Microsoft SC-900 Practice Test 75
Question 740
A help desk receives hundreds of routine password-reset calls from traveling employees. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect subscription or resource role assignments and effective permissions for the target resource.
- Inspect SSPR policy scope, method registration, registration status and reset audit logs.
- Inspect role definitions, active assignments and role audit events for tenant administrators.
- Inspect policy targeting, device compliance information and sign-in evaluation details.
Explanation
Correct Answer
B:Inspect SSPR policy scope, method registration, registration status and reset audit logs. This is the relevant evidence check for this situation. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.
Incorrect Answers
A:Inspect subscription or resource role assignments and effective permissions for the target resource. This item belongs to a different control area: Azure resource RBAC versus Entra roles. Its appropriate purpose is: Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services. For the stated case, Self-service password reset is the closer match. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.
C:Inspect role definitions, active assignments and role audit events for tenant administrators. This item belongs to a different control area: Microsoft Entra role-based access control. Its appropriate purpose is: Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model. For the stated case, Self-service password reset is the closer match. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.
D:Inspect policy targeting, device compliance information and sign-in evaluation details. This item belongs to a different control area: Conditional Access compliant devices. Its appropriate purpose is: Conditional Access combines signals and access controls; device compliance comes from the supported management and enrollment state. For the stated case, Self-service password reset is the closer match. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.
Question 741
A records officer wants to review supported user actions associated with information-protection policies. Which approach MOST directly addresses the stated requirement?
- Use Microsoft Purview Activity explorer to review events associated with labels and protection activities in supported workloads.
- Use Microsoft Purview Audit to search supported Microsoft 365 audit events for accountability and investigations.
- Use Microsoft Purview Insider Risk Management to investigate configured potentially risky user activities under approved privacy safeguards.
- Use Microsoft Purview Compliance Manager to organize improvement actions and track regulatory assessment progress.
Explanation
Correct Answer
A:Use Microsoft Purview Activity explorer to review events associated with labels and protection activities in supported workloads. This is the directly applicable response. Activity explorer focuses on what happened to data, unlike Content explorer's inventory of classified content.
Incorrect Answers
B:Use Microsoft Purview Audit to search supported Microsoft 365 audit events for accountability and investigations. This item belongs to a different control area: Microsoft Purview Audit. Its appropriate purpose is: Audit provides activity logging and search, not a tool to classify documents or automatically enforce retention. For the stated case, Activity explorer is the closer match. Activity explorer focuses on what happened to data, unlike Content explorer's inventory of classified content.
C:Use Microsoft Purview Insider Risk Management to investigate configured potentially risky user activities under approved privacy safeguards. This item belongs to a different control area: Insider risk management. Its appropriate purpose is: Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy. For the stated case, Activity explorer is the closer match. Activity explorer focuses on what happened to data, unlike Content explorer's inventory of classified content.
D:Use Microsoft Purview Compliance Manager to organize improvement actions and track regulatory assessment progress. This item belongs to a different control area: Compliance Manager. Its appropriate purpose is: Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance. For the stated case, Activity explorer is the closer match. Activity explorer focuses on what happened to data, unlike Content explorer's inventory of classified content.
Question 742
An Azure server displays suspicious process behavior and the cloud team needs threat alerts for the workload. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- An analyst can reconstruct the incident sequence and document an evidence-based disposition.
- Inspect protected resource coverage, workload alerts, enabled plans and alert investigation evidence.
- Enable applicable Defender for Cloud workload protection plans to detect threats affecting supported cloud workloads.
- Inspect firewall policies, rule collections, traffic logs and routed connection paths.
- Separate workloads into appropriately designed Azure virtual networks and subnets with explicit connectivity boundaries.
Explanation
Correct Answers
B:Inspect protected resource coverage, workload alerts, enabled plans and alert investigation evidence. This is the relevant evidence check for this situation. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.
C:Enable applicable Defender for Cloud workload protection plans to detect threats affecting supported cloud workloads. This is the directly applicable response. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.
Incorrect Answers
A:An analyst can reconstruct the incident sequence and document an evidence-based disposition. This item belongs to a different control area: Microsoft Sentinel incident investigation. Its appropriate purpose is: Incident management helps investigate and coordinate alerts; it differs from automatic enforcement through a playbook. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.
D:Inspect firewall policies, rule collections, traffic logs and routed connection paths. This item belongs to a different control area: Azure Firewall. Its appropriate purpose is: Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.
E:Separate workloads into appropriately designed Azure virtual networks and subnets with explicit connectivity boundaries. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.
Question 743
A hybrid enterprise wants detection of identity attacks targeting domain accounts and directory infrastructure. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Traffic paths honor the intended segment boundaries and only deliberately connected networks can communicate.
- Apply Azure Web Application Firewall to inspect HTTP and HTTPS requests for common web-application attacks.
- Inspect vault secrets, access configuration, audit logs and consuming identity permissions.
- Use Microsoft Defender for Identity to detect suspicious identity activity involving supported on-premises Active Directory environments.
- Inspect monitored domain controllers, identity alerts and suspicious activity timelines.
Explanation
Correct Answers
D:Use Microsoft Defender for Identity to detect suspicious identity activity involving supported on-premises Active Directory environments. This is the directly applicable response. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.
E:Inspect monitored domain controllers, identity alerts and suspicious activity timelines. This is the relevant evidence check for this situation. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.
Incorrect Answers
A:Traffic paths honor the intended segment boundaries and only deliberately connected networks can communicate. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.
B:Apply Azure Web Application Firewall to inspect HTTP and HTTPS requests for common web-application attacks. This item belongs to a different control area: Azure Web Application Firewall. Its appropriate purpose is: A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.
C:Inspect vault secrets, access configuration, audit logs and consuming identity permissions. This item belongs to a different control area: Azure Key Vault secrets. Its appropriate purpose is: Key Vault manages keys, secrets and certificates; it is not a general-purpose file storage or SIEM service. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.
Question 744
A healthcare organization has security controls but cannot show which regulation each control supports. Which approach MOST directly addresses the stated requirement?
- Maintain documented governance decisions, risk ownership and compliance control evidence.
- Establish a standards-based trust between identity providers so one organization can authenticate users for a relying application.
- Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network.
- Use a trusted identity provider and directory to manage identities and support application sign-in.
Explanation
Correct Answer
A:Maintain documented governance decisions, risk ownership and compliance control evidence. This is the directly applicable response. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.
Incorrect Answers
B:Establish a standards-based trust between identity providers so one organization can authenticate users for a relying application. This item belongs to a different control area: Identity federation. Its appropriate purpose is: Federation extends authentication trust across security domains; it does not automatically grant unrestricted permissions. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.
C:Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.
D:Use a trusted identity provider and directory to manage identities and support application sign-in. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.
Question 745
A project identifies a new data residency obligation and needs to assign ownership, policy and an auditable response. Which approach MOST directly addresses the stated requirement?
- Authenticate the principal first and separately authorize only the permitted resource actions.
- Use a trusted identity provider and directory to manage identities and support application sign-in.
- Maintain documented governance decisions, risk ownership and compliance control evidence.
- Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network.
Explanation
Correct Answer
C:Maintain documented governance decisions, risk ownership and compliance control evidence. This is the directly applicable response. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.
Incorrect Answers
A:Authenticate the principal first and separately authorize only the permitted resource actions. This item belongs to a different control area: Authentication and authorization. Its appropriate purpose is: Authentication proves identity or possession of credentials; authorization determines what that identity may do. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.
B:Use a trusted identity provider and directory to manage identities and support application sign-in. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.
D:Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.
Question 746
A phishing email leads to a risky sign-in and suspicious endpoint behavior that analysts currently investigate separately. After implementing the intended safeguard, which outcome BEST demonstrates that the stated requirement has been met?
- Related endpoint, identity and email signals appear together in a coordinated investigation.
- The compliance dashboard reflects assessment status and supporting remediation evidence for selected standards.
- Misconfigurations are tracked to remediation and future posture scans reflect the corrected resources.
- Security owners see prioritized exposures and applicable workload detections in the expected scope.
Explanation
Correct Answer
A:Related endpoint, identity and email signals appear together in a coordinated investigation. This observable outcome tests whether the requirement has actually been met. Defender XDR correlates detections across product domains; it does not replace storage of encryption keys or data retention governance.
Incorrect Answers
B:The compliance dashboard reflects assessment status and supporting remediation evidence for selected standards. This item belongs to a different control area: Defender for Cloud regulatory compliance. Its appropriate purpose is: Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance. For the stated case, Microsoft Defender XDR unified incidents is the closer match. Defender XDR correlates detections across product domains; it does not replace storage of encryption keys or data retention governance.
C:Misconfigurations are tracked to remediation and future posture scans reflect the corrected resources. This item belongs to a different control area: Cloud Security Posture Management. Its appropriate purpose is: CSPM evaluates configuration and exposure risk proactively, rather than solely responding to an endpoint malware alert. For the stated case, Microsoft Defender XDR unified incidents is the closer match. Defender XDR correlates detections across product domains; it does not replace storage of encryption keys or data retention governance.
D:Security owners see prioritized exposures and applicable workload detections in the expected scope. This item belongs to a different control area: Defender for Cloud unified security posture. Its appropriate purpose is: Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group. For the stated case, Microsoft Defender XDR unified incidents is the closer match. Defender XDR correlates detections across product domains; it does not replace storage of encryption keys or data retention governance.
Question 747
A company repeatedly creates Azure resources with overly permissive network settings. After implementing the intended safeguard, which outcome BEST demonstrates that the stated requirement has been met?
- A targeted remediation clears the relevant security recommendation without loosening the intended standard.
- Test events meeting detection criteria produce expected alerts or incidents without overwhelming false positives.
- Malicious attachments are blocked or handled according to the configured action before users consume them.
- Expected source events are searchable in the intended workspace and support threat analytics.
Explanation
Correct Answer
A:A targeted remediation clears the relevant security recommendation without loosening the intended standard. This observable outcome tests whether the requirement has actually been met. A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources.
Incorrect Answers
B:Test events meeting detection criteria produce expected alerts or incidents without overwhelming false positives. This item belongs to a different control area: Microsoft Sentinel analytics rules. Its appropriate purpose is: Sentinel analytics rules evaluate telemetry to raise detections; collecting logs alone is insufficient to identify a defined pattern. For the stated case, Cloud security policies and recommendations is the closer match. A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources.
C:Malicious attachments are blocked or handled according to the configured action before users consume them. This item belongs to a different control area: Defender for Office 365 Safe Attachments. Its appropriate purpose is: Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs. For the stated case, Cloud security policies and recommendations is the closer match. A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources.
D:Expected source events are searchable in the intended workspace and support threat analytics. This item belongs to a different control area: Microsoft Sentinel SIEM ingestion. Its appropriate purpose is: A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events. For the stated case, Cloud security policies and recommendations is the closer match. A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources.
Question 748
A security group needs a governed process to review insider data-handling risk alerts. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect assessments, improvement actions, assigned owners and uploaded evidence.
- Inspect classifier configuration, matched items and classification results in a controlled test corpus.
- Inspect policy indicators, generated alerts, case evidence and role-controlled access.
- Inspect Activity explorer events, filters, users, activity types and timestamps.
Explanation
Correct Answer
C:Inspect policy indicators, generated alerts, case evidence and role-controlled access. This is the relevant evidence check for this situation. Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy.
Incorrect Answers
A:Inspect assessments, improvement actions, assigned owners and uploaded evidence. This item belongs to a different control area: Compliance Manager. Its appropriate purpose is: Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance. For the stated case, Insider risk management is the closer match. Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy.
B:Inspect classifier configuration, matched items and classification results in a controlled test corpus. This item belongs to a different control area: Sensitive information type classification. Its appropriate purpose is: Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration. For the stated case, Insider risk management is the closer match. Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy.
D:Inspect Activity explorer events, filters, users, activity types and timestamps. This item belongs to a different control area: Activity explorer. Its appropriate purpose is: Activity explorer focuses on what happened to data, unlike Content explorer's inventory of classified content. For the stated case, Insider risk management is the closer match. Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy.
Question 749
A company wants controlled access and audit events for sensitive application credentials. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Relevant on-premises directory attack behavior generates supported identity threat detections.
- Inspect vault secrets, access configuration, audit logs and consuming identity permissions.
- Inspect protected resource coverage, workload alerts, enabled plans and alert investigation evidence.
- Store and access application secrets in Azure Key Vault with appropriately controlled authorization.
- Configure Microsoft Sentinel analytics rules to detect defined suspicious patterns in ingested security data.
Explanation
Correct Answers
B:Inspect vault secrets, access configuration, audit logs and consuming identity permissions. This is the relevant evidence check for this situation. Key Vault manages keys, secrets and certificates; it is not a general-purpose file storage or SIEM service.
D:Store and access application secrets in Azure Key Vault with appropriately controlled authorization. This is the directly applicable response. Key Vault manages keys, secrets and certificates; it is not a general-purpose file storage or SIEM service.
Incorrect Answers
A:Relevant on-premises directory attack behavior generates supported identity threat detections. This item belongs to a different control area: Defender for Identity. Its appropriate purpose is: Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog. For the stated case, Azure Key Vault secrets is the closer match. Key Vault manages keys, secrets and certificates; it is not a general-purpose file storage or SIEM service.
C:Inspect protected resource coverage, workload alerts, enabled plans and alert investigation evidence. This item belongs to a different control area: Defender for Cloud workload protection. Its appropriate purpose is: Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture. For the stated case, Azure Key Vault secrets is the closer match. Key Vault manages keys, secrets and certificates; it is not a general-purpose file storage or SIEM service.
E:Configure Microsoft Sentinel analytics rules to detect defined suspicious patterns in ingested security data. This item belongs to a different control area: Microsoft Sentinel analytics rules. Its appropriate purpose is: Sentinel analytics rules evaluate telemetry to raise detections; collecting logs alone is insufficient to identify a defined pattern. For the stated case, Azure Key Vault secrets is the closer match. Key Vault manages keys, secrets and certificates; it is not a general-purpose file storage or SIEM service.
Question 750
A hybrid enterprise wants detection of identity attacks targeting domain accounts and directory infrastructure. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect vault secrets, access configuration, audit logs and consuming identity permissions.
- Inspect monitored domain controllers, identity alerts and suspicious activity timelines.
- Inspect VNet and subnet address plans, peering relationships and route tables.
- Inspect WAF rules, managed-rule matches and HTTP request logs for the affected endpoint.
Explanation
Correct Answer
B:Inspect monitored domain controllers, identity alerts and suspicious activity timelines. This is the relevant evidence check for this situation. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.
Incorrect Answers
A:Inspect vault secrets, access configuration, audit logs and consuming identity permissions. This item belongs to a different control area: Azure Key Vault secrets. Its appropriate purpose is: Key Vault manages keys, secrets and certificates; it is not a general-purpose file storage or SIEM service. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.
C:Inspect VNet and subnet address plans, peering relationships and route tables. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.
D:Inspect WAF rules, managed-rule matches and HTTP request logs for the affected endpoint. This item belongs to a different control area: Azure Web Application Firewall. Its appropriate purpose is: A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.
