Microsoft SC-900 Practice Test 62
Question 610
An acquisition has Active Directory-based employee accounts and requires aligned cloud sign-in identities. After implementing the intended safeguard, which outcome BEST demonstrates that the stated requirement has been met?
- Known weak or organization-specific passwords are rejected where the configured protection is enforced.
- The intended application sessions are governed and unrelated apps are not accidentally blocked.
- The engineer can perform the allowed resource action but cannot manage unrelated resources or tenant identity settings.
- On-premises identity changes are reflected in Entra ID according to the configured sync topology.
Explanation
Correct Answer
D:On-premises identity changes are reflected in Entra ID according to the configured sync topology. This observable outcome tests whether the requirement has actually been met. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.
Incorrect Answers
A:Known weak or organization-specific passwords are rejected where the configured protection is enforced. This item belongs to a different control area: Password protection. Its appropriate purpose is: Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy. For the stated case, Hybrid identity is the closer match. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.
B:The intended application sessions are governed and unrelated apps are not accidentally blocked. This item belongs to a different control area: Conditional Access application targeting. Its appropriate purpose is: A policy should be tested for targeted principals and applications, with emergency-access exclusions where appropriate. For the stated case, Hybrid identity is the closer match. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.
C:The engineer can perform the allowed resource action but cannot manage unrelated resources or tenant identity settings. This item belongs to a different control area: Azure resource RBAC versus Entra roles. Its appropriate purpose is: Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services. For the stated case, Hybrid identity is the closer match. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.
Question 611
A company wants strong authentication tied to managed Windows laptops rather than shared department passwords. Which approach MOST directly addresses the stated requirement?
- Register an application and control its service principal permissions for unattended application access.
- Deploy Windows Hello for Business for strong device-associated user authentication on supported Windows endpoints.
- Use Microsoft Entra Privileged Identity Management to require time-limited activation of eligible privileged roles.
- Configure and monitor an appropriate supported Microsoft Entra Connect synchronization method for hybrid users.
Explanation
Correct Answer
B:Deploy Windows Hello for Business for strong device-associated user authentication on supported Windows endpoints. This is the directly applicable response. Windows Hello for Business replaces reusable password use in supported scenarios with device-bound asymmetric credentials and local user verification.
Incorrect Answers
A:Register an application and control its service principal permissions for unattended application access. This item belongs to a different control area: Service principals. Its appropriate purpose is: Service principals represent applications or services rather than individual human users; credentials and consent must be governed. For the stated case, Windows Hello for Business is the closer match. Windows Hello for Business replaces reusable password use in supported scenarios with device-bound asymmetric credentials and local user verification.
C:Use Microsoft Entra Privileged Identity Management to require time-limited activation of eligible privileged roles. This item belongs to a different control area: Privileged Identity Management eligible roles. Its appropriate purpose is: PIM reduces standing privilege and provides just-in-time activation controls for supported roles. For the stated case, Windows Hello for Business is the closer match. Windows Hello for Business replaces reusable password use in supported scenarios with device-bound asymmetric credentials and local user verification.
D:Configure and monitor an appropriate supported Microsoft Entra Connect synchronization method for hybrid users. This item belongs to a different control area: Microsoft Entra Connect synchronization. Its appropriate purpose is: Directory synchronization must be scoped and observed; enabling it without verifying source objects can create identity drift. For the stated case, Windows Hello for Business is the closer match. Windows Hello for Business replaces reusable password use in supported scenarios with device-bound asymmetric credentials and local user verification.
Question 612
A help desk report confuses passing multifactor sign-in with having administrator rights in a tenant. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Authenticate the principal first and separately authorize only the permitted resource actions.
- Apply the customer's responsibility for identities, data and cloud configuration rather than assuming the provider performs every control.
- A modified input produces a different computed digest while an unchanged trusted item passes the comparison.
- Compare authentication records with resource permission grants and denied-operation logs.
- Inspect whether access policies, segmentation, application safeguards and encryption operate at independent layers.
Explanation
Correct Answers
A:Authenticate the principal first and separately authorize only the permitted resource actions. This is the directly applicable response. Authentication proves identity or possession of credentials; authorization determines what that identity may do.
D:Compare authentication records with resource permission grants and denied-operation logs. This is the relevant evidence check for this situation. Authentication proves identity or possession of credentials; authorization determines what that identity may do.
Incorrect Answers
B:Apply the customer's responsibility for identities, data and cloud configuration rather than assuming the provider performs every control. This item belongs to a different control area: Cloud shared responsibility. Its appropriate purpose is: Shared responsibility divides security obligations according to the cloud service model; provider data-center security does not replace tenant controls. For the stated case, Authentication and authorization is the closer match. Authentication proves identity or possession of credentials; authorization determines what that identity may do.
C:A modified input produces a different computed digest while an unchanged trusted item passes the comparison. This item belongs to a different control area: Cryptographic hashing. Its appropriate purpose is: Hashing supports integrity checks or password verification when designed correctly; hashing by itself does not provide encryption or confidentiality. For the stated case, Authentication and authorization is the closer match. Authentication proves identity or possession of credentials; authorization determines what that identity may do.
E:Inspect whether access policies, segmentation, application safeguards and encryption operate at independent layers. This item belongs to a different control area: Defense in depth. Its appropriate purpose is: Defense in depth reduces reliance on any one protection; it is not a claim that all risks can be eliminated. For the stated case, Authentication and authorization is the closer match. Authentication proves identity or possession of credentials; authorization determines what that identity may do.
Question 613
An organization has repeated lateral movement incidents and wants identity-aware decisions with constrained access. Which approach MOST directly addresses the stated requirement?
- Establish a standards-based trust between identity providers so one organization can authenticate users for a relying application.
- Use a trusted identity provider and directory to manage identities and support application sign-in.
- Use the Zero Trust principles of verify explicitly, least privilege and assume breach.
- Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network.
Explanation
Correct Answer
C:Use the Zero Trust principles of verify explicitly, least privilege and assume breach. This is the directly applicable response. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.
Incorrect Answers
A:Establish a standards-based trust between identity providers so one organization can authenticate users for a relying application. This item belongs to a different control area: Identity federation. Its appropriate purpose is: Federation extends authentication trust across security domains; it does not automatically grant unrestricted permissions. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.
B:Use a trusted identity provider and directory to manage identities and support application sign-in. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.
D:Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.
Question 614
A compliance manager needs to ensure message content is not removed before the policy retention window ends. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect retention policy scope, duration settings and resulting content lifecycle behavior.
- Inspect policy indicators, generated alerts, case evidence and role-controlled access.
- Inspect score breakdown, applicable improvement actions and updates to action completion.
- Inspect assessments, improvement actions, assigned owners and uploaded evidence.
Explanation
Correct Answer
A:Inspect retention policy scope, duration settings and resulting content lifecycle behavior. This is the relevant evidence check for this situation. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.
Incorrect Answers
B:Inspect policy indicators, generated alerts, case evidence and role-controlled access. This item belongs to a different control area: Insider risk management. Its appropriate purpose is: Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy. For the stated case, Retention policies is the closer match. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.
C:Inspect score breakdown, applicable improvement actions and updates to action completion. This item belongs to a different control area: Compliance score. Its appropriate purpose is: Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee. For the stated case, Retention policies is the closer match. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.
D:Inspect assessments, improvement actions, assigned owners and uploaded evidence. This item belongs to a different control area: Compliance Manager. Its appropriate purpose is: Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance. For the stated case, Retention policies is the closer match. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.
Question 615
A security team needs to trace a suspicious mailbox operation to a recorded actor and time. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect classifier configuration, matched items and classification results in a controlled test corpus.
- Inspect audit search parameters, event operations, actors and timestamps for the relevant workload.
- Inspect label configuration, policy publication or auto-application scope and labeled item status.
- Examine data handling notices, customer controls and the relevant published privacy commitments.
Explanation
Correct Answer
B:Inspect audit search parameters, event operations, actors and timestamps for the relevant workload. This is the relevant evidence check for this situation. Audit provides activity logging and search, not a tool to classify documents or automatically enforce retention.
Incorrect Answers
A:Inspect classifier configuration, matched items and classification results in a controlled test corpus. This item belongs to a different control area: Sensitive information type classification. Its appropriate purpose is: Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration. For the stated case, Microsoft Purview Audit is the closer match. Audit provides activity logging and search, not a tool to classify documents or automatically enforce retention.
C:Inspect label configuration, policy publication or auto-application scope and labeled item status. This item belongs to a different control area: Retention labels. Its appropriate purpose is: Retention labels govern specific items; a broad location-level retention policy does not provide the same fine-grained labeling behavior. For the stated case, Microsoft Purview Audit is the closer match. Audit provides activity logging and search, not a tool to classify documents or automatically enforce retention.
D:Examine data handling notices, customer controls and the relevant published privacy commitments. This item belongs to a different control area: Microsoft privacy principles. Its appropriate purpose is: Privacy principles guide responsible data handling and transparency; they do not automatically classify every document. For the stated case, Microsoft Purview Audit is the closer match. Audit provides activity logging and search, not a tool to classify documents or automatically enforce retention.
Question 616
A finance team finds that employee passwords have been reused and wants to limit successful attacker sign-ins. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- On-premises identity changes are reflected in Entra ID according to the configured sync topology.
- Inspect authentication method registration, authentication details and MFA satisfaction in sign-in logs.
- Assign Azure resource RBAC at the smallest practical resource scope for resource management operations.
- Require an additional authentication factor for relevant user sign-ins using supported Entra MFA methods.
- Inspect policy targeting, device compliance information and sign-in evaluation details.
Explanation
Correct Answers
B:Inspect authentication method registration, authentication details and MFA satisfaction in sign-in logs. This is the relevant evidence check for this situation. MFA combines different factor categories to reduce account takeover from a stolen password alone.
D:Require an additional authentication factor for relevant user sign-ins using supported Entra MFA methods. This is the directly applicable response. MFA combines different factor categories to reduce account takeover from a stolen password alone.
Incorrect Answers
A:On-premises identity changes are reflected in Entra ID according to the configured sync topology. This item belongs to a different control area: Hybrid identity. Its appropriate purpose is: Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure. For the stated case, Multifactor authentication is the closer match. MFA combines different factor categories to reduce account takeover from a stolen password alone.
C:Assign Azure resource RBAC at the smallest practical resource scope for resource management operations. This item belongs to a different control area: Azure resource RBAC versus Entra roles. Its appropriate purpose is: Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services. For the stated case, Multifactor authentication is the closer match. MFA combines different factor categories to reduce account takeover from a stolen password alone.
E:Inspect policy targeting, device compliance information and sign-in evaluation details. This item belongs to a different control area: Conditional Access compliant devices. Its appropriate purpose is: Conditional Access combines signals and access controls; device compliance comes from the supported management and enrollment state. For the stated case, Multifactor authentication is the closer match. MFA combines different factor categories to reduce account takeover from a stolen password alone.
Question 617
A law firm wants confidential documents marked and protected with an approved sensitivity label. Which approach MOST directly addresses the stated requirement?
- Use Microsoft Purview Compliance Manager to organize improvement actions and track regulatory assessment progress.
- Use Microsoft Purview Audit to search supported Microsoft 365 audit events for accountability and investigations.
- Use Microsoft Purview eDiscovery to identify, preserve and collect relevant content for authorized investigations.
- Create and publish Microsoft Purview sensitivity labels that classify and protect content according to policy.
Explanation
Correct Answer
D:Create and publish Microsoft Purview sensitivity labels that classify and protect content according to policy. This is the directly applicable response. Sensitivity labels classify content and may apply protection; labels must be made available through appropriate policy publishing.
Incorrect Answers
A:Use Microsoft Purview Compliance Manager to organize improvement actions and track regulatory assessment progress. This item belongs to a different control area: Compliance Manager. Its appropriate purpose is: Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance. For the stated case, Sensitivity labels is the closer match. Sensitivity labels classify content and may apply protection; labels must be made available through appropriate policy publishing.
B:Use Microsoft Purview Audit to search supported Microsoft 365 audit events for accountability and investigations. This item belongs to a different control area: Microsoft Purview Audit. Its appropriate purpose is: Audit provides activity logging and search, not a tool to classify documents or automatically enforce retention. For the stated case, Sensitivity labels is the closer match. Sensitivity labels classify content and may apply protection; labels must be made available through appropriate policy publishing.
C:Use Microsoft Purview eDiscovery to identify, preserve and collect relevant content for authorized investigations. This item belongs to a different control area: Microsoft Purview eDiscovery. Its appropriate purpose is: eDiscovery supports legal and regulatory evidence workflows; it is distinct from real-time data loss prevention. For the stated case, Sensitivity labels is the closer match. Sensitivity labels classify content and may apply protection; labels must be made available through appropriate policy publishing.
Question 618
A law firm wants confidential documents marked and protected with an approved sensitivity label. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Create and publish Microsoft Purview sensitivity labels that classify and protect content according to policy.
- Inspect label settings, publication policy scopes and actual label application to target documents.
- The investigator finds applicable activity events and can document who performed an action and when.
- Use Microsoft Purview eDiscovery to identify, preserve and collect relevant content for authorized investigations.
- Inspect assessments, improvement actions, assigned owners and uploaded evidence.
Explanation
Correct Answers
A:Create and publish Microsoft Purview sensitivity labels that classify and protect content according to policy. This is the directly applicable response. Sensitivity labels classify content and may apply protection; labels must be made available through appropriate policy publishing.
B:Inspect label settings, publication policy scopes and actual label application to target documents. This is the relevant evidence check for this situation. Sensitivity labels classify content and may apply protection; labels must be made available through appropriate policy publishing.
Incorrect Answers
C:The investigator finds applicable activity events and can document who performed an action and when. This item belongs to a different control area: Microsoft Purview Audit. Its appropriate purpose is: Audit provides activity logging and search, not a tool to classify documents or automatically enforce retention. For the stated case, Sensitivity labels is the closer match. Sensitivity labels classify content and may apply protection; labels must be made available through appropriate policy publishing.
D:Use Microsoft Purview eDiscovery to identify, preserve and collect relevant content for authorized investigations. This item belongs to a different control area: Microsoft Purview eDiscovery. Its appropriate purpose is: eDiscovery supports legal and regulatory evidence workflows; it is distinct from real-time data loss prevention. For the stated case, Sensitivity labels is the closer match. Sensitivity labels classify content and may apply protection; labels must be made available through appropriate policy publishing.
E:Inspect assessments, improvement actions, assigned owners and uploaded evidence. This item belongs to a different control area: Compliance Manager. Its appropriate purpose is: Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance. For the stated case, Sensitivity labels is the closer match. Sensitivity labels classify content and may apply protection; labels must be made available through appropriate policy publishing.
Question 619
A retiring employee's departure date should initiate consistent access removal and notification tasks. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Automate defined joiner, mover and leaver identity tasks using Microsoft Entra Lifecycle Workflows where supported.
- Apply Microsoft Entra Password Protection policies and custom banned-password screening where supported.
- Expected in-scope users and attribute updates appear in Entra ID without duplicate cloud accounts.
- Inspect workflow triggers, task execution history and resulting group or access changes.
- Inspect SSPR policy scope, method registration, registration status and reset audit logs.
Explanation
Correct Answers
A:Automate defined joiner, mover and leaver identity tasks using Microsoft Entra Lifecycle Workflows where supported. This is the directly applicable response. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.
D:Inspect workflow triggers, task execution history and resulting group or access changes. This is the relevant evidence check for this situation. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.
Incorrect Answers
B:Apply Microsoft Entra Password Protection policies and custom banned-password screening where supported. This item belongs to a different control area: Password protection. Its appropriate purpose is: Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy. For the stated case, Lifecycle workflows is the closer match. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.
C:Expected in-scope users and attribute updates appear in Entra ID without duplicate cloud accounts. This item belongs to a different control area: Microsoft Entra Connect synchronization. Its appropriate purpose is: Directory synchronization must be scoped and observed; enabling it without verifying source objects can create identity drift. For the stated case, Lifecycle workflows is the closer match. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.
E:Inspect SSPR policy scope, method registration, registration status and reset audit logs. This item belongs to a different control area: Self-service password reset. Its appropriate purpose is: SSPR helps account recovery; it does not grant additional resource authorization or bypass verification. For the stated case, Lifecycle workflows is the closer match. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.
Question 620
A service desk agent must manage user passwords but should not manage tenantwide security configurations. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Known weak or organization-specific passwords are rejected where the configured protection is enforced.
- Inspect role definitions, active assignments and role audit events for tenant administrators.
- Inspect registered passkey credentials, permitted authentication-method settings and sign-in method details.
- Enable self-service password reset with verified registration and appropriate identity checks for eligible users.
- Assign the least-privileged supported Microsoft Entra administrative role for a directory task.
Explanation
Correct Answers
B:Inspect role definitions, active assignments and role audit events for tenant administrators. This is the relevant evidence check for this situation. Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model.
E:Assign the least-privileged supported Microsoft Entra administrative role for a directory task. This is the directly applicable response. Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model.
Incorrect Answers
A:Known weak or organization-specific passwords are rejected where the configured protection is enforced. This item belongs to a different control area: Password protection. Its appropriate purpose is: Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy. For the stated case, Microsoft Entra role-based access control is the closer match. Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model.
C:Inspect registered passkey credentials, permitted authentication-method settings and sign-in method details. This item belongs to a different control area: Passkeys and FIDO2. Its appropriate purpose is: FIDO2 passkeys bind authentication to the legitimate relying party and resist credential phishing more effectively than SMS codes. For the stated case, Microsoft Entra role-based access control is the closer match. Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model.
D:Enable self-service password reset with verified registration and appropriate identity checks for eligible users. This item belongs to a different control area: Self-service password reset. Its appropriate purpose is: SSPR helps account recovery; it does not grant additional resource authorization or bypass verification. For the stated case, Microsoft Entra role-based access control is the closer match. Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model.
