54 free Microsoft SC-900 practice questions from the CertStash pack of 252, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 54 free here, all 252 in the pack, and each step includes the one before it.
Get all 252 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
Which score measures an organization's progress in completing actions that help reduce risks associated to data protection and regulatory standards?
Show answer and explanation
Correct answer: D. Compliance score
Compliance Score specifically measures an organization's progress in completing actions that reduce risks associated with data protection and regulatory compliance standards. It tracks improvements in security posture relative to regulatory requirements like GDPR, HIPAA, and ISO standards. Microsoft Secure Score focuses on general security improvements, Productivity Score measures organizational efficiency, and Azure Security Center Secure Score addresses infrastructure-level security risks.
Why the other options are wrong
- A. Microsoft Secure Score measures general security improvements across Microsoft 365 and Azure, not specifically compliance and regulatory standards.
- B. Productivity Score measures organizational efficiency and user engagement, not compliance or risk reduction.
- C. Azure Security Center Secure Score focuses on infrastructure and resource-level security recommendations, not regulatory compliance tracking.
Question 2
What do you use to provide real-time integration between Azure Sentinel and another security source?
Show answer and explanation
Correct answer: D. a connector
Connectors are the mechanism used to provide real-time integration between Azure Sentinel and other security sources, data sources, and applications. Connectors enable continuous data ingestion and synchronization from external systems into Azure Sentinel for analysis and threat detection. Azure AD Connect is for directory synchronization, Log Analytics workspaces are storage repositories, and Azure Information Protection is a data governance tool.
Why the other options are wrong
- A. Azure AD Connect is used for synchronizing on-premises directories with Azure AD, not for integrating security sources with Sentinel.
- B. Log Analytics workspaces store and analyze data but are not the mechanism for real-time integration with external security sources.
- C. Azure Information Protection is a data classification and protection tool, unrelated to Sentinel integration with security sources.
Question 3
Which Microsoft portal provides information about how Microsoft cloud services comply with regulatory standard, such as International Organization for Standardization (ISO)?
Show answer and explanation
Correct answer: C. Microsoft Service Trust Portal
The Microsoft Service Trust Portal is the dedicated resource that provides detailed information about how Microsoft cloud services comply with various regulatory standards including ISO, HIPAA, GDPR, SOC 2, and others. It contains compliance reports, audit findings, and trust documentation. Endpoint Manager is for device management, Cost Management is for billing analysis, and Azure AD admin center is for identity management.
Why the other options are wrong
- A. Microsoft Endpoint Manager admin center is used for managing devices and applications, not for viewing regulatory compliance information.
- B. Azure Cost Management + Billing is for tracking and optimizing cloud spending, not for compliance documentation.
- D. The Azure Active Directory admin center manages user identities and access controls, not regulatory compliance information.
Question 4
In the shared responsibility model for an Azure deployment, what is Microsoft solely responsible for managing?
Show answer and explanation
Correct answer: D. the management of the physical hardware
In the Azure shared responsibility model, Microsoft is solely responsible for managing the physical hardware, data centers, network infrastructure, and physical security. Customers are responsible for managing their own data, applications, user accounts, identities, and access permissions. Mobile device management, user permissions, and user account creation are customer responsibilities.
Why the other options are wrong
- A. Mobile device management is a customer responsibility within the shared responsibility model.
- B. Permissions for user data stored in Azure are managed by the customer, not Microsoft.
- C. Creation and management of user accounts is the customer's responsibility in Azure deployments.
Question 5
In the Microsoft Cloud Adoption Framework for Azure, which two phases are addressed before the Ready phase? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, E. Plan; Define Strategy
The Microsoft Cloud Adoption Framework for Azure follows a sequence where Define Strategy and Plan phases occur before the Ready phase. Define Strategy establishes the business case and cloud strategy, Plan creates a detailed implementation plan, and then Ready prepares the Azure environment. The Adopt and Govern phases come after Ready in the framework sequence.
Why the other options are wrong
- B. Manage comes after Ready and Adopt phases, not before Ready.
- C. Adopt (implementing and migrating workloads) comes after the Ready phase.
- D. Govern comes after Adopt in the framework sequence, following the Ready phase.
Question 6
What is an example of encryption at rest?
Show answer and explanation
Correct answer: B. encrypting a virtual machine disk
Encryption at rest specifically refers to encrypting data when it is stored or dormant on physical media. Encrypting a virtual machine disk is a classic example of encryption at rest, protecting stored data from unauthorized access. Site-to-site VPN encryption protects data in transit, HTTPS encryption is for data in transit over networks, and encrypted email protects data in transit during transmission.
Why the other options are wrong
- A. Site-to-site VPN encryption protects data in transit between networks, not at rest.
- C. HTTPS encryption secures communications in transit, which is encryption in transit, not at rest.
- D. Sending encrypted email protects data during transmission, which is encryption in transit, not at rest.
Question 7
Which three statements accurately describe the guiding principles of Zero Trust? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, C, D. Use identity as the primary security boundary; Always verify the permissions of a user explicitly; Always assume that the user system can be breached.
Zero Trust security principles include using identity as the primary security boundary (replacing network perimeter), always explicitly verifying user permissions rather than assuming trust, and assuming that breaches can occur so continuous verification is necessary. These principles shift security from network-centric to identity-centric models. Defining perimeters by physical location and using the network as the primary boundary are traditional security approaches that Zero Trust specifically rejects.
Why the other options are wrong
- A. Defining the perimeter by physical locations is a traditional approach that Zero Trust explicitly rejects in favor of identity-based boundaries.
- E. Using the network as the primary security boundary is the legacy approach that Zero Trust replaces with identity as the primary boundary.
Question 8
What can you use to provide a user with a two-hour window to complete an administrative task in Azure?
Show answer and explanation
Correct answer: A. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
Azure AD Privileged Identity Management (PIM) enables time-bound access elevation for administrative tasks, allowing organizations to grant users elevated permissions for a specific duration (such as a two-hour window). PIM is specifically designed for just-in-time privileged access. MFA is for authentication verification, Identity Protection is for anomalous sign-in detection, and conditional access enforces access policies but does not specifically provide time-limited administrative access windows.
Why the other options are wrong
- B. Azure Multi-Factor Authentication verifies user identity through multiple factors but does not provide time-limited access windows for administrative tasks.
- C. Azure AD Identity Protection detects anomalous and risky sign-in patterns but does not provide time-limited administrative access.
- D. Conditional access policies enforce access rules and conditions but are not specifically designed for time-limited administrative task windows like PIM provides.
Question 9
In a hybrid identity model, what can you use to sync identities between Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD)?
Show answer and explanation
Correct answer: C. Azure AD Connect
Azure AD Connect is the Microsoft tool designed specifically to synchronize identities between on-premises Active Directory Domain Services and Azure Active Directory. It enables hybrid identity management by ensuring consistent user accounts, groups, and contacts across both environments.
Why the other options are wrong
- A. AD FS is used for federation and single sign-on, not for identity synchronization between AD DS and Azure AD.
- B. Microsoft Sentinel is a security information and event management (SIEM) solution, not an identity synchronization tool.
- D. Azure AD PIM is for privileged identity management and access control, not for syncing identities between directories.
Question 10
What is the purpose of Azure Active Directory (Azure AD) Password Protection?
Show answer and explanation
Correct answer: D. to prevent users from using specific words in their passwords
Azure AD Password Protection prevents users from using weak passwords by maintaining a global banned password list and custom banned password lists specific to organizations. It blocks passwords containing common words, variations of the organization name, and other easily guessable terms.
Why the other options are wrong
- A. Password expiration policies are controlled through separate password policy settings, not Password Protection specifically.
- B. Device access without MFA is controlled through conditional access policies, not Password Protection.
- C. Encryption of passwords is a security transport mechanism, not the purpose of Password Protection which focuses on preventing weak password choices.
What people say about the full SC-900 pack 5.0 from 11
Passed my SC-900! Great foundational cert and this dump made it straightforward. Real questions throughout. Passed comfortably on first attempt.
Good dump. Passed without issues.
Security fundamentals were laid out well in the practice questions I used. The format felt familiar by exam day. Passed SC-900 without issue.
Question 11
What should you use to ensure that the members of an Azure Active Directory group use multi-factor authentication (MFA) when they sign in?
Show answer and explanation
Correct answer: D. a conditional access policy
Conditional access policies are the appropriate Azure AD feature to enforce MFA requirements for specific groups of users based on conditions like sign-in risk, location, or device compliance.
Why the other options are wrong
- A. Azure RBAC controls resource access permissions based on roles, not authentication requirements.
- B. Azure AD PIM is for managing privileged access to resources, not for enforcing MFA on general user groups.
- C. Identity Protection detects and responds to risk-based threats but doesn't enforce MFA requirements.
Question 12
Which Azure Active Directory (Azure AD) feature can you use to restrict Microsoft Intune-managed devices from accessing corporate resources?
Show answer and explanation
Correct answer: C. conditional access policies
Conditional access policies in Azure AD allow organizations to restrict access to corporate resources based on device compliance status, including Intune-managed device requirements. This enables enforcement of managed device policies before granting access.
Why the other options are wrong
- A. Network security groups control network traffic but cannot enforce Intune device compliance requirements.
- B. Privileged Identity Management manages elevated access permissions, not device compliance restrictions.
- D. Resource locks prevent resource deletion or modification, not device-based access restrictions.
Question 13
What does Conditional Access evaluate by using Azure Active Directory (Azure AD) Identity Protection?
Show answer and explanation
Correct answer: D. user risk
Conditional Access uses Azure AD Identity Protection to evaluate user risk as one of its signal inputs. User risk scores indicate the likelihood that an identity has been compromised based on detected suspicious activities and anomalies.
Why the other options are wrong
- A. While Conditional Access can evaluate user actions, Identity Protection specifically assesses risk signals, not general user actions.
- B. Group membership is a Conditional Access signal but not specifically evaluated through Identity Protection.
- C. Device compliance is a Conditional Access signal but is evaluated through Intune/Endpoint Manager, not Identity Protection.
Question 14
You have a Microsoft 365 E3 subscription. You plan to audit user activity by using the unified audit log and Basic Audit. For how long will the audit records be retained?
Show answer and explanation
Correct answer: D. 180 days
Audit (Standard), formerly Basic Audit, retains audit records in the unified audit log for 180 days. Microsoft raised the default from 90 to 180 days in October 2023 for all subscriptions with Audit (Standard), including Microsoft 365 E3. Longer retention, such as one year, requires Audit (Premium).
Why the other options are wrong
- A. 15 days is not a retention period used by Microsoft Purview Audit.
- B. 30 days is not the retention period for Audit (Standard) records.
- C. 90 days was the old default and was increased to 180 days for Audit (Standard).
Question 15
Which Azure Active Directory (Azure AD) feature can you use to provide just-in-time (JIT) access to manage Azure resources?
Show answer and explanation
Correct answer: C. Azure AD Privileged Identity Management (PIM)
Azure AD Privileged Identity Management (PIM) provides just-in-time access to Azure resources by allowing administrators to request temporary activation of privileged roles with defined time limits. This minimizes standing administrative access and reduces security exposure.
Why the other options are wrong
- A. Conditional access policies enforce access requirements based on conditions but do not provide time-bound role activation.
- B. Identity Protection detects and responds to identity-based risks rather than managing privileged access.
- D. Authentication method policies define which authentication methods users can use, not time-bound role activation.
Question 16
Which three authentication methods can be used by Azure Multi-Factor Authentication (MFA)? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, B, D. text message (SMS); Microsoft Authenticator app; phone call
Azure Multi-Factor Authentication supports text message (SMS), Microsoft Authenticator app, and phone calls as authentication methods. These three provide flexible options for users to verify their identity through different channels.
Why the other options are wrong
- C. Email verification is not a standard Azure MFA authentication method.
- E. Security questions are not supported as an Azure MFA authentication method for the standard MFA service.
Question 17
Which two types of resources can be protected by using Azure Firewall? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, D. Azure virtual machines; Azure virtual networks
Azure Firewall protects two types of resources: (A) Azure virtual machines by filtering their inbound and outbound traffic, and (D) Azure virtual networks as a whole by acting as a managed firewall service that secures network traffic within and entering the virtual network.
Why the other options are wrong
- B. Azure AD users are identity objects and are not network resources that Azure Firewall can protect.
- C. Microsoft Exchange Online inboxes are cloud services protected by Exchange Online security features, not Azure Firewall.
- E. Microsoft SharePoint Online sites are cloud services with their own security controls, not Azure Firewall-protected resources.
Question 18
What are customers responsible for when evaluating security in a software as a service (SaaS) cloud services model?
Show answer and explanation
Correct answer: D. accounts and identities
In a SaaS model, the cloud provider manages the application, operating system, and network controls. Customers are primarily responsible for managing accounts and identities, including user provisioning, authentication policies, access management, and identity governance.
Why the other options are wrong
- A. Operating systems are managed and maintained by the SaaS provider, not the customer.
- B. Network controls are part of the cloud provider's infrastructure responsibility in SaaS.
- C. The application itself is developed, maintained, and secured by the SaaS provider.
Question 19
What can you protect by using the information protection solution in the Microsoft 365 compliance center?
Show answer and explanation
Correct answer: D. sensitive data from being exposed to unauthorized users
The information protection solution in Microsoft 365 compliance center is designed to identify, classify, and protect sensitive data from unauthorized exposure. It helps organizations prevent data loss and ensure sensitive information remains secure.
Why the other options are wrong
- A. Zero-day exploit protection is handled by endpoint protection and threat defense solutions, not information protection.
- B. Phishing protection is managed through threat intelligence and email security features, not information protection.
- C. Malware and virus protection is the function of antimalware and endpoint security solutions.
Question 20
Which service includes the Attack simulation training feature?
Show answer and explanation
Correct answer: D. Microsoft Defender for Office 365
Microsoft Defender for Office 365 includes the Attack simulation training feature, which allows organizations to conduct simulated phishing and other attacks to train users on security awareness. This feature is specifically part of Office 365's threat protection capabilities, not available in the other Defender products listed.
Why the other options are wrong
- A. Defender for Cloud Apps focuses on cloud application security and threat detection, not attack simulation training.
- B. Defender for Identity protects against identity-based attacks on on-premises Active Directory, lacking attack simulation features.
- C. Defender for SQL provides database threat protection and vulnerability assessments, not attack simulation training.
Question 21
What should you use in the Microsoft 365 Defender portal to view security trends and track the protection status of identities?
Show answer and explanation
Correct answer: B. Reports
The Reports section in the Microsoft 365 Defender portal provides dashboards and visualizations for viewing security trends, tracking protection status across identities, devices, and applications, and monitoring the effectiveness of security controls.
Why the other options are wrong
- A. Attack simulator is used for testing security awareness and defenses, not viewing security trends.
- C. Hunting is used for proactive threat investigation, not for viewing overall security status and trends.
- D. Incidents shows detected security events requiring response, not aggregate trends and protection status.
Question 22
You have an Azure subscription. You need to implement approval-based, time-bound role activation. What should you use?
Show answer and explanation
Correct answer: D. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
Azure AD Privileged Identity Management (PIM) is designed to implement approval-based, time-bound role activation. It enables organizations to grant temporary elevated permissions that expire automatically, require manager approval for activation, and maintain audit logs of all privileged access.
Why the other options are wrong
- A. Windows Hello for Business is an authentication method for device logon, not for managing privileged role activation.
- B. Identity Protection detects and mitigates identity risks rather than managing approval-based role activation.
- C. Access reviews evaluate current group and role memberships but do not provide the approval and time-bound activation mechanisms required.
Question 23
Which Microsoft 365 feature can you use to restrict users from sending email messages that contain lists of customers and their associated credit card numbers?
Show answer and explanation
Correct answer: B. data loss prevention (DLP) policies
Data loss prevention (DLP) policies are designed to identify and protect sensitive information such as credit card numbers and customer lists from being transmitted insecurely or shared inappropriately. DLP can scan email content and block messages containing specific sensitive data patterns before they are sent.
Why the other options are wrong
- A. Retention policies manage how long content is kept and when it is deleted, not how sensitive data is protected during transmission.
- C. Conditional access policies control user access to resources based on conditions but do not scan message content for sensitive data.
- D. Information barriers restrict communication between user groups, not sensitive data patterns within messages.
Question 24
Which two cards are available in the Microsoft 365 Defender portal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, E. Devices at risk; Users at risk
The Microsoft 365 Defender portal displays cards showing security insights including 'Devices at risk' and 'Users at risk' to help security teams quickly identify and respond to threats affecting organizational resources.
Why the other options are wrong
- B. Compliance Score appears in the Compliance Manager, not in the Microsoft 365 Defender portal.
- C. Service Health is found in the Microsoft 365 admin center, not the Defender portal.
- D. User Management is an administrative function not displayed as a primary card in the Defender portal.
Question 25
Which Azure Active Directory (Azure AD) feature can you use to evaluate group membership and automatically remove users that no longer require membership in a group?
Show answer and explanation
Correct answer: A. access reviews
Access reviews in Azure AD allow organizations to periodically review group memberships and automatically remove users who no longer require access. Reviewers can certify that users should remain members or remove them based on changed business requirements.
Why the other options are wrong
- B. Managed identities are used for authenticating Azure services, not for evaluating and managing group membership.
- C. Conditional access policies control access based on conditions like location and device state, not group membership review and removal.
- D. Azure AD Identity Protection detects and responds to security risks, not for managing group memberships.
Question 26
You plan to implement a security strategy and place multiple layers of defense throughout a network infrastructure. Which security methodology does this represent?
Show answer and explanation
Correct answer: C. defense in depth
Defense in depth is the security methodology that implements multiple layers of defense throughout a network infrastructure. This approach ensures that if one security layer is compromised, additional layers remain in place to protect assets, reducing overall risk through redundancy and diversity of controls.
Why the other options are wrong
- A. Threat modeling is a process for identifying and analyzing potential security threats, not a layered defense strategy.
- B. Identity as the security perimeter is a modern security approach focusing on user and device verification rather than network perimeter defense.
- D. The shared responsibility model describes how cloud providers and customers divide security responsibilities, not a defense layering strategy.
Question 27
Which three authentication methods does Windows Hello for Business support? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, B, C. fingerprint; facial recognition; PIN
Windows Hello for Business supports three biometric and PIN-based authentication methods: fingerprint recognition, facial recognition using infrared cameras, and PIN. These passwordless methods provide secure and convenient authentication on Windows devices.
Why the other options are wrong
- D. Email verification is not a Windows Hello for Business authentication method.
- E. Security questions are not supported by Windows Hello for Business authentication.
Question 28
What can you use to provide threat detection for Azure SQL Managed Instance?
Show answer and explanation
Correct answer: C. Microsoft Defender for Cloud
Microsoft Defender for Cloud provides threat detection capabilities for Azure SQL Managed Instance through advanced threat protection features that monitor for suspicious activities and potential vulnerabilities, offering real-time security monitoring and alerts.
Why the other options are wrong
- A. Microsoft Secure Score is a measurement tool for security posture, not a threat detection mechanism.
- B. Application security groups are network-level access control tools, not threat detection solutions.
- D. Azure Bastion provides secure remote access to virtual machines, not SQL threat detection.
Question 29
Which Microsoft 365 compliance center feature can you use to identify all the documents on a Microsoft SharePoint Online site that contain a specific key word?
Show answer and explanation
Correct answer: C. Content Search
Content Search is the compliance center feature specifically designed to search across Microsoft 365 services including SharePoint Online to identify and locate documents containing specific keywords. It allows broad searches across multiple locations and provides detailed results about matching content.
Why the other options are wrong
- A. Audit logs record user and admin activities but are not designed to search document content for specific keywords.
- B. Compliance Manager helps organizations track and manage compliance requirements but does not search document content for keywords.
- D. Alerts are notifications about policy violations or security events, not tools for searching document content within SharePoint.
Question 30
Which type of identity is created when you register an application with Active Directory (Azure AD)?
Show answer and explanation
Correct answer: D. a service principal
When you register an application with Azure AD, a service principal is created. The service principal is the identity object that represents the application within the Azure AD tenant, allowing the application to authenticate and receive permissions for accessing resources.
Why the other options are wrong
- A. A user account is for human users, not applications.
- B. A user-assigned managed identity is a separate Azure resource for assigning identities to other Azure resources.
- C. A system-assigned managed identity is automatically created for Azure resources but is distinct from the identity created during app registration.
Question 31
Which statement represents a Microsoft privacy principle?
Show answer and explanation
Correct answer: B. Microsoft respects the local privacy laws that are applicable to its customers.
A core Microsoft privacy principle is respect for local privacy laws applicable to customers. Microsoft commits to complying with all relevant privacy regulations in the jurisdictions where it operates and serves customers.
Why the other options are wrong
- A. Microsoft empowers customers to manage their own privacy settings rather than managing them for customers.
- C. Microsoft does not use customer email and chat data for targeted advertising; this would violate its privacy commitments.
- D. Microsoft does collect customer data as necessary for service delivery, but does so transparently and with appropriate safeguards.
Question 32
What can you specify in Microsoft 365 sensitivity labels?
Show answer and explanation
Correct answer: C. which watermark to add to files
Sensitivity labels in Microsoft 365 allow organizations to specify visual markings such as watermarks to be added to labeled files and emails, helping to identify and protect sensitive content.
Why the other options are wrong
- A. File retention duration is specified through retention policies, not sensitivity labels.
- B. Email archiving schedules are managed through retention policies and mailbox settings, not sensitivity labels.
- D. File storage location is determined by SharePoint and OneDrive settings, not sensitivity labels.
Question 33
What are three uses of Microsoft Cloud App Security? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, C, E. to discover and control the use of shadow IT; to protect sensitive information hosted anywhere in the cloud; to prevent data leaks to noncompliant apps and limit access to regulated data
Microsoft Cloud App Security (now part of Microsoft Defender for Cloud Apps) enables discovery and control of shadow IT applications, protects sensitive data across cloud environments through classification and protection policies, and prevents data leaks by blocking access to noncompliant apps while enforcing controls on regulated data.
Why the other options are wrong
- B. Providing secure connections to Azure virtual machines is the function of Azure Bastion, not Cloud App Security.
- D. Pass-through authentication to on-premises applications is provided by Azure AD Application Proxy or similar identity solutions, not Cloud App Security.
Question 34
You need to create a data loss prevention (DLP) policy. What should you use?
Show answer and explanation
Correct answer: A. the Microsoft 365 Compliance center
Data Loss Prevention (DLP) policies are created and managed in the Microsoft 365 Compliance Center. This is the dedicated portal for all compliance-related features including DLP, retention policies, sensitivity labels, and other data governance tools.
Why the other options are wrong
- B. Endpoint Manager admin center is used for device and application management, not DLP policy creation.
- C. The Microsoft 365 admin center handles general tenant administration but DLP policies are specifically created in the Compliance Center.
- D. Microsoft 365 Defender portal focuses on threat protection and security investigations, not compliance policy creation.
Question 35
You need to keep a copy of all files in a Microsoft SharePoint site for one year, even if users delete the files from the site. What should you apply to the site?
Show answer and explanation
Correct answer: A. a retention policy
A retention policy is the appropriate tool to preserve a copy of all files in a SharePoint site for a specified period (one year), even after users delete them. Retention policies hold data for compliance and legal purposes.
Why the other options are wrong
- B. Insider risk policies monitor user activities for policy violations, not for preserving deleted files.
- C. DLP policies prevent unauthorized data sharing and loss, not file preservation and retention.
- D. Sensitivity label policies control classification and protection of data, not retention periods.
Question 36
You need to connect to an Azure virtual machine by using Azure Bastion. What should you use?
Show answer and explanation
Correct answer: B. the Azure portal
Azure Bastion provides secure remote access to Azure virtual machines through the Azure portal interface directly, eliminating the need for RDP/SSH clients or exposed public IP addresses. Users simply navigate to the VM in the portal and select Connect via Bastion.
Why the other options are wrong
- A. PowerShell remoting requires direct network connectivity and is not the Azure Bastion connection method.
- C. While Remote Desktop Connection could technically work, Azure Bastion's primary interface is through the Azure portal without needing the RDP client.
- D. SSH clients may be used with Bastion for Linux VMs but the connection originates through the Azure portal, not directly via SSH.
Question 37
Which Microsoft 365 compliance feature can you use to encrypt content automatically based on specific conditions?
Show answer and explanation
Correct answer: B. sensitivity labels
Sensitivity labels can automatically apply encryption to content based on conditions specified by the administrator, such as file type, content patterns, or recipient. This is a core feature that protects sensitive data automatically.
Why the other options are wrong
- A. Content Search is used to find and retrieve data, not to encrypt content automatically.
- C. Retention policies manage how long data is kept, not automatic encryption based on conditions.
- D. eDiscovery is used for legal investigations and data discovery, not for automatic encryption.
Question 38
Which two tasks can you implement by using data loss prevention (DLP) policies in Microsoft 365? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, C. Display policy tips to users who are about to violate your organization's policies; Protect documents in Microsoft OneDrive that contain sensitive information.
DLP policies can display policy tips to warn users before they violate policies, and they can protect sensitive documents in OneDrive and other locations by preventing unauthorized sharing or access. Both are core DLP functions.
Why the other options are wrong
- B. Disk encryption is managed through device management and BitLocker settings, not DLP policies.
- D. Security baselines are applied through device management and compliance settings, not DLP policies.
Question 39
When security defaults are enabled for an Azure Active Directory (Azure AD) tenant, which two requirements are enforced? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, C. Administrators must always use Azure Multi-Factor Authentication (MFA); Azure Multi-Factor Authentication (MFA) registration is required for all users.
When security defaults are enabled in Azure AD, two key requirements are enforced: (B) Administrators must always use Azure MFA to protect privileged accounts, and (C) MFA registration is required for all users, though it can be completed later. Security defaults mandate MFA for admins immediately and require all users to register for MFA, enhancing the tenant's security posture without blocking user access.
Why the other options are wrong
- A. Security defaults do not require all users to authenticate from registered devices; that's a separate conditional access policy requirement.
- D. Passwordless sign-in is not mandated by security defaults; users can still use traditional passwords.
- E. Windows Hello is not a requirement of security defaults; it's an optional passwordless authentication method.
Question 40
What feature in Microsoft Defender for Endpoint provides the first line of defense against cyberthreats by reducing the attack surface?
Show answer and explanation
Correct answer: D. network protection
Network protection in Microsoft Defender for Endpoint provides the first line of defense by reducing the attack surface. It blocks malicious connections at the network level, preventing threats from reaching endpoints and protecting against network-based attacks before they can compromise systems.
Why the other options are wrong
- A. Automated remediation responds to threats after detection, not as a first line of defense.
- B. Automated investigation analyzes and responds to detected threats, occurring after initial defense.
- C. Advanced hunting is used to proactively search for threats, not to prevent them initially.
Question 41
What can you use to deploy Azure resources across multiple subscriptions in a consistent manner?
Show answer and explanation
Correct answer: B. Azure Blueprints
Azure Blueprints enable you to deploy Azure resources across multiple subscriptions in a consistent and repeatable manner. Blueprints allow you to define a reusable set of Azure resources with policies and role assignments that can be deployed consistently across different subscriptions and environments.
Why the other options are wrong
- A. Microsoft Defender for Cloud is a security posture management and threat protection service, not a resource deployment tool.
- C. Microsoft Sentinel is a cloud-native SIEM solution for security monitoring and threat detection, not for resource deployment.
- D. Azure Policy enforces compliance standards and governance rules but does not deploy resources across multiple subscriptions in a templated manner like Blueprints.
Question 42
Which two Azure resources can a network security group (NSG) be associated with? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, B. a virtual network subnet; a network interface
Network security groups (NSGs) can be associated with both virtual network subnets and network interfaces. These are the two primary attachment points for NSGs in Azure, allowing granular control of network traffic at either the subnet level or the individual network interface card level.
Why the other options are wrong
- C. Resource groups are logical containers for resources but are not network entities and cannot be directly associated with NSGs.
- D. Virtual networks cannot directly have NSGs associated with them; NSGs must be associated with subnets within a virtual network.
- E. Azure App Service web apps do not have NSGs associated with them directly; network traffic is controlled through other mechanisms like service endpoints and access restrictions.
Question 43
In a Core eDiscovery workflow, what should you do before you can search for content?
Show answer and explanation
Correct answer: A. Create an eDiscovery hold.
Before searching for content in Core eDiscovery, you must first create an eDiscovery hold. The hold preserves content in the relevant locations (mailboxes, sites, etc.) so that data cannot be deleted during the investigation. This is a prerequisite step to ensure content preservation before conducting searches.
Why the other options are wrong
- B. Express Analysis is run after you have collected and exported content, not before searching for it.
- C. Attorney-client privilege detection is a post-search analysis feature used when reviewing results, not a prerequisite for searching.
- D. Exporting and downloading results occurs at the end of the eDiscovery workflow after searches have been conducted and results reviewed.
Question 44
Which Microsoft 365 feature can you use to restrict communication and the sharing of information between members of two departments at your organization?
Show answer and explanation
Correct answer: C. information barriers
Information barriers in Microsoft 365 allow organizations to restrict communication and information sharing between specific groups or departments. This compliance feature prevents cross-department collaboration when regulatory or business policies require separation.
Why the other options are wrong
- A. Sensitivity label policies control how information is classified and protected, but do not restrict communication between departments.
- B. Customer Lockbox provides audit capabilities and approval controls for Microsoft personnel access, not for internal department separation.
- D. Privileged Access Management (PAM) controls elevated access to systems, not communication and information sharing between departments.
Question 45
Which Microsoft portal provides information about how Microsoft manages privacy, compliance, and security?
Show answer and explanation
Correct answer: A. Microsoft Service Trust Portal
The Microsoft Service Trust Portal is the official Microsoft resource that provides detailed information about how Microsoft manages privacy, compliance, and security across its cloud services. It includes audit reports, compliance documentation, and security assessments.
Why the other options are wrong
- B. Compliance Manager is a tool for managing compliance tasks and improvement actions, not a general information portal.
- C. Microsoft 365 compliance center is for managing compliance policies and solutions, not for learning about Microsoft's own practices.
- D. Microsoft Support handles technical support tickets, not privacy and compliance information.
Question 46
To which type of resource can Azure Bastion provide secure access?
Show answer and explanation
Correct answer: C. Azure virtual machines
Azure Bastion provides secure remote access to Azure virtual machines through the Azure portal using RDP or SSH protocols without requiring public IP addresses or VPN connections.
Why the other options are wrong
- A. Azure Files is a cloud storage service that does not require Azure Bastion for secure access.
- B. Azure SQL Managed Instances are databases that use other security mechanisms and connection methods.
- D. Azure App Service is a web hosting service that uses different access mechanisms than Azure Bastion.
Question 47
Which type of alert can you manage from the Microsoft 365 Defender portal?
Show answer and explanation
Correct answer: C. Microsoft Defender for Endpoint
Microsoft Defender for Endpoint alerts can be managed from the Microsoft 365 Defender portal. The portal provides centralized alert management for endpoint security incidents, allowing security teams to view, investigate, and respond to endpoint threats in a unified interface.
Why the other options are wrong
- A. Microsoft Defender for Storage is an Azure-based service managed through the Azure portal, not the Microsoft 365 Defender portal.
- B. Microsoft Defender for SQL is managed through the Azure portal and SQL-specific interfaces, not primarily through Microsoft 365 Defender.
- D. Microsoft Defender for IoT is managed through Azure portals and IoT-specific management tools, not the Microsoft 365 Defender portal.
Question 48
What can you use to scan email attachments and forward the attachments to recipients only if the attachments are free from malware?
Show answer and explanation
Correct answer: A. Microsoft Defender for Office 365
Microsoft Defender for Office 365 provides the capability to scan email attachments for malware and forward them to recipients only if they are clean. This protects users from malware delivered via email and includes features like safe attachments that detonate files in a sandbox environment before delivery.
Why the other options are wrong
- B. Microsoft Defender Antivirus protects endpoints but is not specifically designed for scanning email attachments in transit.
- C. Microsoft Defender for Identity focuses on detecting identity-based attacks and compromised credentials, not email attachment scanning.
- D. Microsoft Defender for Endpoint protects individual devices but is not the service used to scan email attachments at the email gateway level.
Question 49
What can you use to view the Microsoft Secure Score for Devices?
Show answer and explanation
Correct answer: B. Microsoft Defender for Endpoint
Microsoft Secure Score for Devices is viewed through Microsoft Defender for Endpoint. This portal provides device-level security assessments, vulnerability management, and secure score metrics specific to endpoints and devices.
Why the other options are wrong
- A. Defender for Cloud Apps focuses on cloud application security and SaaS security, not device secure scores.
- C. Defender for Identity is focused on on-premises Active Directory threat detection, not device secure scores.
- D. Defender for Office 365 is specialized for email and collaboration security, not device security scoring.
Question 50
What are two capabilities of Microsoft Defender for Endpoint? Each correct selection presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: A, D. automated investigation and remediation; attack surface reduction
Microsoft Defender for Endpoint provides two key capabilities: (A) automated investigation and remediation that reduces response time by automatically analyzing alerts and taking corrective actions, and (D) attack surface reduction through policies and rules that block or prevent exploitation of common attack vectors and vulnerabilities.
Why the other options are wrong
- B. Transport encryption is a network security feature, not a primary Defender for Endpoint capability.
- C. Shadow IT detection is primarily a Microsoft Defender for Cloud Apps capability, not a core Defender for Endpoint function.
Question 51
What is an assessment in Compliance Manager?
Show answer and explanation
Correct answer: C. A grouping of controls from a specific regulation, standard or policy.
In Compliance Manager, an assessment is a grouping of controls organized around a specific regulation, standard, or policy. Assessments help organizations map their compliance controls to regulatory frameworks and track their compliance progress.
Why the other options are wrong
- A. A policy initiative is an Azure Policy concept, not a Compliance Manager assessment.
- B. A dictionary of prohibited words relates to DLP or content filtering, not Compliance Manager assessments.
- D. Recommended guidance is provided through improvement actions or recommendations, not through assessments themselves.
Question 52
Which three tasks can be performed by using Azure Active Directory (Azure AD) Identity Protection? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Show answer and explanation
Correct answer: B, C, D. Export risk detection to third-party utilities; Automate the detection and remediation of identity based-risks; Investigate risks that relate to user authentication.
Azure AD Identity Protection enables three key tasks: (B) exporting risk detection data to third-party utilities for integration with other security tools, (C) automating the detection and remediation of identity-based risks through conditional access policies, and (D) investigating risks related to user authentication through detailed risk reports and insights.
Why the other options are wrong
- A. Configuring external access for partner organizations is an Azure AD B2B collaboration feature, not an Identity Protection capability.
- E. Creating and assigning sensitivity labels to data is a Microsoft Information Protection feature, unrelated to Identity Protection.
Question 53
Which feature provides the extended detection and response (XDR) capability of Azure Sentinel?
Show answer and explanation
Correct answer: C. integration with Microsoft 365 Defender
Azure Sentinel provides extended detection and response (XDR) capabilities through its integration with Microsoft 365 Defender, which allows it to correlate and analyze security signals from across Microsoft's security stack including endpoints, email, identity, and cloud apps. This integration enables comprehensive threat detection and response workflows.
Why the other options are wrong
- A. Integration with Microsoft 365 compliance center relates to data governance and compliance, not XDR detection capabilities.
- B. Threat hunting is a separate feature for proactive investigation, not the primary XDR capability provider.
- D. Azure Monitor Workbooks are visualization tools for monitoring, not the core XDR feature.
Question 54
What is a use case for implementing information barrier policies in Microsoft 365?
Show answer and explanation
Correct answer: B. to restrict Microsoft Teams chats between certain groups within an organization
Information barrier policies are designed to restrict communication and collaboration between specific groups within an organization. The primary use case is preventing Microsoft Teams chats (and other collaboration) between defined user segments to maintain information silos, such as between competing business units or to ensure compliance with regulatory requirements.
Why the other options are wrong
- A. Information barriers do not address unauthenticated access; authentication is handled by separate identity and access management mechanisms.
- C. While information barriers can affect Exchange email, the primary and most common use case is Teams chat restrictions, making this less complete than option B.
- D. Information barriers do not restrict sharing to external recipients; they restrict internal communication between specific groups within the organization.
That was 54 of 252.
The full Microsoft SC-900 pack has all 252 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 126 free as one PDF by email. Get the Half Pack →