Security, Compliance, and Identity Fundamentals (SC-900) - Full Practice Exam 1

1. A company needs a cloud directory to manage users, groups, and application identities. Which service is the foundation?
2. A company needs threat detection around its on-premises Active Directory identity infrastructure. Which Defender product should it evaluate?
3. A company needs visibility into security posture and misconfigurations across supported cloud workloads. Which service is the closest fit?
4. A company uses a SaaS business application. Which TWO responsibilities generally remain with the customer? Select TWO.
5. A compliance analyst must inspect recorded user and administrator activities in supported Microsoft workloads. Which capability should be used?
6. A compliance team needs to discover and govern information across its data estate. Which Microsoft solution family should it evaluate?
7. A compliance team wants to organize improvement actions and assess progress against relevant standards. Which Purview capability should it evaluate?
8. A confidential document must carry a classification that can apply protection such as encryption and access restrictions. Which capability fits?
9. A DLP policy needs to recognize supported financial identifiers in content. Which building block can identify such data patterns?
10. A large organization wants to delegate selected directory administration for one business division. Which Entra feature provides a scoped container for supported administrative delegation?
11. A mail security team wants supported attachment analysis to help detect unknown malicious attachments before users are exposed. Which capability fits?
12. A project needs a request-and-approval process that grants a bundle of group and application access for a limited assignment period. Which capability should it evaluate?
13. A security design follows Zero Trust. Which TWO practices align with that model? Select TWO.
14. A security operations center wants a cloud-native SIEM and SOAR solution that can ingest signals from Microsoft and supported non-Microsoft sources. Which service fits?
15. A security team wants to prevent staff from reading stored information without the required key. Which technique directly addresses confidentiality of the stored representation?
16. A Sentinel deployment needs to bring supported security events from an external system into its analytics environment. Which component should be configured?
17. A service combines identity checks, network restrictions, endpoint protection, and data controls. Which security approach is being used?
18. A sign-in requires a password and a verification using an independent possession factor. Which capability does this illustrate?
19. A SOC collects large amounts of logs but never assigns incident ownership or response procedures. What is missing from an effective security operations design?
20. A supplier employee should collaborate using their existing organizational identity while the customer controls application access. Which identity model fits?
21. A team compares Microsoft Entra roles with Azure RBAC roles. Which statement is correct?
22. A team compares sensitivity labels with retention labels. Which distinction is correct?
23. A team stores a one-way digest to detect whether a downloaded file has changed. Which technique is being used?
24. A team wants prioritized recommendations about weaknesses in its cloud resource configurations. Which Defender for Cloud capability is most relevant?
25. A team wants to automate a supported sequence of actions after a Sentinel incident meets defined conditions. Which capability is the closest fit?
26. A user clicks a URL in a protected email. The team wants supported URL checking at click time. Which feature is most relevant?
27. A user proves who they are, and the system then checks whether they may open a protected record. Which two processes occur in that order?
28. Access to a sensitive application should require a compliant device and stronger authentication under defined conditions. Which capability should be configured?
29. Administrators should activate eligible privileges only when needed and for a limited time. Which capability directly fits?
30. An analyst wants to query event records and find unusual activity that no current alert rule has identified. Which activity is this?
31. An eligible Azure workload needs to authenticate to another supported service without storing a client secret. Which identity feature should be evaluated?
32. An organization must keep specified business content for a defined period and apply configured disposition behavior afterward. Which capability fits?
33. An organization needs protection against malicious content delivered through Microsoft 365 email and collaboration. Which product is the closest fit?
34. An organization wants phishing-resistant sign-in using supported FIDO2 security keys rather than shared passwords. Which authentication approach is most relevant?
35. An organization wants protection tailored to supported server and database workloads, beyond posture recommendations. Which Defender for Cloud concept applies?
36. An organization wants to investigate potentially risky insider behavior using defined policies, authorized review, and privacy controls. Which Purview capability fits?
37. Analysts need to correlate alerts from supported endpoint, identity, email, and application protections into a broader attack view. Which platform capability fits?
38. Analysts suspect a managed endpoint is actively communicating with an attacker. Which supported response action can help contain network communication while investigation continues?
39. Application owners must periodically confirm whether external collaborators still need access. Which capability supports this process?
40. Authorized investigators need to find, preserve, and review relevant electronic content for a formal investigation. Which capability is designed for this?
41. Compliance Manager reports an improved score after actions are completed. What is the correct interpretation?
42. Defender for Cloud secure score increases after recommendations are remediated. What should the team understand about that score?
43. Eligible users need to recover forgotten passwords using registered verification methods without a routine help-desk ticket. Which capability fits?
44. Employees must be warned or blocked when sharing supported sensitive information outside approved channels. Which capability should be evaluated?
45. Employees sign in once and then open several integrated applications without reentering credentials for each. Which capability is being demonstrated?
46. Security needs endpoint detection, investigation, and response for supported employee devices. Which product should it evaluate?
47. Security needs to identify suspicious sign-ins and risky users using supported identity risk detections. Which capability is the closest fit?
48. Security wants visibility and controls for the use of cloud applications, including identifying risky application activity. Which product should it evaluate?
49. Sentinel must turn matching suspicious-event patterns into actionable security detections. Which capability should be configured?
50. Several alerts appear to be related parts of one attack. Why is incident correlation useful?

Comments — 0