on content patterns, such as credit card numbers or specific keywords. This feature uses pattern matching and machine learning classifiers to detect sensitive content and assign the appropriate sensitivity label without manual intervention.

Answer

Audit log

Answer

Retention labels

Answer

Data Loss Prevention policy

Question 13

A user is locked out of their account due to multiple failed sign-in attempts. Which Microsoft Entra ID feature can automatically block suspicious sign-in attempts based on risk?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection uses machine learning and heuristic algorithms to detect and automatically block suspicious sign-in attempts based on risk signals such as anonymous IP addresses, atypical travel, or leaked credentials. When a user is locked out due to multiple failed attempts, Entra ID Protection can evaluate the sign-in risk and enforce a block or require multi-factor authentication before allowing access.

Answer

Self-Service Password Reset (SSPR)

Answer

Microsoft Entra ID Governance

Answer

Conditional Access

Question 14

Refer to the exhibit. You run a Kusto query in Microsoft Defender XDR Advanced Hunting. What does this query return?

Accepted Answer

Top 10 high-severity alert titles by number of distinct affected devices. The query filters for high-severity alerts, then summarizes by AlertTitle and counts distinct DeviceName values. It orders by that count descending and takes the top 10, so it returns the top 10 high-severity alert titles ranked by the number of distinct affected devices.

Answer

Top 10 alert titles by number of distinct devices, including all severities

Answer

Top 10 devices with the most high-severity alerts

Answer

Top 10 high-severity alert titles by total number of alerts

Question 15

Which TWO features are part of Microsoft Purview Information Protection?

Accepted Answer

Automatic classification based on sensitive content. Microsoft Purview Information Protection (MIP) focuses on classifying, labeling, and protecting sensitive data. Automatic classification based on sensitive content (Option C) is a core capability of MIP, using built-in or custom sensitive information types to detect and label data automatically. Sensitivity labels (Option D) are the primary mechanism in MIP to apply protection actions such as encryption, access restrictions, and visual markings to documents and emails.

Answer

Communication monitoring

Answer

Retention policies

Answer

Audit log investigation

Microsoft Security, Compliance, and Identity Fundamentals SC-900 practice test

Three ways to study

Study SC-900 by domain

Study SC-900 by topic

Describe the capabilities of Microsoft Entra practice questions

Describe the capabilities of Microsoft security solutions practice questions

Describe the capabilities of Microsoft compliance solutions practice questions

Describe the concepts of security, compliance, and identity practice questions

SC-900 fundamentals practice questions

SC-900 scenario practice questions

SC-900 troubleshooting practice questions

Top SC-900 questions

Microsoft Security, Compliance, and Identity Fundamentals SC-900 practice questions