Microsoft SC-900 Practice Test 63
Question 620
A service desk agent must manage user passwords but should not manage tenantwide security configurations. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Known weak or organization-specific passwords are rejected where the configured protection is enforced.
- Inspect role definitions, active assignments and role audit events for tenant administrators.
- Inspect registered passkey credentials, permitted authentication-method settings and sign-in method details.
- Enable self-service password reset with verified registration and appropriate identity checks for eligible users.
- Assign the least-privileged supported Microsoft Entra administrative role for a directory task.
Explanation
Correct Answers
B:Inspect role definitions, active assignments and role audit events for tenant administrators. This is the relevant evidence check for this situation. Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model.
E:Assign the least-privileged supported Microsoft Entra administrative role for a directory task. This is the directly applicable response. Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model.
Incorrect Answers
A:Known weak or organization-specific passwords are rejected where the configured protection is enforced. This item belongs to a different control area: Password protection. Its appropriate purpose is: Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy. For the stated case, Microsoft Entra role-based access control is the closer match. Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model.
C:Inspect registered passkey credentials, permitted authentication-method settings and sign-in method details. This item belongs to a different control area: Passkeys and FIDO2. Its appropriate purpose is: FIDO2 passkeys bind authentication to the legitimate relying party and resist credential phishing more effectively than SMS codes. For the stated case, Microsoft Entra role-based access control is the closer match. Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model.
D:Enable self-service password reset with verified registration and appropriate identity checks for eligible users. This item belongs to a different control area: Self-service password reset. Its appropriate purpose is: SSPR helps account recovery; it does not grant additional resource authorization or bypass verification. For the stated case, Microsoft Entra role-based access control is the closer match. Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model.
Question 621
A factory retains Windows domain controllers while introducing Microsoft 365 for its staff. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Connect on-premises Active Directory identities with Microsoft Entra ID for a coordinated hybrid identity experience.
- The operator can perform the approved directory task without access to unrelated privileged functions.
- Inspect synchronization status, source directories and matching cloud user identities.
- Inspect PIM eligible and active assignments, activation policies and role activation logs.
- Use Microsoft Entra entitlement management access packages with governed request, approval and expiration rules.
Explanation
Correct Answers
A:Connect on-premises Active Directory identities with Microsoft Entra ID for a coordinated hybrid identity experience. This is the directly applicable response. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.
C:Inspect synchronization status, source directories and matching cloud user identities. This is the relevant evidence check for this situation. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.
Incorrect Answers
B:The operator can perform the approved directory task without access to unrelated privileged functions. This item belongs to a different control area: Microsoft Entra role-based access control. Its appropriate purpose is: Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model. For the stated case, Hybrid identity is the closer match. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.
D:Inspect PIM eligible and active assignments, activation policies and role activation logs. This item belongs to a different control area: Privileged Identity Management eligible roles. Its appropriate purpose is: PIM reduces standing privilege and provides just-in-time activation controls for supported roles. For the stated case, Hybrid identity is the closer match. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.
E:Use Microsoft Entra entitlement management access packages with governed request, approval and expiration rules. This item belongs to a different control area: Entitlement management access packages. Its appropriate purpose is: Entitlement management standardizes access bundles and access-request governance for groups, apps and sites. For the stated case, Hybrid identity is the closer match. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.
Question 622
A company wants new hires automatically assigned onboarding tasks at their start date. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect workflow triggers, task execution history and resulting group or access changes.
- Inspect synchronization status, source directories and matching cloud user identities.
- Inspect device enrollment, configured Windows Hello credentials and successful intended authentication method.
- Inspect authentication method registration, authentication details and MFA satisfaction in sign-in logs.
Explanation
Correct Answer
A:Inspect workflow triggers, task execution history and resulting group or access changes. This is the relevant evidence check for this situation. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.
Incorrect Answers
B:Inspect synchronization status, source directories and matching cloud user identities. This item belongs to a different control area: Hybrid identity. Its appropriate purpose is: Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure. For the stated case, Lifecycle workflows is the closer match. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.
C:Inspect device enrollment, configured Windows Hello credentials and successful intended authentication method. This item belongs to a different control area: Windows Hello for Business. Its appropriate purpose is: Windows Hello for Business replaces reusable password use in supported scenarios with device-bound asymmetric credentials and local user verification. For the stated case, Lifecycle workflows is the closer match. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.
D:Inspect authentication method registration, authentication details and MFA satisfaction in sign-in logs. This item belongs to a different control area: Multifactor authentication. Its appropriate purpose is: MFA combines different factor categories to reduce account takeover from a stolen password alone. For the stated case, Lifecycle workflows is the closer match. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.
Question 623
A regulated firm must review approvals before permanently disposing of certain retained records. After implementing the intended safeguard, which outcome BEST demonstrates that the stated requirement has been met?
- Authorized investigators can preserve and retrieve relevant evidence with traceable case handling.
- The record follows the required preservation and disposition process with auditable controls.
- The compliance analyst can access the intended Purview capability under the appropriate permissions.
- Completed validated actions appropriately change the calculated progress score while gaps remain visible.
Explanation
Correct Answer
B:The record follows the required preservation and disposition process with auditable controls. This observable outcome tests whether the requirement has actually been met. Records management adds governance and disposition requirements; it differs from simply adding a decorative classification tag.
Incorrect Answers
A:Authorized investigators can preserve and retrieve relevant evidence with traceable case handling. This item belongs to a different control area: Microsoft Purview eDiscovery. Its appropriate purpose is: eDiscovery supports legal and regulatory evidence workflows; it is distinct from real-time data loss prevention. For the stated case, Records management is the closer match. Records management adds governance and disposition requirements; it differs from simply adding a decorative classification tag.
C:The compliance analyst can access the intended Purview capability under the appropriate permissions. This item belongs to a different control area: Microsoft Purview portal. Its appropriate purpose is: The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification. For the stated case, Records management is the closer match. Records management adds governance and disposition requirements; it differs from simply adding a decorative classification tag.
D:Completed validated actions appropriately change the calculated progress score while gaps remain visible. This item belongs to a different control area: Compliance score. Its appropriate purpose is: Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee. For the stated case, Records management is the closer match. Records management adds governance and disposition requirements; it differs from simply adding a decorative classification tag.
Question 624
An organization needs to identify files containing financial account identifiers before policy enforcement. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Examine data handling notices, customer controls and the relevant published privacy commitments.
- Inspect the relevant Purview solution pages, available roles and enabled features.
- Inspect assessments, improvement actions, assigned owners and uploaded evidence.
- Inspect classifier configuration, matched items and classification results in a controlled test corpus.
Explanation
Correct Answer
D:Inspect classifier configuration, matched items and classification results in a controlled test corpus. This is the relevant evidence check for this situation. Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration.
Incorrect Answers
A:Examine data handling notices, customer controls and the relevant published privacy commitments. This item belongs to a different control area: Microsoft privacy principles. Its appropriate purpose is: Privacy principles guide responsible data handling and transparency; they do not automatically classify every document. For the stated case, Sensitive information type classification is the closer match. Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration.
B:Inspect the relevant Purview solution pages, available roles and enabled features. This item belongs to a different control area: Microsoft Purview portal. Its appropriate purpose is: The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification. For the stated case, Sensitive information type classification is the closer match. Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration.
C:Inspect assessments, improvement actions, assigned owners and uploaded evidence. This item belongs to a different control area: Compliance Manager. Its appropriate purpose is: Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance. For the stated case, Sensitive information type classification is the closer match. Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration.
Question 625
An HR team wants new interns to request a predefined collection of resources that expire after the internship. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Assign Azure resource RBAC at the smallest practical resource scope for resource management operations.
- A noncompliant device is blocked or challenged while compliant devices can access the targeted app.
- Use Microsoft Entra entitlement management access packages with governed request, approval and expiration rules.
- Inspect access package catalogs, eligibility, request policy and expiration configuration.
- Inspect banned-password lists, password change results and protection audit or enforcement events.
Explanation
Correct Answers
C:Use Microsoft Entra entitlement management access packages with governed request, approval and expiration rules. This is the directly applicable response. Entitlement management standardizes access bundles and access-request governance for groups, apps and sites.
D:Inspect access package catalogs, eligibility, request policy and expiration configuration. This is the relevant evidence check for this situation. Entitlement management standardizes access bundles and access-request governance for groups, apps and sites.
Incorrect Answers
A:Assign Azure resource RBAC at the smallest practical resource scope for resource management operations. This item belongs to a different control area: Azure resource RBAC versus Entra roles. Its appropriate purpose is: Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services. For the stated case, Entitlement management access packages is the closer match. Entitlement management standardizes access bundles and access-request governance for groups, apps and sites.
B:A noncompliant device is blocked or challenged while compliant devices can access the targeted app. This item belongs to a different control area: Conditional Access compliant devices. Its appropriate purpose is: Conditional Access combines signals and access controls; device compliance comes from the supported management and enrollment state. For the stated case, Entitlement management access packages is the closer match. Entitlement management standardizes access bundles and access-request governance for groups, apps and sites.
E:Inspect banned-password lists, password change results and protection audit or enforcement events. This item belongs to a different control area: Password protection. Its appropriate purpose is: Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy. For the stated case, Entitlement management access packages is the closer match. Entitlement management standardizes access bundles and access-request governance for groups, apps and sites.
Question 626
A company needs to retain Teams and Exchange content for a defined period under a broad policy. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect retention policy scope, duration settings and resulting content lifecycle behavior.
- Inspect the relevant Purview solution pages, available roles and enabled features.
- Examine data handling notices, customer controls and the relevant published privacy commitments.
- Inspect score breakdown, applicable improvement actions and updates to action completion.
Explanation
Correct Answer
A:Inspect retention policy scope, duration settings and resulting content lifecycle behavior. This is the relevant evidence check for this situation. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.
Incorrect Answers
B:Inspect the relevant Purview solution pages, available roles and enabled features. This item belongs to a different control area: Microsoft Purview portal. Its appropriate purpose is: The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification. For the stated case, Retention policies is the closer match. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.
C:Examine data handling notices, customer controls and the relevant published privacy commitments. This item belongs to a different control area: Microsoft privacy principles. Its appropriate purpose is: Privacy principles guide responsible data handling and transparency; they do not automatically classify every document. For the stated case, Retention policies is the closer match. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.
D:Inspect score breakdown, applicable improvement actions and updates to action completion. This item belongs to a different control area: Compliance score. Its appropriate purpose is: Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee. For the stated case, Retention policies is the closer match. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.
Question 627
A customer service website needs configurable web attack protection on incoming HTTP traffic. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect session policy scope, controlled activities and matched cloud app session events.
- Inspect WAF rules, managed-rule matches and HTTP request logs for the affected endpoint.
- Inspect onboarded device inventory, detection alerts, process timelines and investigation findings.
- Inspect discovered app inventory, traffic evidence and application risk scores.
Explanation
Correct Answer
B:Inspect WAF rules, managed-rule matches and HTTP request logs for the affected endpoint. This is the relevant evidence check for this situation. A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering.
Incorrect Answers
A:Inspect session policy scope, controlled activities and matched cloud app session events. This item belongs to a different control area: Defender for Cloud Apps session controls. Its appropriate purpose is: Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors. For the stated case, Azure Web Application Firewall is the closer match. A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering.
C:Inspect onboarded device inventory, detection alerts, process timelines and investigation findings. This item belongs to a different control area: Defender for Endpoint EDR. Its appropriate purpose is: Endpoint detection and response targets device-level malicious behavior, not Microsoft 365 document retention. For the stated case, Azure Web Application Firewall is the closer match. A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering.
D:Inspect discovered app inventory, traffic evidence and application risk scores. This item belongs to a different control area: Defender for Cloud Apps discovery. Its appropriate purpose is: Cloud app discovery assesses shadow IT usage, not the same task as investigating on-premises domain controller compromise. For the stated case, Azure Web Application Firewall is the closer match. A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering.
Question 628
A benefits administrator stores exported claims and wants them protected if a storage device is lost. Which approach MOST directly addresses the stated requirement?
- Use a trusted identity provider and directory to manage identities and support application sign-in.
- Establish a standards-based trust between identity providers so one organization can authenticate users for a relying application.
- Protect sensitive information with appropriate encryption at rest and in transit and manage access to keys.
- Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network.
Explanation
Correct Answer
C:Protect sensitive information with appropriate encryption at rest and in transit and manage access to keys. This is the directly applicable response. Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash.
Incorrect Answers
A:Use a trusted identity provider and directory to manage identities and support application sign-in. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Encryption is the closer match. Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash.
B:Establish a standards-based trust between identity providers so one organization can authenticate users for a relying application. This item belongs to a different control area: Identity federation. Its appropriate purpose is: Federation extends authentication trust across security domains; it does not automatically grant unrestricted permissions. For the stated case, Encryption is the closer match. Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash.
D:Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Encryption is the closer match. Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash.
Question 629
An enterprise wants to identify risky cloud services appearing in its network usage logs. Which approach MOST directly addresses the stated requirement?
- Enable applicable Defender for Cloud workload protection plans to detect threats affecting supported cloud workloads.
- Use Sentinel automation rules and supported playbooks to orchestrate defined incident-response tasks.
- Use Azure Key Vault to centrally control cryptographic key or certificate material and its authorized operations.
- Use Microsoft Defender for Cloud Apps discovery to identify and assess cloud applications used by the organization.
Explanation
Correct Answer
D:Use Microsoft Defender for Cloud Apps discovery to identify and assess cloud applications used by the organization. This is the directly applicable response. Cloud app discovery assesses shadow IT usage, not the same task as investigating on-premises domain controller compromise.
Incorrect Answers
A:Enable applicable Defender for Cloud workload protection plans to detect threats affecting supported cloud workloads. This item belongs to a different control area: Defender for Cloud workload protection. Its appropriate purpose is: Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture. For the stated case, Defender for Cloud Apps discovery is the closer match. Cloud app discovery assesses shadow IT usage, not the same task as investigating on-premises domain controller compromise.
B:Use Sentinel automation rules and supported playbooks to orchestrate defined incident-response tasks. This item belongs to a different control area: Microsoft Sentinel SOAR playbooks. Its appropriate purpose is: SOAR automates and orchestrates workflows; it complements rather than replaces detection analytics and human judgment. For the stated case, Defender for Cloud Apps discovery is the closer match. Cloud app discovery assesses shadow IT usage, not the same task as investigating on-premises domain controller compromise.
C:Use Azure Key Vault to centrally control cryptographic key or certificate material and its authorized operations. This item belongs to a different control area: Azure Key Vault keys and certificates. Its appropriate purpose is: Key Vault supports cryptographic key and certificate lifecycle; secret storage alone is not a substitute for proper key policy. For the stated case, Defender for Cloud Apps discovery is the closer match. Cloud app discovery assesses shadow IT usage, not the same task as investigating on-premises domain controller compromise.
Question 630
An analyst cannot investigate suspicious sign-in patterns because the relevant identity events are missing from the detection workspace. After implementing the intended safeguard, which outcome BEST demonstrates that the stated requirement has been met?
- Expected source events are searchable in the intended workspace and support threat analytics.
- Traffic paths honor the intended segment boundaries and only deliberately connected networks can communicate.
- Security owners see prioritized exposures and applicable workload detections in the expected scope.
- Supported workloads generate relevant security detections that the team can triage.
Explanation
Correct Answer
A:Expected source events are searchable in the intended workspace and support threat analytics. This observable outcome tests whether the requirement has actually been met. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.
Incorrect Answers
B:Traffic paths honor the intended segment boundaries and only deliberately connected networks can communicate. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.
C:Security owners see prioritized exposures and applicable workload detections in the expected scope. This item belongs to a different control area: Defender for Cloud unified security posture. Its appropriate purpose is: Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.
D:Supported workloads generate relevant security detections that the team can triage. This item belongs to a different control area: Defender for Cloud workload protection. Its appropriate purpose is: Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.
