Microsoft Security, Compliance, and Identity Fundamentals practice questions

1. Question 1 of 25

   What should you use to ensure that the members of an Azure Active Directory group use multi-factor authentication (MFA) when they sign in?

   • AAzure role-based access control (Azure RBAC)
   • BAzure Active Directory (Azure AD) Privileged Identity Management (PIM)
   • CAzure Active Directory (Azure AD) Identity Protection
   • Da conditional access policy

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   Conditional Access is a feature in Azure AD that allows you to create policies that are used to control access to Azure AD-connected resources. These policies can be based on a variety of factors, such as the user's location, device state, and sign-in risk.

   Adapted from community discussion by AAsif098 · 2023-01-22 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

   1. A

      AAsif098

      2023-01-22

      Selected D5 upvotes

      Conditional Access is a feature in Azure AD that allows you to create policies that are used to control access to Azure AD-connected resources. These policies can be based on a variety of factors, such as the user's location, device state, and sign-in risk.

   2. E

      ETU69

      2022-12-23

      Selected D4 upvotes

      For more granular controls, you can use Conditional Access policies to define events or applications that require MFA. https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks#how-to-enable-and-use-azure-ad-multi-factor-authentication

   3. Z

      zellck

      2023-04-24

      Selected D4 upvotes

      D is the answer. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa

   4. R

      RodrigoAB

      2022-09-28

      Selected D3 upvotes

      The recommended way to enable and use Azure AD Multi-Factor Authentication is with Conditional Access policies. Conditional Access lets you create and define policies that react to sign-in events and that request additional actions before a user is granted access to an application or service. Information: Microsoft Site!

2. Question 2 of 25

   You need to keep a copy of all files in a Microsoft SharePoint site for one year, even if users delete the files from the site. What should you apply to the site?

   • Aa retention policy
   • Ban insider risk policy
   • Ca data loss prevention (DLP) policy
   • Da sensitivity label policy

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   In order to keep a copy of all files in a Microsoft SharePoint site for one year, even if users delete the files from the site, you should enable the Recycle Bin feature in SharePoint and set the retention period to one year.

   Adapted from community discussion by AAsif098 · 2023-01-22 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

   1. J

      jellybiscuit

      2022-09-06

      Selected A6 upvotes

      https://docs.microsoft.com/en-us/microsoft-365/compliance/retention-policies-sharepoint?view=o365-worldwide#how-retention-works-for-sharepoint-and-onedrive

   2. A

      AAsif098

      2023-01-22

      Selected A3 upvotes

      In order to keep a copy of all files in a Microsoft SharePoint site for one year, even if users delete the files from the site, you should enable the Recycle Bin feature in SharePoint and set the retention period to one year.

   3. Z

      zellck

      2023-04-24

      Selected A1 upvote

      A is the answer. https://learn.microsoft.com/en-us/microsoft-365/compliance/create-retention-policies?view=o365-worldwide&tabs=teams-retention Use a retention policy to manage the data for your organization by deciding proactively whether to retain content, delete content, or retain and then delete the content.

   4. L

      LegendaryZA

      2024-10-08

      Selected A1 upvote

      The answer is: a retention policy https://learn.microsoft.com/en-us/purview/retention-policies-sharepoint

3. Question 3 of 25

   You need to create a data loss prevention (DLP) policy. What should you use?

   • Athe Microsoft 365 Compliance center
   • Bthe Microsoft Endpoint Manager admin center
   • Cthe Microsoft 365 admin center
   • Dthe Microsoft 365 Defender portal

   Show answer

   Correct answer: A

   How others answered

   • A100%

   Explanation

   To create a data loss prevention (DLP) policy, you can use the Microsoft 365 compliance center or the Microsoft Purview compliance portal. In the Microsoft 365 compliance center, you can navigate to Data loss prevention and then select Policy. From there, you can either create a new policy or edit an existing one. You can then customize the policy settings, such as defining which connectors to include in the Business data group and which connectors to block1. You can also use PowerShell commands to create and manage DLP policies2.

   Adapted from community discussion by dunget · 2023-06-11 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

   1. J

      jellybiscuit

      2022-09-05

      Selected A16 upvotes

      "you can configure DLP policies for all workloads through the Microsoft Purview compliance portal," https://docs.microsoft.com/en-us/microsoft-365/compliance/create-test-tune-dlp-policy

   2. P

      PinkUnicorns

      2023-01-02

      Selected A7 upvotes

      It has been renamed to Purview. So the Answer is A. https://learn.microsoft.com/en-us/microsoft-365/compliance/create-a-dlp-policy-from-a-template?view=o365-worldwide

   3. Z

      zxmaz01

      2022-12-29

      Selected A4 upvotes

      DLP is a question of Governance and Compliance --> Purview Compliance Center (Answer A)

   4. M

      Micha338el

      2023-05-29

      2 upvotes

      How DLP works between the Compliance portal and Exchange admin center. In Microsoft Purview, you can create a data loss prevention (DLP) policy in two different admin centers: In the Microsoft Purview compliance portal, you can create a single DLP policy to help protect content in SharePoint, OneDrive, Exchange, Teams, and now Endpoint Devices. We recommend that you create a DLP policy here. For more information, see Create and Deploy data loss prevention policies. In the Exchange admin center, you can create a DLP policy to help protect content only in Exchange. This policy can use Exchange mail flow rules (also known as transport rules), so it has more options specific to handling email. For more information, see DLP in the Exchange admin center.

4. Question 4 of 25

   What can you use to view the Microsoft Secure Score for Devices?

   • AMicrosoft Defender for Cloud Apps
   • BMicrosoft Defender for Endpoint
   • CMicrosoft Defender for Identity
   • DMicrosoft Defender for Office 365

   Show answer

   Correct answer: B

   How others answered

   • B88%

   Explanation

   Your score for devices is visible in the Defender Vulnerability Management dashboard of the Microsoft 365 Defender portal. Forward Microsoft Defender for Endpoint signals, giving Microsoft Secure Score visibility into the device security posture. So: MS Defender for Endpoint, and MS 365 defender (if forwarded). But NOT Defender for O365

   Adapted from community discussion by Bartin8tor · 2022-12-16 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

   1. B

      Bartin8tor

      2022-12-16

      Selected B8 upvotes

      Your score for devices is visible in the Defender Vulnerability Management dashboard of the Microsoft 365 Defender portal. Forward Microsoft Defender for Endpoint signals, giving Microsoft Secure Score visibility into the device security posture. So: MS Defender for Endpoint, and MS 365 defender (if forwarded). But NOT Defender for O365

   2. C

      cris_exam

      2023-01-07

      Selected B5 upvotes

      This one is tricky but the correct answer is B. Since this is regarding devices, it refers to Endpoints, hence Microsoft Defender for Endpoint, NOT MS Defender for O365. The below link documentation also confirms in what portals the secure score can be found. https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score?view=o365-worldwide#products-included-in-secure-score

   3. M

      manofsteel9

      2023-05-30

      Selected B2 upvotes

      B. Microsoft Defender for Endpoint Microsoft Defender for Endpoint provides the capability to view the Microsoft Secure Score for Devices. The Microsoft Secure Score is a measurement of the overall security posture and configuration of devices within an organization. It assesses various security settings, configurations, and best practices to provide a score that represents the level of security and compliance.

   4. N

      nikolaost

      2023-02-18

      Selected B3 upvotes

      Defender for Endpoint as it is referring to devices=endpoints

5. Question 5 of 25

   DRAG DROP - Match the Microsoft Defender for Office 365 feature to the correct description. To answer, drag the appropriate feature from the column on the left to its description on the right. Each feature may be used once, more than once, or not at all. NOTE: Each correct match is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer

   Explanation

   1. Threat Trackers 2. Threat Explorer 3. Anti-phishing protection https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-trackers?view=o365-worldwide#what-are-threat-trackers Threat Trackers are informative widgets and views that provide you with intelligence on different cybersecurity issues that might impact your company. For example, you can view information about trending malware campaigns using Threat Trackers. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer-views?view=o365-worldwide Threat Explorer (and the real-time detections report) is a powerful, near real-time tool to help Security Operations teams investigate and respond to threats in the Microsoft 365 Defender portal. Explorer (and the real-time detections report) displays information about suspected malware and phish in email and files in Office 365, as well as other security threats and risks to your organization.

   Adapted from community discussion by zellck · 2023-04-24 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Answer figure

   

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

   1. L

      louval357

      2022-12-19

      28 upvotes

      Keywords: Prevailing = Trackers Real-time = Explorer Impersonation = Anti-phishing

   2. J

      jellybiscuit

      2022-09-04

      9 upvotes

      Correct Threat tracker https://docs.microsoft.com/en-us/office365/servicedescriptions/microsoft-defender-for-office-365-features#threat-trackers Threat Explorer https://docs.microsoft.com/en-us/office365/servicedescriptions/microsoft-defender-for-office-365-features#threat-explorer

   3. Z

      zellck

      2023-04-24

      4 upvotes

      1. Threat Trackers 2. Threat Explorer 3. Anti-phishing protection https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-trackers?view=o365-worldwide#what-are-threat-trackers Threat Trackers are informative widgets and views that provide you with intelligence on different cybersecurity issues that might impact your company. For example, you can view information about trending malware campaigns using Threat Trackers. https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/threat-explorer-views?view=o365-worldwide Threat Explorer (and the real-time detections report) is a powerful, near real-time tool to help Security Operations teams investigate and respond to threats in the Microsoft 365 Defender portal. Explorer (and the real-time detections report) displays information about suspected malware and phish in email and files in Office 365, as well as other security threats and risks to your organization.

   4. Z

      zellck

      2023-04-24

      1 upvote

      https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-phishing-protection-about?view=o365-worldwide#anti-phishing-protection-in-eop EOP (that is, Microsoft 365 organizations without Microsoft Defender for Office 365) contains features that can help protect your organization from phishing threats: - Spoof intelligence: Use the spoof intelligence insight to review detected spoofed senders in messages from external and internal domains, and manually allow or block those detected senders.

6. Question 6 of 25

   What are customers responsible for when evaluating security in a software as a service (SaaS) cloud services model?

   • Aoperating systems
   • Bnetwork controls
   • Capplications
   • Daccounts and identities

   Show answer

   Correct answer: D

   How others answered

   • D98%

   Explanation

   D is the answer. https://learn.microsoft.com/en-us/training/modules/describe-security-concepts-methodologies/2-describe-shared-responsibility-model In summary, responsibilities always retained by the customer organization include: - Information and data - Devices (mobile and PCs) - Accounts and identities

   Adapted from community discussion by zellck · 2023-04-24 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

   1. Z

      zellck

      2023-04-24

      Selected D6 upvotes

      D is the answer. https://learn.microsoft.com/en-us/training/modules/describe-security-concepts-methodologies/2-describe-shared-responsibility-model In summary, responsibilities always retained by the customer organization include: - Information and data - Devices (mobile and PCs) - Accounts and identities

   2. D

      Darkfire

      2023-07-23

      Selected D4 upvotes

      D = Correct A. Operating systems = Responsibility for the hoster (SaaS) B. Network controls = Responsibiity for the hoster (SaaS) C. Applications = Responsibiity for the hoster (SaaS) D. Accounts and identities = Responsibiity for the Customer

   3. C

      Cooljoy7777

      2022-11-13

      Selected D4 upvotes

      It's (SaaS) cloud services model so the company is only responsible for the accounts and ID

   4. W

      WimTS

      2022-09-21

      Selected D3 upvotes

      In SaaS you are never responsible for the application. D is correct

7. Question 7 of 25

   What does Conditional Access evaluate by using Azure Active Directory (Azure AD) Identity Protection?

   • Auser actions
   • Bgroup membership
   • Cdevice compliance
   • Duser risk

   Show answer

   Correct answer: D

   How others answered

   • D100%

   Explanation

   Correct is D - User risk. For customers with access to Identity Protection, user risk can be evaluated as part of a Conditional Access policy. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions#user-risk

   Adapted from community discussion by cris_exam · 2023-01-08 · 15 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

   1. C

      cris_exam

      2023-01-08

      Selected D15 upvotes

      Correct is D - User risk. For customers with access to Identity Protection, user risk can be evaluated as part of a Conditional Access policy. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-conditions#user-risk

   2. A

      azeem0077

      2022-09-02

      Selected D5 upvotes

      Its's user risk including the below: Anonymous IP address use Atypical travel Malware linked IP address Unfamiliar sign-in properties Leaked credentials Password spray

   3. X

      xeni66

      2022-10-30

      Selected D5 upvotes

      https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection

   4. G

      gaijin101

      2022-08-30

      5 upvotes

      Should be D https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection Its about Identity Protection

8. Question 8 of 25

   Select 3

   Which three authentication methods can Azure AD users use to reset their password? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • Amobile app notification
   • Btext message to a phone
   • Csecurity questions
   • Dcertificate
   • Epicture password

   Show answer

   Correct answer: A, B, C

   How others answered

   • ABC100%

   Explanation

   ABC is the answer. https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks#authentication-methods The following authentication methods are available for SSPR: - Mobile app notification - Mobile app code - Email - Mobile phone - Office phone (available only for tenants with paid subscriptions) - Security questions

   Adapted from community discussion by zellck · 2023-04-23 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

   1. E

      ETU69

      2023-01-03

      Selected A, B, C8 upvotes

      Correct: https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr#select-authentication-methods-and-registration-options

   2. Z

      zellck

      2023-04-23

      Selected A, B, C4 upvotes

      ABC is the answer. https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks#authentication-methods The following authentication methods are available for SSPR: - Mobile app notification - Mobile app code - Email - Mobile phone - Office phone (available only for tenants with paid subscriptions) - Security questions

   3. M

      Mithu94

      2023-02-17

      Selected A, B, C3 upvotes

      https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr#select-authentication-methods-and-registration-options

   4. Z

      zellck

      2023-04-23

      2 upvotes

      https://learn.microsoft.com/en-us/training/modules/explore-authentication-capabilities/4-describe-self-service-password-reset The following authentication methods are available for SSPR: - Mobile app notification - Mobile app code - Email - Mobile phone - Office phone - Security questions

9. Question 9 of 25

   Microsoft 365 Endpoint data loss prevention (Endpoint DLP) can be used on which operating systems?

   • AWindows 10 and newer only
   • BWindows 10 and newer and Android only
   • CWindows 10 and newer and iOS only
   • DWindows 10 and newer, Android, and iOS

   Show answer

   Correct answer: A

   How others answered

   • A90%

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/microsoft-365/compliance/endpoint-dlp-getting-started Microsoft Endpoint DLP allows you to monitor onboarded Windows 10, and Windows 11 and onboarded macOS devices running three latest released versions. Once a device is onboarded, DLP detects when sensitive items are used and shared. This gives you the visibility and control you need to ensure that they're used and protected properly, and to help prevent risky behavior that might compromise them.

   Adapted from community discussion by zellck · 2023-04-22 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

   1. Z

      zellck

      2023-04-22

      Selected A3 upvotes

      A is the answer. https://learn.microsoft.com/en-us/microsoft-365/compliance/endpoint-dlp-getting-started Microsoft Endpoint DLP allows you to monitor onboarded Windows 10, and Windows 11 and onboarded macOS devices running three latest released versions. Once a device is onboarded, DLP detects when sensitive items are used and shared. This gives you the visibility and control you need to ensure that they're used and protected properly, and to help prevent risky behavior that might compromise them.

   2. C

      cris_exam

      2023-01-08

      4 upvotes

      This is a tricky one. Official documentation says the below: Windows 10, Windows 11 and macOS (three latest released versions) endpoints So, the right answer might actually be C because as per above, it also states that besides Windows 10 and newer, there are also the 3 latest IOS versions. I hope this question won't pop up in the exam. :)) I think I will go with C anyway.

   3. J

      jqatar

      2023-02-17

      2 upvotes

      Microsoft Purview, you implement data loss prevention by defining and applying DLP policies. With a DLP policy, you can identify, monitor, and automatically protect sensitive items across: Microsoft 365 services such as Teams, Exchange, SharePoint, and OneDrive Office applications such as Word, Excel, and PowerPoint Windows 10, Windows 11 and macOS (three latest released versions) endpoints non-Microsoft cloud apps on-premises file shares and on-premises SharePoint. https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide

   4. E

      ETU69

      2023-01-03

      Selected A3 upvotes

      Correct: https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide

10. Question 10 of 25

    What is the maximum number of resources that Azure DDoS Protection Standard can protect without additional costs?

    • A50
    • B100
    • C500
    • D1000

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    B is the right answer. However: There's no Azure DDoS Protection Standard anymore. "Azure DDoS Protection offers two tiers – IP Protection and Network Protection – to meet your security and cost needs". https://azure.microsoft.com/en-in/pricing/details/ddos-protection/

    Adapted from community discussion by penatuna · 2023-02-02 · 7 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • azure.microsoft.com documentation
    • azure.microsoft.com documentation

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. E

       ETU69

       2023-01-03

       Selected B12 upvotes

       Correct: https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-faq#how-does-pricing-work-

    2. P

       penatuna

       2023-02-02

       7 upvotes

       B is the right answer. However: There's no Azure DDoS Protection Standard anymore. "Azure DDoS Protection offers two tiers – IP Protection and Network Protection – to meet your security and cost needs". https://azure.microsoft.com/en-in/pricing/details/ddos-protection/

    3. O

       orionduo

       2023-01-15

       7 upvotes

       DDoS protection plans have a fixed monthly charge that covers up to 100 public IP addresses. Protection for additional resources is available. https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-faq#how-does-pricing-work

    4. Z

       zellck

       2023-04-22

       Selected B1 upvote

       B is the answer. https://azure.microsoft.com/en-us/pricing/details/ddos-protection Network Protection will have a fixed monthly charge, which includes protection for 100 public IP resources. Protection for additional public IP resources will be charged on a monthly per-resource basis. A single Azure DDoS Protection plan in a tenant can be used across multiple subscriptions

11. Question 11 of 25

    What should you use to associate the same identity to more than one Azure virtual machine?

    • Aan Azure AD user account
    • Ba user-assigned managed identity
    • Ca system-assigned managed identity
    • Dan Azure AD security group

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    B is correct https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview You can create a user-assigned managed identity and assign it to one or more Azure Resources.

    Adapted from community discussion by Darkfire · 2023-07-25 · 5 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion3

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. D

       Darkfire

       2023-07-25

       Selected B5 upvotes

       B is correct https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview You can create a user-assigned managed identity and assign it to one or more Azure Resources.

    2. N

       novak18

       2023-06-14

       3 upvotes

       The given answer is correct Supporting links below: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-manage-user-assigned-managed-identities?pivots=identity-mi-methods-azp#manage-access-to-user-assigned-managed-identities https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-cli-windows-vm

    3. L

       LegendaryZA

       2024-10-14

       Selected B2 upvotes

       Answer: a user-assigned managed identity https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

12. Question 12 of 25

    You plan to move resources to the cloud. You are evaluating the use of Infrastructure as a service (IaaS), Platform as a service (PaaS), and Software as a service (SaaS) cloud models. You plan to manage only the data, user accounts, and user devices for a cloud-based app. Which cloud model will you use?

    • ASaaS
    • BPaaS
    • CIaaS

    Show answer

    Correct answer: A

    How others answered

    • A89%

    Explanation

    A is correct https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility Responsibility always retained by the customer: - Information and Data - Devices (Mobile and PCs) - Accounts and Identities

    Adapted from community discussion by Darkfire · 2023-07-25 · 6 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. D

       Darkfire

       2023-07-25

       Selected A6 upvotes

       A is correct https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility Responsibility always retained by the customer: - Information and Data - Devices (Mobile and PCs) - Accounts and Identities

    2. T

       tsummey

       2024-05-30

       2 upvotes

       I feel like this question is missing context. The correct answer can be SaaS or PaaS depending on the need for this to be 'fully managed'. SaaS definitely works. PaaS can manage the data and user accounts while the cloud provider manages the underlying infrastructure, runtime, middleware, OS, and virtualization. Devices can be managed through various services offered within the PaaS model, which often include advanced capabilities for application development, business analytics, and IoT services

    3. K

       KindFlame

       2025-04-06

       Selected A1 upvote

       Tricky question because they mentioned "... and user devices for a cloud-based app". As far as I know, Intune has been removed from the SC-900 exam. That said, "Intune is a cloud-based endpoint management solution that securely manages identities, apps, and devices". That is why I would go with 'SaaS', just in case. https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/what-is-intune https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/sc-900

    4. L

       LegendaryZA

       2024-10-14

       Selected A1 upvote

       Answer is SaaS https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility

13. Question 13 of 25

    What can you use to provide a user with a two-hour window to complete an administrative task in Azure?

    • AAzure Active Directory (Azure AD) Privileged Identity Management (PIM)
    • BAzure Multi-Factor Authentication (MFA)
    • CAzure Active Directory (Azure AD) Identity Protection
    • Dconditional access policies

    Show answer

    Correct answer: A

    How others answered

    • A99%

    Explanation

    Provided answer is wrong. Should be A. https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management: Provide just-in-time privileged access to Azure AD and Azure resources Assign time-bound access to resources using start and end dates Require approval to activate privileged roles Enforce multi-factor authentication to activate any role Use justification to understand why users activate Get notifications when privileged roles are activated Conduct access reviews to ensure users still need roles Download audit history for internal or external audit Prevents removal of the last active Global Administrator role assignment

    Adapted from community discussion by gills · 2021-07-01 · 99 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. G

       gills

       2021-07-01

       99 upvotes

       Provided answer is wrong. Should be A. https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management: Provide just-in-time privileged access to Azure AD and Azure resources Assign time-bound access to resources using start and end dates Require approval to activate privileged roles Enforce multi-factor authentication to activate any role Use justification to understand why users activate Get notifications when privileged roles are activated Conduct access reviews to ensure users still need roles Download audit history for internal or external audit Prevents removal of the last active Global Administrator role assignment

    2. B

       BrkyUlukn

       2023-10-26

       1 upvote

       Correct answer is A: https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management: Provide just-in-time privileged access to Azure AD and Azure resources Assign time-bound access to resources using start and end dates Require approval to activate privileged roles Enforce multi-factor authentication to activate any role Use justification to understand why users activate Get notifications when privileged roles are activated Conduct access reviews to ensure users still need roles Download audit history for internal or external audit Prevents removal of the last active Global Administrator role assignment

    3. L

       LegendaryZA

       2024-10-07

       Selected A2 upvotes

       The answer is: Azure Active Directory (Azure AD) Privileged Identity Management (PIM) https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure

    4. A

       AaronMedrano

       2024-01-29

       Selected A1 upvote

       Should be A. https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about.

14. Question 14 of 25

    What is the purpose of Azure Active Directory (Azure AD) Password Protection?

    • Ato control how often users must change their passwords
    • Bto identify devices to which users can sign in without using multi-factor authentication (MFA)
    • Cto encrypt a password by using globally recognized encryption standards
    • Dto prevent users from using specific words in their passwords

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    1) In course they said that change the passwd of any device or net immediately away from default? I think so. 2) And then the instructions said that don't use same names or terms in both username and passwd. 3) Store passwd and username separately and securily.

    Adapted from community discussion by Marski · 2021-11-26 · 3 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. M

       Melwin86

       2021-07-05

       32 upvotes

       correct https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad

    2. M

       Marski

       2021-11-26

       3 upvotes

       1) In course they said that change the passwd of any device or net immediately away from default? I think so. 2) And then the instructions said that don't use same names or terms in both username and passwd. 3) Store passwd and username separately and securily.

    3. G

       gamerongam

       2022-02-07

       3 upvotes

       Correct is D, https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad

    4. X

       XtraWest

       2023-04-17

       2 upvotes

       The purpose of Azure Active Directory (Azure AD) Password Protection is to help prevent common passwords and weak passwords from being used in Azure AD.

15. Question 15 of 25

    Select 3

    Which three authentication methods can be used by Azure Multi-Factor Authentication (MFA)? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

    • Atext message (SMS)
    • BMicrosoft Authenticator app
    • Cemail verification
    • Dphone call
    • Esecurity question

    Show answer

    Correct answer: A, B, D

    How others answered

    • ABD94%

    Explanation

    Available verification methods When users sign in to an application or service and receive an MFA prompt, they can choose from one of their registered forms of additional verification. Users can access My Profile to edit or add verification methods. The following additional forms of verification can be used with Azure AD Multi-Factor Authentication: Microsoft Authenticator app Windows Hello for Business FIDO2 security key OATH hardware token (preview) OATH software token SMS Voice call https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

    Adapted from community discussion by HK010 · 2022-03-29 · 23 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. H

       HK010

       2022-03-29

       23 upvotes

       Available verification methods When users sign in to an application or service and receive an MFA prompt, they can choose from one of their registered forms of additional verification. Users can access My Profile to edit or add verification methods. The following additional forms of verification can be used with Azure AD Multi-Factor Authentication: Microsoft Authenticator app Windows Hello for Business FIDO2 security key OATH hardware token (preview) OATH software token SMS Voice call https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

    2. Y

       yulexam

       2021-11-04

       4 upvotes

       Correct... authentication method used by MFA: sms, phone call, authenticator app, hw token, sw token. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks. If SSPR, option E (security question) included.

    3. U

       User1208

       2023-06-09

       3 upvotes

       I agree the answer can be verified with the Learning materials, but in reality, I do set up my personal email as a component of the MFA for my working email. Is that empowered by other tech?

    4. E

       ehallak

       2023-01-28

       Selected A, B, D2 upvotes

       Correct. For more details: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

16. Question 16 of 25

    Select 3

    Which three tasks can be performed by using Azure Active Directory (Azure AD) Identity Protection? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

    • AConfigure external access for partner organizations.
    • BExport risk detection to third-party utilities.
    • CAutomate the detection and remediation of identity based-risks.
    • DInvestigate risks that relate to user authentication.
    • ECreate and automatically assign sensitivity labels to data.

    Show answer

    Correct answer: B, C, D

    How others answered

    • BCD100%

    Explanation

    Directly from the SC-900 Fundamentals training slides: Azure Identity Protection Enables organizations to accomplish three key tasks: • Automate the detection and remediation of identity based risks. • Investigate risks using data in the portal. • Export risk detection data to third party utilities for further analysis.

    Adapted from community discussion by KoosDuppen · 2022-04-27 · 86 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. K

       KoosDuppen

       2022-04-27

       86 upvotes

       Directly from the SC-900 Fundamentals training slides: Azure Identity Protection Enables organizations to accomplish three key tasks: • Automate the detection and remediation of identity based risks. • Investigate risks using data in the portal. • Export risk detection data to third party utilities for further analysis.

    2. J

       JMROFLLOL

       2022-04-23

       Selected B, C, D32 upvotes

       As other have said, sensitivity labels have nothing to do with it.

    3. K

       Kuliet

       2022-09-24

       7 upvotes

       "other TOOLS" = "3rd party ULTILITIES", same thing, different words mate.

    4. M

       mandragon

       2022-04-21

       6 upvotes

       BCD is correct. https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection

17. Question 17 of 25

    Select 2

    What are two capabilities of Microsoft Defender for Endpoint? Each correct selection presents a complete solution. NOTE: Each correct selection is worth one point.

    • Aautomated investigation and remediation
    • Btransport encryption
    • Cshadow IT detection
    • Dattack surface reduction

    Show answer

    Correct answer: A, D

    How others answered

    • AD100%

    Explanation

    Answers are CORRECT Microsoft Defender for Endpoint offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale. While The attack surface reduction set of capabilities provides the first line of defence in the stack. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide#microsoft-defender-for-endpoint

    Adapted from community discussion by An_is_here · 2021-07-15 · 35 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. A

       An_is_here

       2021-07-15

       35 upvotes

       Answers are CORRECT Microsoft Defender for Endpoint offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale. While The attack surface reduction set of capabilities provides the first line of defence in the stack. https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide#microsoft-defender-for-endpoint

    2. L

       LegendaryZA

       2024-10-07

       Selected A, D3 upvotes

       The answer is: automated investigation and remediation attack surface reduction https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-endpoint

    3. C

       Chief

       2022-03-19

       2 upvotes

       https://docs.microsoft.com/en-us/learn/modules/describe-threat-protection-with-microsoft-365-defender/5-describe-defender-endpoint

    4. C

       Charly0710

       2023-01-03

       2 upvotes

       AD https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide

18. Question 18 of 25

    Which score measures an organization's progress in completing actions that help reduce risks associated to data protection and regulatory standards?

    • AMicrosoft Secure Score
    • BProductivity Score
    • CSecure score in Azure Security Center
    • DCompliance score

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    Am I the only one who has serious trouble identifying the differences between Microsoft 365 Defender, Defender for Cloud, Defender for Endpoint and the remaining 300 similar named Microsoft Defenders? What;s wrong with these Microsoft people, they are masochists or sth?

    Adapted from community discussion by lalalakis · 2023-03-04 · 20 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • azure.microsoft.com documentation
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. E

       eddie_network_jedi

       2024-09-22

       49 upvotes

       Correct. "regulatory" is the keyword here. regulatory:compliance

    2. L

       lalalakis

       2023-03-04

       20 upvotes

       Am I the only one who has serious trouble identifying the differences between Microsoft 365 Defender, Defender for Cloud, Defender for Endpoint and the remaining 300 similar named Microsoft Defenders? What;s wrong with these Microsoft people, they are masochists or sth?

    3. K

       KoosDuppen

       2022-04-27

       12 upvotes

       to be honest, I barely paid attention to this specific word. Looking here why the answer is 'D'.... I'm surprised that I was surprised by the specific word. Good looking out and great advice for us all (will not forget, thank you)

    4. G

       gustavomelquiades

       2022-06-27

       Selected D4 upvotes

       Answer is: Compliance score D "Microsoft Purview Compliance Manager is a feature in the Microsoft Purview compliance portal that helps you manage your organization’s compliance requirements with greater ease and convenience. Compliance Manager can help you throughout your compliance journey, from taking inventory of your data protection risks to managing the complexities of implementing controls, staying current with regulations and certifications, and reporting to auditors." Source - https://docs.microsoft.com/en-us/microsoft-365/compliance/compliance-manager?view=o365-worldwide&viewFallbackFrom=o365-worldwide%20https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fcompliance%2Fcompliance-score-calculation%3Fview%3Do365-worldwide

19. Question 19 of 25

    Which feature provides the extended detection and response (XDR) capability of Azure Sentinel?

    • Aintegration with the Microsoft 365 compliance center
    • Bsupport for threat hunting
    • Cintegration with Microsoft 365 Defender
    • Dsupport for Azure Monitor Workbooks

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Correct The Microsoft 365 Defender connector for Azure Sentinel (preview) sends all Microsoft 365 Defender incidents and alerts information to Azure Sentinel and keeps the incidents synchronized. Once you add the connector, Microsoft 365 Defender incidents—which include all associated alerts, entities, and relevant information received from Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Defender for Office 365, and Microsoft Cloud App Security—are streamed to Azure Sentinel as security information and event management (SIEM) data, providing you with context to perform triage and incident response with Azure Sentinel. Once in Azure Sentinel, incidents remain bi-directionally synchronized with Microsoft 365 Defender, allowing you to take advantage of the benefits of both the Microsoft 365 Defender portal and Azure Sentinel in the Azure portal for incident investigation and response. https://docs.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender-integration-with-azure-sentinel?view=o365-worldwide

    Adapted from community discussion by JayHall · 2021-10-28 · 38 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. J

       JayHall

       2021-10-28

       38 upvotes

       Correct The Microsoft 365 Defender connector for Azure Sentinel (preview) sends all Microsoft 365 Defender incidents and alerts information to Azure Sentinel and keeps the incidents synchronized. Once you add the connector, Microsoft 365 Defender incidents—which include all associated alerts, entities, and relevant information received from Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Defender for Office 365, and Microsoft Cloud App Security—are streamed to Azure Sentinel as security information and event management (SIEM) data, providing you with context to perform triage and incident response with Azure Sentinel. Once in Azure Sentinel, incidents remain bi-directionally synchronized with Microsoft 365 Defender, allowing you to take advantage of the benefits of both the Microsoft 365 Defender portal and Azure Sentinel in the Azure portal for incident investigation and response. https://docs.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender-integration-with-azure-sentinel?view=o365-worldwide

    2. 2

       2cent2

       2023-01-12

       Selected C7 upvotes

       Microsoft Sentinel is a cloud-native SIEM tool; Microsoft 365 Defender provides XDR capabilities for end-user environments (email, documents, identity, apps, and endpoint); and Microsoft Defender for Cloud provides XDR capabilities for infrastructure and multi-cloud platforms including virtual machines, databases, containers, and IoT.

    3. Z

       zellck

       2023-04-27

       Selected C2 upvotes

       C is the answer. https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview Microsoft 365 Defender is an XDR solution that automatically collects, correlates, and analyzes signal, threat, and alert data from across your Microsoft 365 environment. Microsoft Sentinel is a cloud-native solution that provides security information and event management (SIEM) and security orchestration, automation, and response (SOAR) capabilities. Together, Microsoft Sentinel and Microsoft 365 Defender provide a comprehensive solution to help organizations defend against modern attacks.

    4. L

       LegendaryZA

       2024-10-07

       1 upvote

       The answer is: integration with Microsoft 365 Defender. https://learn.microsoft.com/en-us/defender-xdr/microsoft-365-defender-integration-with-azure-sentinel

20. Question 20 of 25

    What can you use to provide threat detection for Azure SQL Managed Instance?

    • AMicrosoft Secure Score
    • Bapplication security groups
    • CMicrosoft Defender for Cloud
    • DAzure Bastion

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    Microsoft Defender for SQL is a Defender plan in Microsoft Defender for Cloud. Microsoft Defender for SQL includes functionality for surfacing and mitigating potential database vulnerabilities, and detecting anomalous activities that could indicate a threat to your database. It provides a single go-to location for enabling and managing these capabilities. Microsoft Defender for SQL https://learn.microsoft.com/en-us/azure/azure-sql/database/azure-defender-for-sql

    Adapted from community discussion by OrangeSG · 2022-12-07 · 12 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. O

       OrangeSG

       2022-12-07

       Selected C12 upvotes

       Microsoft Defender for SQL is a Defender plan in Microsoft Defender for Cloud. Microsoft Defender for SQL includes functionality for surfacing and mitigating potential database vulnerabilities, and detecting anomalous activities that could indicate a threat to your database. It provides a single go-to location for enabling and managing these capabilities. Microsoft Defender for SQL https://learn.microsoft.com/en-us/azure/azure-sql/database/azure-defender-for-sql

    2. K

       KingChuang

       2022-09-15

       6 upvotes

       Correct. https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction

    3. Z

       zellck

       2023-04-27

       Selected C1 upvote

       C is the answer. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction#advanced-threat-protection An advanced threat protection service continuously monitors your SQL servers for threats such as SQL injection, brute-force attacks, and privilege abuse. This service provides action-oriented security alerts in Microsoft Defender for Cloud with details of the suspicious activity, guidance on how to mitigate to the threats, and options for continuing your investigations with Microsoft Sentinel.

    4. L

       LegendaryZA

       2024-10-07

       Selected C1 upvote

       The answer is: Microsoft Defender for Cloud. https://learn.microsoft.com/en-us/azure/azure-sql/database/azure-defender-for-sql?view=azuresql

21. Question 21 of 25

    You have a Microsoft 365 E3 subscription. You plan to audit user activity by using the unified audit log and Basic Audit. For how long will the audit records be retained?

    • A15 days
    • B30 days
    • C90 days
    • D180 days

    Show answer

    Correct answer: D

    How others answered

    • D67%
    • C33%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Answer D is now correct. per: https://learn.microsoft.com/en-us/purview/audit-solutions-overview?view=o365-worldwide#licensing-requirements "The default retention period for Audit (Standard) has changed from 90 days to 180 days. Audit (Standard) logs generated before October 17, 2023 are retained for 90 days. Audit (Standard) logs generated on or after October 17, 2023 follow the new default retention of 180 days.

    Adapted from community discussion by marges_stud · 2023-11-05 · 8 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. C

       Clouddog

       2022-04-24

       12 upvotes

       Microsoft 365 unified auditing helps to track activities performed in the different Microsoft 365 services by both users and admins. Basic auditing is enabled by default for most Microsoft 365 organizations. In the Basic audit, audit records are retained and searchable for the last 90 days. https://o365reports.com/2021/07/07/microsoft-365-retrieve-audit-log-for-1-year-for-all-subscriptions/

    2. M

       marges_stud

       2023-11-05

       Selected D8 upvotes

       Answer D is now correct. per: https://learn.microsoft.com/en-us/purview/audit-solutions-overview?view=o365-worldwide#licensing-requirements "The default retention period for Audit (Standard) has changed from 90 days to 180 days. Audit (Standard) logs generated before October 17, 2023 are retained for 90 days. Audit (Standard) logs generated on or after October 17, 2023 follow the new default retention of 180 days.

    3. C

       C0mptias_Main_Guy

       2024-02-21

       Selected D6 upvotes

       It's now 180 Days. See reference: https://learn.microsoft.com/en-us/purview/audit-log-retention-policies The default retention period for Audit (Standard) has changed from 90 days to 180 days. Audit (Standard) logs generated before October 17, 2023 are retained for 90 days. Audit (Standard) logs generated on or after October 17, 2023 follow the new default retention of 180 days.

    4. C

       chiliman

       2024-05-05

       6 upvotes

       Be careful, there has been an update here: With a Microsoft 365 E3 subscription, when using the unified audit log and Basic Audit, the audit records are retained for 180 days. This updated retention period applies to audit logs generated on or after October 17, 2023. Prior to this date, the retention period for Basic Audit was 90 days. It’s important to note that this is the default retention period and it can be extended up to 10 years with additional licenses.

22. Question 22 of 25

    What do you use to provide real-time integration between Azure Sentinel and another security source?

    • AAzure AD Connect
    • Ba Log Analytics workspace
    • CAzure Information Protection
    • Da connector

    Show answer

    Correct answer: D

    How others answered

    • D100%

    Explanation

    What do you use to provide real-time integration between Azure Sentinel and another security source? The Questions asks what do you use and connect to another security source (SIEM) , The answer is D " Connector " Because connector is used for real-time integration. After onboarding Microsoft Sentinel into your workspace, connect data sources to start ingesting your data into Microsoft Sentinel. Microsoft Sentinel comes with many connectors for Microsoft products, available out of the box and providing real-time integration. You can also enable out-of-the-box connectors to the broader security ecosystem for non-Microsoft products. For example, you can use Syslog, Common Event Format (CEF), or REST APIs to connect your data sources with Microsoft Sentinel. https://docs.microsoft.com/en-us/azure/sentinel/connect-data-sources

    Adapted from community discussion by imironman · 2022-03-18 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. M

       Melwin86

       2021-07-05

       25 upvotes

       correct https://docs.microsoft.com/en-us/azure/sentinel/connect-data-sources

    2. T

       TDAC

       2021-10-13

       8 upvotes

       Azure AD Connect doesn't have anything to do with Azure Sentinel. AAD Connect is for synchronizing objects/attributes/password hashes between on-prem Active Directory and Azure Active Directory.

    3. I

       imironman

       2022-03-18

       4 upvotes

       What do you use to provide real-time integration between Azure Sentinel and another security source? The Questions asks what do you use and connect to another security source (SIEM) , The answer is D " Connector " Because connector is used for real-time integration. After onboarding Microsoft Sentinel into your workspace, connect data sources to start ingesting your data into Microsoft Sentinel. Microsoft Sentinel comes with many connectors for Microsoft products, available out of the box and providing real-time integration. You can also enable out-of-the-box connectors to the broader security ecosystem for non-Microsoft products. For example, you can use Syslog, Common Event Format (CEF), or REST APIs to connect your data sources with Microsoft Sentinel. https://docs.microsoft.com/en-us/azure/sentinel/connect-data-sources

    4. G

       gustavomelquiades

       2022-06-27

       Selected D3 upvotes

       Answer is: D "Microsoft Sentinel comes with a number of connectors for Microsoft solutions, available out of the box and providing real-time integration, including Microsoft 365 Defender (formerly Microsoft Threat Protection) solutions, and Microsoft 365 sources, including Office 365, Azure AD, Microsoft Defender for Identity (formerly Azure ATP), and Microsoft Defender for Cloud Apps, and more. " https://docs.microsoft.com/en-us/azure/sentinel/overview

23. Question 23 of 25

    You need to connect to an Azure virtual machine by using Azure Bastion. What should you use?

    • APowerShell remoting
    • Bthe Azure portal
    • Cthe Remote Desktop Connection client
    • Dan SSH client

    Show answer

    Correct answer: B

    How others answered

    • B95%

    Explanation

    Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal

    Adapted from community discussion by yonie · 2022-12-23 · 19 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. Y

       yonie

       2022-12-23

       Selected B19 upvotes

       Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal

    2. Z

       zellck

       2023-04-26

       Selected B1 upvote

       B is the answer. https://learn.microsoft.com/en-us/azure/bastion/bastion-overview Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal, or via the native SSH or RDP client already installed on your local computer. The Azure Bastion service is a fully platform-managed PaaS service that you provision inside your virtual network. It provides secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over TLS. When you connect via Azure Bastion, your virtual machines don't need a public IP address, agent, or special client software.

    3. J

       Jothar

       2022-08-31

       4 upvotes

       Azure portal, B. whole idea of bastion is to keep rdp port 3389 closed.

    4. K

       KingChuang

       2022-09-15

       Selected B3 upvotes

       Azure Porta; https://docs.microsoft.com/zh-tw/azure/bastion/bastion-overview

24. Question 24 of 25

    Which type of alert can you manage from the Microsoft 365 Defender portal?

    • AMicrosoft Defender for Storage
    • BMicrosoft Defender for SQL
    • CMicrosoft Defender for Endpoint
    • DMicrosoft Defender for IoT

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    C is the answer. https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender-portal?view=o365-worldwide The Microsoft 365 Defender portal combines protection, detection, investigation, and response to email, collaboration, identity, device, and cloud app threats, in a central place. The Microsoft 365 Defender portal emphasizes quick access to information, simpler layouts, and bringing related information together for easier use. It includes: - Microsoft Defender for Endpoint delivers preventative protection, post-breach detection, automated investigation, and response for devices in your organization.

    Adapted from community discussion by zellck · 2023-04-26 · 2 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. D

       datahop

       2022-11-23

       4 upvotes

       Correct is C! Alert sources Microsoft 365 Defender Microsoft Defender for Office 365 Microsoft Defender for Endpoint Microsoft Defender for Identity Microsoft Defender for Cloud Apps Azure Active Directory (AAD) Identity Protection App Governance Microsoft Data Loss Prevention source: https://learn.microsoft.com/en-us/microsoft-365/security/defender/investigate-alerts?view=o365-worldwide

    2. M

       Mithu94

       2023-02-16

       Selected C4 upvotes

       Alerts from different Microsoft security solutions like Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft 365 Defender appear here.

    3. Z

       zellck

       2023-04-26

       Selected C2 upvotes

       C is the answer. https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender-portal?view=o365-worldwide The Microsoft 365 Defender portal combines protection, detection, investigation, and response to email, collaboration, identity, device, and cloud app threats, in a central place. The Microsoft 365 Defender portal emphasizes quick access to information, simpler layouts, and bringing related information together for easier use. It includes: - Microsoft Defender for Endpoint delivers preventative protection, post-breach detection, automated investigation, and response for devices in your organization.

    4. N

       Nail

       2023-01-26

       Selected C2 upvotes

       MDI, MDO, MDE, and MDCA (formerly MCAS) are all in the M365 Defender portal.

25. Question 25 of 25

    What is a use case for implementing information barrier policies in Microsoft 365?

    • Ato restrict unauthenticated access to Microsoft 365
    • Bto restrict Microsoft Teams chats between certain groups within an organization
    • Cto restrict Microsoft Exchange Online email between certain groups within an organization
    • Dto restrict data sharing to external email recipients

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    correct answer is B:Information barriers are supported in Microsoft Teams, SharePoint Online, and OneDrive for Business. A compliance administrator or information barriers administrator can define policies to allow or prevent communications between groups of users in Microsoft Teams. Information barrier policies can be used for situations like these:

    Adapted from community discussion by vani009 · 2021-08-07 · 38 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by SC-900 or CertExamHQ.

    1. V

       vani009

       2021-08-07

       38 upvotes

       correct answer is B:Information barriers are supported in Microsoft Teams, SharePoint Online, and OneDrive for Business. A compliance administrator or information barriers administrator can define policies to allow or prevent communications between groups of users in Microsoft Teams. Information barrier policies can be used for situations like these:

    2. J

       juanchv

       2021-12-05

       Selected B5 upvotes

       In the documentation clearly describes that information barriers are supported for Microsoft teams, Sharepoint and one drive: https://docs.microsoft.com/en-us/microsoft-365/compliance/information-barriers?view=o365-worldwide

    3. S

       sas000

       2022-01-22

       1 upvote

       B is the correct answer nformation barriers are supported in solutions like Microsoft Teams, OneDrive for Business, SharePoint Online, and more. Information barriers in Microsoft Teams In Microsoft Teams, information barrier policies determine and prevent the following kinds of unauthorized communications: Searching for a user Adding a member to a team Starting a chat session with someone Starting a group chat Inviting someone to join a meeting Sharing a screen Placing a call Sharing a file with another user Access to file through sharing link If the people involved are included in an information barrier policy to prevent the activity, they cannot continue. Potentially, everyone included in an information barrier policy can be blocked from communicating with others in Microsoft Teams. When people affected by information barrier policies are part of the same team or group chat, they might be removed from those chat sessions and further communication with the group might not be allowed. To learn more about the user experience with information barriers, see information barriers in Microsoft Teams.

    4. C

       cris_exam

       2023-01-07

       Selected B3 upvotes

       B is correct Block policies prevent one group from communicating with another group. Allow policies allow a group to communicate with only specific groups. https://learn.microsoft.com/en-us/microsoft-365/compliance/information-barriers-policies?view=o365-worldwide#determine-what-policies-are-needed

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-900 practice, question 1 of 25