50 Free SC-900 Practice Questions and Answers

Play from 04:40 Question 4. Which statement represents a Microsoft privacy principle? Here are the options. Option A. Microsoft manages privacy settings for its customers. Option B. Microsoft respects the local privacy laws that are applicable to its customers. Option C. Microsoft uses hosted customer email and chat data for targeted advertising. Option D. Microsoft does not collect any customer data. Pause the video now if you want time to think about the answer.

The correct answer is B. Microsoft respects the local privacy laws that are applicable to its customers. A core Microsoft privacy principle is respect for local privacy laws applicable to customers. Microsoft commits to complying with all relevant privacy regulations in the jurisdictions where it operates and serves customers. Now, why are the other options incorrect? Option A is incorrect. Microsoft empowers customers to manage their own privacy settings rather than managing them for customers. Option C is incorrect. Microsoft does not use customer email and chat data for targeted advertising; this would violate its privacy commitments. Option D is incorrect. Microsoft does collect customer data as necessary for service delivery, but does so transparently and with appropriate safeguards. Therefore, B, Microsoft respects the local privacy laws that are applicable to its customers, is the correct answer.

Play from 06:28 Question 5. You need to connect to an Azure virtual machine by using Azure Bastion. What should you use? Here are the options. Option A. PowerShell remoting. Option B. the Azure portal. Option C. the Remote Desktop Connection client. Option D. an SSH client. Pause the video now if you want time to think about the answer.

The correct answer is B. the Azure portal. Azure Bastion provides secure remote access to Azure virtual machines through the Azure portal interface directly, eliminating the need for RDP/SSH clients or exposed public IP addresses. Users simply navigate to the VM in the portal and select Connect via Bastion. Now, why are the other options incorrect? Option A is incorrect. PowerShell remoting requires direct network connectivity and is not the Azure Bastion connection method. Option C is incorrect. While Remote Desktop Connection could technically work, Azure Bastion's primary interface is through the Azure portal without needing the RDP client. Option D is incorrect. SSH clients may be used with Bastion for Linux VMs but the connection originates through the Azure portal, not directly via SSH. Therefore, B, the Azure portal, is the correct answer.

Play from 08:04 Question 6. What is Azure Key Vault used for? Here are the options. Option A. to deploy a cloud-based network security service that protects Azure virtual network resources. Option B. to protect cloud-based applications from cyber threats and vulnerabilities. Option C. to safeguard cryptographic keys and other secrets used by cloud apps and services. Option D. to provide secure and seamless RDP/SSH connectivity to Azure virtual machines via TLS from the Azure portal. Pause the video now if you want time to think about the answer.

The correct answer is C. to safeguard cryptographic keys and other secrets used by cloud apps and services. Azure Key Vault is a cloud service designed to securely store and manage cryptographic keys, certificates, and secrets used by applications and services, protecting sensitive information from unauthorized access. Now, why are the other options incorrect? Option A is incorrect. Describing network security services and virtual network protection is the role of Azure Firewall and Network Security Groups, not Key Vault. Option B is incorrect. Protecting cloud applications from cyber threats is handled by services like Microsoft Defender for Cloud and Web Application Firewall. Option D is incorrect. Providing RDP/SSH connectivity is the function of Azure Bastion, not Key Vault. Therefore, C, to safeguard cryptographic keys and other secrets used by cloud apps and services, is the correct answer.

Play from 09:57 Question 7. What is a function of Conditional Access session controls? Here are the options. Option A. enforcing device compliance. Option B. enforcing client app compliance. Option C. enable limited experiences, such as blocking download of sensitive information. Option D. prompting multi-factor authentication (MFA). Pause the video now if you want time to think about the answer.

The correct answer is C. enable limited experiences, such as blocking download of sensitive information. Session controls in Conditional Access are specifically designed to enable limited experiences by restricting what users can do with their sessions. This includes blocking downloads of sensitive information, disabling copy/paste functionality, and other granular restrictions on user actions during a session. Options A and B describe assignment conditions rather than session controls, and option D describes a grant control rather than a session control. Now, why are the other options incorrect? Option A is incorrect. Device compliance enforcement is an assignment condition, not a session control. Option B is incorrect. Client app compliance is an assignment condition, not a session control. Option D is incorrect. Prompting MFA is a grant control (requiring authentication), not a session control. Therefore, C, enable limited experiences, such as blocking download of sensitive information, is the correct answer.

Play from 11:41 Question 8. Which Microsoft 365 feature can you use to restrict users from sending email messages that contain lists of customers and their associated credit card numbers? Here are the options. Option A. retention policies. Option B. data loss prevention (DLP) policies. Option C. conditional access policies. Option D. information barriers. Pause the video now if you want time to think about the answer.

The correct answer is B. data loss prevention (DLP) policies. Data loss prevention (DLP) policies are designed to identify and protect sensitive information such as credit card numbers and customer lists from being transmitted insecurely or shared inappropriately. DLP can scan email content and block messages containing specific sensitive data patterns before they are sent. Now, why are the other options incorrect? Option A is incorrect. Retention policies manage how long content is kept and when it is deleted, not how sensitive data is protected during transmission. Option C is incorrect. Conditional access policies control user access to resources based on conditions but do not scan message content for sensitive data. Option D is incorrect. Information barriers restrict communication between user groups, not sensitive data patterns within messages. Therefore, B, data loss prevention (DLP) policies, is the correct answer.

Play from 13:21 Question 9. What should you create to search and export content preserved in an eDiscovery hold? Here are the options. Option A. a Microsoft SharePoint Online site. Option B. a case. Option C. a Microsoft Exchange Online public folder. Option D. Azure Files. Pause the video now if you want time to think about the answer.

The correct answer is B. a case. To search and export content that is preserved in an eDiscovery hold, you must create a case within the Microsoft Purview eDiscovery (Premium) or eDiscovery (Standard) solution. The case serves as the container for all eDiscovery activities including holds, searches, and content export. Now, why are the other options incorrect? Option A is incorrect. SharePoint Online sites are used for collaboration but not for eDiscovery hold management. Option C is incorrect. Exchange Online public folders are mailbox containers but not the proper eDiscovery mechanism. Option D is incorrect. Azure Files is a storage service unrelated to eDiscovery functionality. Therefore, B, a case, is the correct answer.

Play from 14:46 Question 10. In the shared responsibility model for an Azure deployment, what is Microsoft solely responsible for managing? Here are the options. Option A. the management of mobile devices. Option B. the permissions for the user data stored in Azure. Option C. the creation and management of user accounts. Option D. the management of the physical hardware. Pause the video now if you want time to think about the answer.

The correct answer is D. the management of the physical hardware. In the Azure shared responsibility model, Microsoft is solely responsible for managing the physical hardware, data centers, network infrastructure, and physical security. Customers are responsible for managing their own data, applications, user accounts, identities, and access permissions. Mobile device management, user permissions, and user account creation are customer responsibilities. Now, why are the other options incorrect? Option A is incorrect. Mobile device management is a customer responsibility within the shared responsibility model. Option B is incorrect. Permissions for user data stored in Azure are managed by the customer, not Microsoft. Option C is incorrect. Creation and management of user accounts is the customer's responsibility in Azure deployments. Therefore, D, the management of the physical hardware, is the correct answer.

Play from 16:28 Question 11. When a user authenticates by using passwordless sign-in, what should the user select in the Microsoft Authenticator app? Here are the options. Option A. an answer to a security question. Option B. a number. Option C. an alphanumeric key. Option D. a passphrase. Pause the video now if you want time to think about the answer.

The correct answer is B. a number. When using Microsoft Authenticator app for passwordless phone sign-in, users must select a matching number displayed on the sign-in screen to complete the authentication process without entering a password. Now, why are the other options incorrect? Option A is incorrect. Security question answers are part of traditional multi-factor authentication, not passwordless sign-in. Option C is incorrect. Alphanumeric keys are not used in the Microsoft Authenticator passwordless sign-in method. Option D is incorrect. Passphrases are not part of the Microsoft Authenticator passwordless sign-in workflow. Therefore, B, a number, is the correct answer.

Play from 17:50 Question 12. What are two reasons to deploy multiple virtual networks instead of using just one virtual network? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. to meet governance policies. Option B. to connect multiple types of resources. Option C. to separate the resources for budgeting. Option D. to isolate the resources. Pause the video now if you want time to think about the answer.

The correct answers are A. to meet governance policies, and D. to isolate the resources. Multiple virtual networks are deployed to meet governance policies (different compliance requirements, security policies, or organizational boundaries) and to isolate resources (network segmentation for security, performance, and management). Connecting multiple types of resources and budgeting separation can be accomplished within a single virtual network using subnets and resource organization, making these less compelling reasons for multiple virtual networks. Now, why are the other options incorrect? Option B is incorrect. Multiple resource types can be connected and managed within a single virtual network using subnets. Option C is incorrect. Resource budgeting separation can be accomplished within a single virtual network through tagging and cost allocation without requiring separate networks. Therefore, A and D are the correct answers.

Play from 19:39 Question 13. In a Core eDiscovery workflow, what should you do before you can search for content? Here are the options. Option A. Create an eDiscovery hold. Option B. Run Express Analysis. Option C. Configure attorney-client privilege detection. Option D. Export and download results. Pause the video now if you want time to think about the answer.

The correct answer is A. Create an eDiscovery hold. Before searching for content in Core eDiscovery, you must first create an eDiscovery hold. The hold preserves content in the relevant locations (mailboxes, sites, etc.) so that data cannot be deleted during the investigation. This is a prerequisite step to ensure content preservation before conducting searches. Now, why are the other options incorrect? Option B is incorrect. Express Analysis is run after you have collected and exported content, not before searching for it. Option C is incorrect. Attorney-client privilege detection is a post-search analysis feature used when reviewing results, not a prerequisite for searching. Option D is incorrect. Exporting and downloading results occurs at the end of the eDiscovery workflow after searches have been conducted and results reviewed. Therefore, A, Create an eDiscovery hold, is the correct answer.

Play from 21:17 Question 14. What is a use case for implementing information barrier policies in Microsoft 365? Here are the options. Option A. to restrict unauthenticated access to Microsoft 365. Option B. to restrict Microsoft Teams chats between certain groups within an organization. Option C. to restrict Microsoft Exchange Online email between certain groups within an organization. Option D. to restrict data sharing to external email recipients. Pause the video now if you want time to think about the answer.

The correct answer is B. to restrict Microsoft Teams chats between certain groups within an organization. Information barrier policies are designed to restrict communication and collaboration between specific groups within an organization. The primary use case is preventing Microsoft Teams chats (and other collaboration) between defined user segments to maintain information silos, such as between competing business units or to ensure compliance with regulatory requirements. Now, why are the other options incorrect? Option A is incorrect. Information barriers do not address unauthenticated access; authentication is handled by separate identity and access management mechanisms. Option C is incorrect. While information barriers can affect Exchange email, the primary and most common use case is Teams chat restrictions, making this less complete than option B. Option D is incorrect. Information barriers do not restrict sharing to external recipients; they restrict internal communication between specific groups within the organization. Therefore, B, to restrict Microsoft Teams chats between certain groups within an organization, is the correct answer.

Play from 23:27 Question 15. Which solution performs security assessments and automatically generates alerts when a vulnerability is found? Here are the options. Option A. cloud security posture management (CSPM). Option B. DevSecOps. Option C. cloud workload protection platform (CWPP). Option D. security information and event management (SIEM). Pause the video now if you want time to think about the answer.

The correct answer is A. cloud security posture management (CSPM). Cloud Security Posture Management (CSPM) performs security assessments of cloud environments and automatically generates alerts when vulnerabilities or misconfigurations are discovered. It continuously monitors cloud resources against security benchmarks and compliance standards. Now, why are the other options incorrect? Option B is incorrect. DevSecOps integrates security into development and operations processes but does not automatically generate alerts for vulnerabilities in running environments. Option C is incorrect. Cloud Workload Protection Platform (CWPP) protects running workloads from threats but focuses on runtime protection rather than vulnerability assessments. Option D is incorrect. Security Information and Event Management (SIEM) collects and analyzes security events and logs but is not primarily designed for automated vulnerability assessments. Therefore, A, cloud security posture management (CSPM), is the correct answer.

Play from 25:23 Question 16. What Microsoft Purview feature can use machine learning algorithms to detect and automatically protect sensitive items? Here are the options. Option A. eDiscovery. Option B. Data loss prevention. Option C. Information risks. Option D. Communication compliance. Pause the video now if you want time to think about the answer.

The correct answer is B. Data loss prevention. Data loss prevention (DLP) in Microsoft Purview uses machine learning algorithms and sensitive information type detectors to automatically identify and protect sensitive data like credit card numbers, social security numbers, and personal information. Now, why are the other options incorrect? Option A is incorrect. eDiscovery is used for searching and retrieving data during legal investigations, not for automatic sensitive data detection. Option C is incorrect. Information risks is not a specific Microsoft Purview feature for automatic sensitive data detection and protection. Option D is incorrect. Communication compliance monitors communications for policy violations but does not primarily use machine learning to automatically detect and protect sensitive items. Therefore, B, Data loss prevention, is the correct answer.

Play from 27:01 Question 17. Which Microsoft Defender for Cloud metric displays the overall security health of an Azure subscription? Here are the options. Option A. secure score. Option B. resource health. Option C. completed controls. Option D. the status of recommendations. Pause the video now if you want time to think about the answer.

The correct answer is A. secure score. Secure Score is the key metric in Microsoft Defender for Cloud that provides an overall numerical representation of the security health of an Azure subscription. It reflects your security posture across all assessed controls and recommendations. Resource health shows individual resource status, completed controls shows progress on specific controls, and recommendation status shows individual findings, but none provide the overall health metric like Secure Score does. Now, why are the other options incorrect? Option B is incorrect. Resource health shows the status of individual resources, not the overall subscription security health. Option C is incorrect. Completed controls shows progress on specific security controls, not the overall health metric. Option D is incorrect. The status of recommendations shows individual findings, not a comprehensive overall security health measure. Therefore, A, secure score, is the correct answer.

Play from 28:41 Question 18. What can you use to protect against malicious links sent in email messages, chat messages, and channels? Here are the options. Option A. Microsoft Defender for Cloud Apps. Option B. Microsoft Defender for Office 365. Option C. Microsoft Defender for Endpoint. Option D. Microsoft Defender for Identity. Pause the video now if you want time to think about the answer.

The correct answer is B. Microsoft Defender for Office 365. Microsoft Defender for Office 365 specifically protects against malicious links in email messages, chat messages, and Teams channels through Safe Links technology, which scans URLs in real-time and provides warnings for suspicious content. Now, why are the other options incorrect? Option A is incorrect. Microsoft Defender for Cloud Apps focuses on cloud application security and data protection, not email link protection. Option C is incorrect. Microsoft Defender for Endpoint protects devices and endpoints, not email message content. Option D is incorrect. Microsoft Defender for Identity protects against identity-based threats in on-premises Active Directory environments. Therefore, B, Microsoft Defender for Office 365, is the correct answer.

Play from 30:16 Question 19. Which three statements accurately describe the guiding principles of Zero Trust? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Define the perimeter by physical locations. Option B. Use identity as the primary security boundary. Option C. Always verify the permissions of a user explicitly. Option D. Always assume that the user system can be breached. Option E. Use the network as the primary security boundary. Pause the video now if you want time to think about the answer.

The correct answers are B. Use identity as the primary security boundary, and C. Always verify the permissions of a user explicitly, and D. Always assume that the user system can be breached. Zero Trust security principles include using identity as the primary security boundary (replacing network perimeter), always explicitly verifying user permissions rather than assuming trust, and assuming that breaches can occur so continuous verification is necessary. These principles shift security from network-centric to identity-centric models. Defining perimeters by physical location and using the network as the primary boundary are traditional security approaches that Zero Trust specifically rejects. Now, why are the other options incorrect? Option A is incorrect. Defining the perimeter by physical locations is a traditional approach that Zero Trust explicitly rejects in favor of identity-based boundaries. Option E is incorrect. Using the network as the primary security boundary is the legacy approach that Zero Trust replaces with identity as the primary boundary. Therefore, B and C and D are the correct answers.

Play from 32:27 Question 20. Which two actions can you perform by using Azure Key Vault? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Store secrets. Option B. Store Azure Resource Manager (ARM) templates. Option C. Implement network security groups (NSGs). Option D. Implement Azure DDoS Protection. Option E. Store keys. Pause the video now if you want time to think about the answer.

The correct answers are A. Store secrets, and E. Store keys. Azure Key Vault is a service designed to securely store and manage cryptographic keys and secrets. Option A is correct because Key Vault stores secrets such as connection strings, API keys, and passwords. Option E is correct because Key Vault's primary function includes storing and managing encryption keys. Both are core features of the service. Now, why are the other options incorrect? Option B is incorrect. ARM templates are stored in repositories or storage accounts, not in Key Vault. Option C is incorrect. Network security groups are configured in Azure networking, not managed through Key Vault. Option D is incorrect. DDoS Protection is a separate Azure security service unrelated to Key Vault's key and secret management. Therefore, A and E are the correct answers.

Play from 34:09 Question 21. You are comparing features between Microsoft Defender for Office 365 Plan 1 and Plan 2. Which feature is only available in Defender for Office 365 Plan 2? Here are the options. Option A. Attack simulation training. Option B. zero-day malware detection. Option C. anti-phishing protection. Option D. volume-based attack protection. Pause the video now if you want time to think about the answer.

The correct answer is A. Attack simulation training. Attack simulation training is a Plan 2-exclusive feature that allows organizations to run simulated phishing and attack campaigns to train users. Zero-day malware detection, anti-phishing protection, and volume-based attack protection are all available in both Plan 1 and Plan 2. Now, why are the other options incorrect? Option B is incorrect. Zero-day malware detection is available in both Plan 1 and Plan 2. Option C is incorrect. Anti-phishing protection is available in both Plan 1 and Plan 2. Option D is incorrect. Volume-based attack protection is available in both Plan 1 and Plan 2. Therefore, A, Attack simulation training, is the correct answer.

Play from 35:41 Question 22. You need to create a workflow that runs automatically when a user account is provisioned or its properties are updated. Which Microsoft Entra feature should you use? Here are the options. Option A. entitlement management. Option B. Conditional Access policies. Option C. lifecycle workflows. Option D. access reviews. Pause the video now if you want time to think about the answer.

The correct answer is C. lifecycle workflows. Lifecycle workflows in Microsoft Entra ID automatically execute predefined actions when user accounts are provisioned, updated, or deprovisioned. This feature is specifically designed to trigger workflows based on user lifecycle events, enabling automated responses without manual intervention. Now, why are the other options incorrect? Option A is incorrect. Entitlement management handles access to groups and applications but does not automatically trigger workflows based on account provisioning or property changes. Option B is incorrect. Conditional Access policies enforce authentication and access controls based on risk conditions, not user provisioning events. Option D is incorrect. Access reviews are compliance tools for periodically auditing access assignments, not automation mechanisms for user provisioning events. Therefore, C, lifecycle workflows, is the correct answer.

Play from 37:28 Question 23. In the shared responsibility model, for what is Microsoft responsible when managing Azure virtual machines? Here are the options. Option A. Updating the firmware of the disk controller. Option B. Updating installed applications. Option C. Configuring the permissions for shared folders. Option D. Updating the operating system. Pause the video now if you want time to think about the answer.

The correct answer is A. Updating the firmware of the disk controller. In the shared responsibility model for Azure virtual machines, Microsoft is responsible for updating the firmware of the disk controller. This is infrastructure-level management that occurs below the hypervisor layer and is entirely Microsoft's responsibility. The customer is responsible for the OS, applications, and configurations. Now, why are the other options incorrect? Option B is incorrect. Updating installed applications is the customer's responsibility. Option C is incorrect. Configuring permissions for shared folders is the customer's responsibility. Option D is incorrect. Updating the operating system is the customer's responsibility. Therefore, A, Updating the firmware of the disk controller, is the correct answer.

Play from 39:03 Question 24. What is the role of Microsoft Purview insider risk management in maintaining the compliance status of a company? Here are the options. Option A. to detect and prevent communication policy breaches. Option B. to audit and assess the company's resources to ensure ongoing compliance with data regulations and standards. Option C. to detect potentially harmful user activities and assign risk scores to the activities. Option D. to find, preserve, and export content from various locations in response to legal, regulatory, and corporate requests for data. Pause the video now if you want time to think about the answer.

The correct answer is C. to detect potentially harmful user activities and assign risk scores to the activities. Microsoft Purview insider risk management detects potentially harmful user activities and assigns risk scores to those activities to help organizations identify insider threats. While it supports compliance efforts, its primary function is activity detection and risk scoring rather than auditing regulatory compliance, detecting communication policy breaches, or managing legal holds and data export. Now, why are the other options incorrect? Option A is incorrect. Detecting communication policy breaches is not the primary role of insider risk management. Option B is incorrect. Auditing resources for regulatory compliance is handled by compliance management tools, not insider risk management. Option D is incorrect. Finding, preserving, and exporting content for legal requests is the function of eDiscovery, not insider risk management. Therefore, C, to detect potentially harmful user activities and assign risk scores to the activities, is the correct answer.

Play from 41:17 Question 25. You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains multiple subnets and virtual machines. You deploy an Azure Firewall named FW1 to VNet1. You need to ensure that FW1 can analyze and filter all the internet traffic to and from VNet1. The solution must minimize costs. What should you do? Here are the options. Option A. Create and associate route tables. Option B. Configure network peerings. Option C. Create service endpoints. Option D. Implement Azure Route Server. Pause the video now if you want time to think about the answer.

The correct answer is A. Create and associate route tables. To ensure Azure Firewall FW1 analyzes all internet traffic to and from VNet1, you must create and associate user-defined route tables (UDRs) that direct traffic through the firewall's internal IP. This forces all outbound internet traffic to pass through FW1 for inspection and filtering. Route tables are the standard, cost-effective mechanism for routing traffic through a firewall in Azure without requiring additional services. Now, why are the other options incorrect? Option B is incorrect. Network peering connects separate VNets but does not enable traffic filtering through a firewall within a single VNet. Option C is incorrect. Service endpoints allow direct connectivity to Azure services and do not route traffic through a firewall. Option D is incorrect. Azure Route Server is designed for dynamic routing in hybrid scenarios with network appliances, not the primary method for firewall traffic direction and adds unnecessary cost. Therefore, A, Create and associate route tables, is the correct answer.

Play from 43:29 Question 26. You have a Microsoft 365 E3 subscription. You plan to audit user activity by using the unified audit log and Basic Audit. For how long will the audit records be retained? Here are the options. Option A. 15 days. Option B. 30 days. Option C. 90 days. Option D. 180 days. Pause the video now if you want time to think about the answer.

The correct answer is D. 180 days. Audit (Standard), formerly Basic Audit, retains audit records in the unified audit log for 180 days. Microsoft raised the default from 90 to 180 days in October 2023 for all subscriptions with Audit (Standard), including Microsoft 365 E3. Longer retention, such as one year, requires Audit (Premium). Now, why are the other options incorrect? Option A is incorrect. 15 days is not a retention period used by Microsoft Purview Audit. Option B is incorrect. 30 days is not the retention period for Audit (Standard) records. Option C is incorrect. 90 days was the old default and was increased to 180 days for Audit (Standard). Therefore, D, 180 days, is the correct answer.

Play from 45:07 Question 27. You plan to implement a security strategy and place multiple layers of defense throughout a network infrastructure. Which security methodology does this represent? Here are the options. Option A. threat modeling. Option B. identity as the security perimeter. Option C. defense in depth. Option D. the shared responsibility model. Pause the video now if you want time to think about the answer.

The correct answer is C. defense in depth. Defense in depth is the security methodology that implements multiple layers of defense throughout a network infrastructure. This approach ensures that if one security layer is compromised, additional layers remain in place to protect assets, reducing overall risk through redundancy and diversity of controls. Now, why are the other options incorrect? Option A is incorrect. Threat modeling is a process for identifying and analyzing potential security threats, not a layered defense strategy. Option B is incorrect. Identity as the security perimeter is a modern security approach focusing on user and device verification rather than network perimeter defense. Option D is incorrect. The shared responsibility model describes how cloud providers and customers divide security responsibilities, not a defense layering strategy. Therefore, C, defense in depth, is the correct answer.

Play from 46:48 Question 28. Which type of identity can be used with an Azure service and will be deleted automatically when the service is deleted? Here are the options. Option A. user-assigned managed identity. Option B. service principal. Option C. user. Option D. system-assigned managed identity. Pause the video now if you want time to think about the answer.

The correct answer is D. system-assigned managed identity. A system-assigned managed identity is automatically created when an Azure service is provisioned and is automatically deleted when that service is deleted. The identity lifecycle is entirely bound to the service's lifecycle, requiring no separate management. Now, why are the other options incorrect? Option A is incorrect. User-assigned managed identities persist independently and are not deleted when a service is deleted. Option B is incorrect. Service principals are not automatically deleted and require explicit deletion. Option C is incorrect. User identities are not automatically deleted with service deletion. Therefore, D, system-assigned managed identity, is the correct answer.

Play from 48:18 Question 29. Which three authentication methods does Windows Hello for Business support? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. fingerprint. Option B. facial recognition. Option C. PIN. Option D. email verification. Option E. security question. Pause the video now if you want time to think about the answer.

The correct answers are A. fingerprint, and B. facial recognition, and C. PIN. Windows Hello for Business supports three biometric and PIN-based authentication methods: fingerprint recognition, facial recognition using infrared cameras, and PIN. These passwordless methods provide secure and convenient authentication on Windows devices. Now, why are the other options incorrect? Option D is incorrect. Email verification is not a Windows Hello for Business authentication method. Option E is incorrect. Security questions are not supported by Windows Hello for Business authentication. Therefore, A and B and C are the correct answers.

Play from 49:44 Question 30. What can you use to scan email attachments and forward the attachments to recipients only if the attachments are free from malware? Here are the options. Option A. Microsoft Defender for Office 365. Option B. Microsoft Defender Antivirus. Option C. Microsoft Defender for Identity. Option D. Microsoft Defender for Endpoint. Pause the video now if you want time to think about the answer.

The correct answer is A. Microsoft Defender for Office 365. Microsoft Defender for Office 365 provides the capability to scan email attachments for malware and forward them to recipients only if they are clean. This protects users from malware delivered via email and includes features like safe attachments that detonate files in a sandbox environment before delivery. Now, why are the other options incorrect? Option B is incorrect. Microsoft Defender Antivirus protects endpoints but is not specifically designed for scanning email attachments in transit. Option C is incorrect. Microsoft Defender for Identity focuses on detecting identity-based attacks and compromised credentials, not email attachment scanning. Option D is incorrect. Microsoft Defender for Endpoint protects individual devices but is not the service used to scan email attachments at the email gateway level. Therefore, A, Microsoft Defender for Office 365, is the correct answer.

Play from 51:33 Question 31. Which Microsoft Purview data classification type supports the use of regular expressions? Here are the options. Option A. exact data match (EDM). Option B. fingerprint classifier. Option C. sensitive information types (SITs). Option D. trainable classifier. Pause the video now if you want time to think about the answer.

The correct answer is C. sensitive information types (SITs). Sensitive Information Types (SITs) support the use of regular expressions (regex) to define pattern-based detection rules for sensitive data. This allows for flexible and powerful matching of complex data patterns like custom ID formats, email patterns, or organizational identifiers. Now, why are the other options incorrect? Option A is incorrect. Exact Data Match (EDM) uses exact value comparison, not regular expressions. Option B is incorrect. Fingerprint classifier works on document structure similarity, not regex patterns. Option D is incorrect. Trainable classifiers use machine learning models, not regular expression syntax. Therefore, C, sensitive information types (SITs), is the correct answer.

Play from 53:05 Question 32. Which Microsoft Purview feature allows users to identify content that should be protected? Here are the options. Option A. Sensitivity Labels. Option B. Data loss prevention. Option C. eDiscovery. Option D. Insider Risks. Pause the video now if you want time to think about the answer.

The correct answer is A. Sensitivity Labels. Sensitivity Labels are the Microsoft Purview feature that allows users to identify, classify, and protect content that should be protected. Users and administrators apply sensitivity labels to mark content with appropriate protection levels, enabling consistent data protection across the organization. Now, why are the other options incorrect? Option B is incorrect. Data Loss Prevention enforces policy rules but does not primarily identify what should be protected. Option C is incorrect. eDiscovery is used for legal holds and investigation, not for identifying content for protection. Option D is incorrect. Insider Risks focuses on risky user behavior, not on content identification for protection. Therefore, A, Sensitivity Labels, is the correct answer.

Play from 54:37 Question 33. What is a feature of Microsoft Defender for Cloud Apps? Here are the options. Option A. cloud workload protection platform (CWPP). Option B. automated investigation and response (AIR). Option C. SaaS security posture management (SSPM). Option D. cloud security posture management (CSPM). Pause the video now if you want time to think about the answer.

The correct answer is C. SaaS security posture management (SSPM). SaaS security posture management (SSPM) is a feature of Microsoft Defender for Cloud Apps that assesses the security configuration and compliance posture of SaaS applications. CWPP is a feature of Defender for Containers, AIR is associated with Defender for Endpoint and Office 365, and CSPM is primarily associated with Defender for Cloud for Azure resources. Now, why are the other options incorrect? Option A is incorrect. Cloud workload protection platform is a feature of Defender for Containers, not Cloud Apps. Option B is incorrect. Automated investigation and response is primarily a feature of Defender for Endpoint, not Cloud Apps. Option D is incorrect. Cloud security posture management is primarily associated with Defender for Cloud, not Cloud Apps. Therefore, C, SaaS security posture management (SSPM), is the correct answer.

Play from 56:25 Question 34. Which three authentication methods can Microsoft Entra users use to reset their password? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. fingerprint. Option B. security questions. Option C. picture password. Option D. mobile app notification. Option E. text message to a phone. Pause the video now if you want time to think about the answer.

The correct answers are B. security questions, and D. mobile app notification, and E. text message to a phone. Microsoft Entra users can reset their passwords using security questions, mobile app notifications, and text messages to a phone. Fingerprint and picture password are biometric and visual authentication methods respectively, but they are not supported password reset methods in Entra self-service password reset. Now, why are the other options incorrect? Option A is incorrect. Fingerprint authentication is a biometric method not supported for Entra password reset. Option C is incorrect. Picture password is a visual authentication method not supported for Entra password reset. Therefore, B and D and E are the correct answers.

Play from 57:59 Question 35. Your company is evaluating various security products, including a security information and event management (SIEM) solution. You need to provide information about the functionality of SIEM solutions. What is a function of a SIEM solution? Here are the options. Option A. the ability to review network activity and provide reports about which applications and services can communicate. Option B. an alerting system that triggers an alert when users reach their Azure spending limit. Option C. the ability to review logs and provide reports about malicious activity. Option D. automated incident remediation. Pause the video now if you want time to think about the answer.

The correct answer is C. the ability to review logs and provide reports about malicious activity. A core function of SIEM solutions is the ability to aggregate, analyze, and report on logs from various sources to identify malicious activity and security threats. The other options describe different security tools: option A describes network monitoring and application discovery tools, option B describes Azure cost management, and option D describes Security Orchestration, Automation and Response (SOAR) capabilities rather than core SIEM functions. Now, why are the other options incorrect? Option A is incorrect. Reviewing network application communication is a network analysis tool function, not a primary SIEM function. Option B is incorrect. Azure spending limit alerts are a cost management feature, not a SIEM function. Option D is incorrect. Automated incident remediation is primarily a SOAR capability, not a core SIEM function. Therefore, C, the ability to review logs and provide reports about malicious activity, is the correct answer.

Play from 1:00:08 Question 36. What is an assessment in Compliance Manager? Here are the options. Option A. A policy initiative that includes multiple policies. Option B. A dictionary of words that are not allowed in company documents. Option C. A grouping of controls from a specific regulation, standard or policy. Option D. Recommended guidance to help organizations align with their corporate standards. Pause the video now if you want time to think about the answer.

The correct answer is C. A grouping of controls from a specific regulation, standard or policy. In Compliance Manager, an assessment is a grouping of controls organized around a specific regulation, standard, or policy. Assessments help organizations map their compliance controls to regulatory frameworks and track their compliance progress. Now, why are the other options incorrect? Option A is incorrect. A policy initiative is an Azure Policy concept, not a Compliance Manager assessment. Option B is incorrect. A dictionary of prohibited words relates to DLP or content filtering, not Compliance Manager assessments. Option D is incorrect. Recommended guidance is provided through improvement actions or recommendations, not through assessments themselves. Therefore, C, A grouping of controls from a specific regulation, standard or policy, is the correct answer.

Play from 1:01:49 Question 37. What are two capabilities of Microsoft Defender for Endpoint? Each correct selection presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. automated investigation and remediation. Option B. transport encryption. Option C. shadow IT detection. Option D. attack surface reduction. Pause the video now if you want time to think about the answer.

The correct answers are A. automated investigation and remediation, and D. attack surface reduction. Microsoft Defender for Endpoint provides two key capabilities: (A) automated investigation and remediation that reduces response time by automatically analyzing alerts and taking corrective actions, and (D) attack surface reduction through policies and rules that block or prevent exploitation of common attack vectors and vulnerabilities. Now, why are the other options incorrect? Option B is incorrect. Transport encryption is a network security feature, not a primary Defender for Endpoint capability. Option C is incorrect. Shadow IT detection is primarily a Microsoft Defender for Cloud Apps capability, not a core Defender for Endpoint function. Therefore, A and D are the correct answers.

Play from 1:03:24 Question 38. What types of files can Microsoft Purview sensitive information type classifiers be used to classify? Here are the options. Option A. Documents. Option B. Video files. Option C. Audio files. Option D. Images. Pause the video now if you want time to think about the answer.

The correct answer is A. Documents. Microsoft Purview sensitive information type classifiers are designed to classify text-based content within documents such as emails and files. They do not support video files, audio files, or images as these are non-text media types that cannot be analyzed for sensitive information patterns using text-based classification methods. Now, why are the other options incorrect? Option B is incorrect. Video files cannot be classified using text-based sensitive information type classifiers. Option C is incorrect. Audio files cannot be classified using text-based sensitive information type classifiers. Option D is incorrect. Images cannot be classified using text-based sensitive information type classifiers. Therefore, A, Documents, is the correct answer.

Play from 1:04:52 Question 39. To which type of resource can Azure Bastion provide secure access? Here are the options. Option A. Azure Files. Option B. Azure SQL Managed Instances. Option C. Azure virtual machines. Option D. Azure App Service. Pause the video now if you want time to think about the answer.

The correct answer is C. Azure virtual machines. Azure Bastion provides secure remote access to Azure virtual machines through the Azure portal using RDP or SSH protocols without requiring public IP addresses or VPN connections. Now, why are the other options incorrect? Option A is incorrect. Azure Files is a cloud storage service that does not require Azure Bastion for secure access. Option B is incorrect. Azure SQL Managed Instances are databases that use other security mechanisms and connection methods. Option D is incorrect. Azure App Service is a web hosting service that uses different access mechanisms than Azure Bastion. Therefore, C, Azure virtual machines, is the correct answer.

Play from 1:06:16 Question 40. Which two Azure resources can a network security group (NSG) be associated with? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. a virtual network subnet. Option B. a network interface. Option C. a resource group. Option D. a virtual network. Option E. an Azure App Service web app. Pause the video now if you want time to think about the answer.

The correct answers are A. a virtual network subnet, and B. a network interface. Network security groups (NSGs) can be associated with both virtual network subnets and network interfaces. These are the two primary attachment points for NSGs in Azure, allowing granular control of network traffic at either the subnet level or the individual network interface card level. Now, why are the other options incorrect? Option C is incorrect. Resource groups are logical containers for resources but are not network entities and cannot be directly associated with NSGs. Option D is incorrect. Virtual networks cannot directly have NSGs associated with them; NSGs must be associated with subnets within a virtual network. Option E is incorrect. Azure App Service web apps do not have NSGs associated with them directly; network traffic is controlled through other mechanisms like service endpoints and access restrictions. Therefore, A and B are the correct answers.

Play from 1:08:03 Question 41. Which two tasks can you implement by using data loss prevention (DLP) policies in Microsoft 365? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Here are the options. Option A. Display policy tips to users who are about to violate your organization's policies. Option B. Enable disk encryption on endpoints. Option C. Protect documents in Microsoft OneDrive that contain sensitive information. Option D. Apply security baselines to devices. Pause the video now if you want time to think about the answer.

The correct answers are A. Display policy tips to users who are about to violate your organization's policies, and C. Protect documents in Microsoft OneDrive that contain sensitive information. DLP policies can display policy tips to warn users before they violate policies, and they can protect sensitive documents in OneDrive and other locations by preventing unauthorized sharing or access. Both are core DLP functions. Now, why are the other options incorrect? Option B is incorrect. Disk encryption is managed through device management and BitLocker settings, not DLP policies. Option D is incorrect. Security baselines are applied through device management and compliance settings, not DLP policies. Therefore, A and C are the correct answers.

Play from 1:09:46 Question 42. Which Microsoft 365 feature can you use to restrict communication and the sharing of information between members of two departments at your organization? Here are the options. Option A. sensitivity label policies. Option B. Customer Lockbox. Option C. information barriers. Option D. Privileged Access Management (PAM). Pause the video now if you want time to think about the answer.

The correct answer is C. information barriers. Information barriers in Microsoft 365 allow organizations to restrict communication and information sharing between specific groups or departments. This compliance feature prevents cross-department collaboration when regulatory or business policies require separation. Now, why are the other options incorrect? Option A is incorrect. Sensitivity label policies control how information is classified and protected, but do not restrict communication between departments. Option B is incorrect. Customer Lockbox provides audit capabilities and approval controls for Microsoft personnel access, not for internal department separation. Option D is incorrect. Privileged Access Management (PAM) controls elevated access to systems, not communication and information sharing between departments. Therefore, C, information barriers, is the correct answer.

Play from 1:11:25 Question 43. You are reviewing rules in an Azure network security group (NSG). You need to identify which NSG rules are default rules, and which are custom rules. Which property should you use? Here are the options. Option A. Source. Option B. Protocol. Option C. Priority. Option D. Port. Pause the video now if you want time to think about the answer.

The correct answer is C. Priority. The Priority property is used to distinguish between default NSG rules and custom rules. Default rules have priority values of 65000 and above, while custom rules have lower priority numbers (0-65000). Source, Protocol, and Port properties are used for filtering traffic rules but do not indicate whether a rule is default or custom. Now, why are the other options incorrect? Option A is incorrect. Source property defines traffic origin but does not distinguish default from custom rules. Option B is incorrect. Protocol property specifies the traffic protocol but does not indicate rule type. Option D is incorrect. Port property specifies the network port but does not distinguish default from custom rules. Therefore, C, Priority, is the correct answer.

Play from 1:13:00 Question 44. What can you use in Microsoft Purview Compliance Manager to simplify the process of creating assessments? Here are the options. Option A. Jupyter notebooks. Option B. workbooks. Option C. Bicep files. Option D. templates. Pause the video now if you want time to think about the answer.

The correct answer is D. templates. Templates in Microsoft Purview Compliance Manager provide pre-built assessment frameworks based on regulatory standards and industry benchmarks, enabling users to quickly create assessments without building them from scratch. This simplifies the assessment creation process by providing ready-made structures aligned with compliance requirements. Now, why are the other options incorrect? Option A is incorrect. Jupyter notebooks are data analysis tools not integrated into Compliance Manager for assessment creation. Option B is incorrect. Workbooks are visualization and reporting tools used for displaying compliance data, not for simplifying assessment creation. Option C is incorrect. Bicep files are infrastructure-as-code templates for Azure resource deployment and are not used in Compliance Manager assessment creation. Therefore, D, templates, is the correct answer.

Play from 1:14:37 Question 45. What are customers responsible for when evaluating security in a software as a service (SaaS) cloud services model? Here are the options. Option A. operating systems. Option B. network controls. Option C. applications. Option D. accounts and identities. Pause the video now if you want time to think about the answer.

The correct answer is D. accounts and identities. In a SaaS model, the cloud provider manages the application, operating system, and network controls. Customers are primarily responsible for managing accounts and identities-including user provisioning, authentication policies, access management, and identity governance. Now, why are the other options incorrect? Option A is incorrect. Operating systems are managed and maintained by the SaaS provider, not the customer. Option B is incorrect. Network controls are part of the cloud provider's infrastructure responsibility in SaaS. Option C is incorrect. The application itself is developed, maintained, and secured by the SaaS provider. Therefore, D, accounts and identities, is the correct answer.

Play from 1:16:03 Question 46. You need to keep a copy of all files in a Microsoft SharePoint site for one year, even if users delete the files from the site. What should you apply to the site? Here are the options. Option A. a retention policy. Option B. an insider risk policy. Option C. a data loss prevention (DLP) policy. Option D. a sensitivity label policy. Pause the video now if you want time to think about the answer.

The correct answer is A. a retention policy. A retention policy is the appropriate tool to preserve a copy of all files in a SharePoint site for a specified period (one year), even after users delete them. Retention policies hold data for compliance and legal purposes. Now, why are the other options incorrect? Option B is incorrect. Insider risk policies monitor user activities for policy violations, not for preserving deleted files. Option C is incorrect. DLP policies prevent unauthorized data sharing and loss, not file preservation and retention. Option D is incorrect. Sensitivity label policies control classification and protection of data, not retention periods. Therefore, A, a retention policy, is the correct answer.

Play from 1:17:30 Question 47. What feature in Microsoft Defender for Endpoint provides the first line of defense against cyberthreats by reducing the attack surface? Here are the options. Option A. automated remediation. Option B. automated investigation. Option C. advanced hunting. Option D. network protection. Pause the video now if you want time to think about the answer.

The correct answer is D. network protection. Network protection in Microsoft Defender for Endpoint provides the first line of defense by reducing the attack surface. It blocks malicious connections at the network level, preventing threats from reaching endpoints and protecting against network-based attacks before they can compromise systems. Now, why are the other options incorrect? Option A is incorrect. Automated remediation responds to threats after detection, not as a first line of defense. Option B is incorrect. Automated investigation analyzes and responds to detected threats, occurring after initial defense. Option C is incorrect. Advanced hunting is used to proactively search for threats, not to prevent them initially. Therefore, D, network protection, is the correct answer.

Play from 1:18:59 Question 48. Which Microsoft 365 compliance feature can you use to encrypt content automatically based on specific conditions? Here are the options. Option A. Content Search. Option B. sensitivity labels. Option C. retention policies. Option D. eDiscovery. Pause the video now if you want time to think about the answer.

The correct answer is B. sensitivity labels. Sensitivity labels can automatically apply encryption to content based on conditions specified by the administrator, such as file type, content patterns, or recipient. This is a core feature that protects sensitive data automatically. Now, why are the other options incorrect? Option A is incorrect. Content Search is used to find and retrieve data, not to encrypt content automatically. Option C is incorrect. Retention policies manage how long data is kept, not automatic encryption based on conditions. Option D is incorrect. eDiscovery is used for legal investigations and data discovery, not for automatic encryption. Therefore, B, sensitivity labels, is the correct answer.

Play from 1:20:22 Question 49. Which security feature is available in the free mode of Microsoft Defender for Cloud? Here are the options. Option A. threat protection alerts. Option B. just-in-time (JIT) VM access to Azure virtual machines. Option C. vulnerability scanning of virtual machines. Option D. secure score. Pause the video now if you want time to think about the answer.

The correct answer is D. secure score. Secure score is a security governance feature available in the free tier of Microsoft Defender for Cloud, allowing organizations to assess and track their security posture. Threat protection alerts, just-in-time VM access, and vulnerability scanning are premium features that require the standard/paid tier of Defender for Cloud. Now, why are the other options incorrect? Option A is incorrect. Threat protection alerts are part of the paid Standard tier of Defender for Cloud. Option B is incorrect. Just-in-time VM access is a premium feature available only in the Standard tier. Option C is incorrect. Vulnerability scanning of virtual machines requires the Standard tier of Defender for Cloud. Therefore, D, secure score, is the correct answer.

Play from 1:21:51 Question 50. What can you specify in Microsoft 365 sensitivity labels? Here are the options. Option A. how long files must be preserved. Option B. when to archive an email message. Option C. which watermark to add to files. Option D. where to store files. Pause the video now if you want time to think about the answer.

The correct answer is C. which watermark to add to files. Sensitivity labels in Microsoft 365 allow organizations to specify visual markings such as watermarks to be added to labeled files and emails, helping to identify and protect sensitive content. Now, why are the other options incorrect? Option A is incorrect. File retention duration is specified through retention policies, not sensitivity labels. Option B is incorrect. Email archiving schedules are managed through retention policies and mailbox settings, not sensitivity labels. Option D is incorrect. File storage location is determined by SharePoint and OneDrive settings, not sensitivity labels. Therefore, C, which watermark to add to files, is the correct answer.