Microsoft SC-900 Practice Test 81
Question 800
A security team wants consistent logging and managed policy for traffic leaving multiple VNets. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Use Azure Firewall to centrally apply managed network and application traffic rules for Azure workloads.
- Use supported Defender for Cloud Apps Conditional Access App Control session controls for cloud app activity when configured.
- Inspect ASR rule configuration, audit or block events and exclusions for the affected endpoints.
- The compliance dashboard reflects assessment status and supporting remediation evidence for selected standards.
- Inspect firewall policies, rule collections, traffic logs and routed connection paths.
Explanation
Correct Answers
A:Use Azure Firewall to centrally apply managed network and application traffic rules for Azure workloads. This is the directly applicable response. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.
E:Inspect firewall policies, rule collections, traffic logs and routed connection paths. This is the relevant evidence check for this situation. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.
Incorrect Answers
B:Use supported Defender for Cloud Apps Conditional Access App Control session controls for cloud app activity when configured. This item belongs to a different control area: Defender for Cloud Apps session controls. Its appropriate purpose is: Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors. For the stated case, Azure Firewall is the closer match. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.
C:Inspect ASR rule configuration, audit or block events and exclusions for the affected endpoints. This item belongs to a different control area: Endpoint attack surface reduction. Its appropriate purpose is: ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement. For the stated case, Azure Firewall is the closer match. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.
D:The compliance dashboard reflects assessment status and supporting remediation evidence for selected standards. This item belongs to a different control area: Defender for Cloud regulatory compliance. Its appropriate purpose is: Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance. For the stated case, Azure Firewall is the closer match. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.
Question 801
A project ends but its guest users remain members of a confidential collaboration group. Which approach MOST directly addresses the stated requirement?
- Require an additional authentication factor for relevant user sign-ins using supported Entra MFA methods.
- Scope Conditional Access to selected cloud applications and test policy results before enforcement.
- Use location-based Conditional Access rules only as one evaluated sign-in signal, not as proof of identity.
- Schedule Microsoft Entra access reviews to let owners recertify whether users still need access.
Explanation
Correct Answer
D:Schedule Microsoft Entra access reviews to let owners recertify whether users still need access. This is the directly applicable response. Access reviews periodically reassess existing permissions, unlike a new initial access request.
Incorrect Answers
A:Require an additional authentication factor for relevant user sign-ins using supported Entra MFA methods. This item belongs to a different control area: Multifactor authentication. Its appropriate purpose is: MFA combines different factor categories to reduce account takeover from a stolen password alone. For the stated case, Access reviews is the closer match. Access reviews periodically reassess existing permissions, unlike a new initial access request.
B:Scope Conditional Access to selected cloud applications and test policy results before enforcement. This item belongs to a different control area: Conditional Access application targeting. Its appropriate purpose is: A policy should be tested for targeted principals and applications, with emergency-access exclusions where appropriate. For the stated case, Access reviews is the closer match. Access reviews periodically reassess existing permissions, unlike a new initial access request.
C:Use location-based Conditional Access rules only as one evaluated sign-in signal, not as proof of identity. This item belongs to a different control area: Conditional Access locations. Its appropriate purpose is: Conditional Access can evaluate network locations alongside identities and risk, but location by itself should not be assumed trustworthy. For the stated case, Access reviews is the closer match. Access reviews periodically reassess existing permissions, unlike a new initial access request.
Question 802
A regulated firm must review approvals before permanently disposing of certain retained records. Which approach MOST directly addresses the stated requirement?
- Use the compliance score in Microsoft Purview Compliance Manager as a progress indicator for assessed improvement actions.
- Use Microsoft Purview records management capabilities to govern records according to declared lifecycle and disposition requirements.
- Use the Microsoft Purview portal to discover and administer supported compliance, information protection and risk capabilities.
- Use Microsoft Purview eDiscovery to identify, preserve and collect relevant content for authorized investigations.
Explanation
Correct Answer
B:Use Microsoft Purview records management capabilities to govern records according to declared lifecycle and disposition requirements. This is the directly applicable response. Records management adds governance and disposition requirements; it differs from simply adding a decorative classification tag.
Incorrect Answers
A:Use the compliance score in Microsoft Purview Compliance Manager as a progress indicator for assessed improvement actions. This item belongs to a different control area: Compliance score. Its appropriate purpose is: Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee. For the stated case, Records management is the closer match. Records management adds governance and disposition requirements; it differs from simply adding a decorative classification tag.
C:Use the Microsoft Purview portal to discover and administer supported compliance, information protection and risk capabilities. This item belongs to a different control area: Microsoft Purview portal. Its appropriate purpose is: The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification. For the stated case, Records management is the closer match. Records management adds governance and disposition requirements; it differs from simply adding a decorative classification tag.
D:Use Microsoft Purview eDiscovery to identify, preserve and collect relevant content for authorized investigations. This item belongs to a different control area: Microsoft Purview eDiscovery. Its appropriate purpose is: eDiscovery supports legal and regulatory evidence workflows; it is distinct from real-time data loss prevention. For the stated case, Records management is the closer match. Records management adds governance and disposition requirements; it differs from simply adding a decorative classification tag.
Question 803
A help desk receives hundreds of routine password-reset calls from traveling employees. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Enforce Microsoft Entra Conditional Access requiring compliant device signals for sensitive application access.
- The engineer can perform the allowed resource action but cannot manage unrelated resources or tenant identity settings.
- Inspect role definitions, active assignments and role audit events for tenant administrators.
- Inspect SSPR policy scope, method registration, registration status and reset audit logs.
- Enable self-service password reset with verified registration and appropriate identity checks for eligible users.
Explanation
Correct Answers
D:Inspect SSPR policy scope, method registration, registration status and reset audit logs. This is the relevant evidence check for this situation. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.
E:Enable self-service password reset with verified registration and appropriate identity checks for eligible users. This is the directly applicable response. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.
Incorrect Answers
A:Enforce Microsoft Entra Conditional Access requiring compliant device signals for sensitive application access. This item belongs to a different control area: Conditional Access compliant devices. Its appropriate purpose is: Conditional Access combines signals and access controls; device compliance comes from the supported management and enrollment state. For the stated case, Self-service password reset is the closer match. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.
B:The engineer can perform the allowed resource action but cannot manage unrelated resources or tenant identity settings. This item belongs to a different control area: Azure resource RBAC versus Entra roles. Its appropriate purpose is: Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services. For the stated case, Self-service password reset is the closer match. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.
C:Inspect role definitions, active assignments and role audit events for tenant administrators. This item belongs to a different control area: Microsoft Entra role-based access control. Its appropriate purpose is: Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model. For the stated case, Self-service password reset is the closer match. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.
Question 804
A firm wants to block access from explicitly disallowed geographic regions without giving blanket privilege to office networks. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Configure and monitor an appropriate supported Microsoft Entra Connect synchronization method for hybrid users.
- Inspect named locations, policy exclusions, targeting and sign-in location evaluation.
- Use location-based Conditional Access rules only as one evaluated sign-in signal, not as proof of identity.
- Users sign in with the intended phishing-resistant cryptographic authentication method instead of sharing reusable secrets.
- Inspect tenant user and group objects, enterprise application registration and sign-in events.
Explanation
Correct Answers
B:Inspect named locations, policy exclusions, targeting and sign-in location evaluation. This is the relevant evidence check for this situation. Conditional Access can evaluate network locations alongside identities and risk, but location by itself should not be assumed trustworthy.
C:Use location-based Conditional Access rules only as one evaluated sign-in signal, not as proof of identity. This is the directly applicable response. Conditional Access can evaluate network locations alongside identities and risk, but location by itself should not be assumed trustworthy.
Incorrect Answers
A:Configure and monitor an appropriate supported Microsoft Entra Connect synchronization method for hybrid users. This item belongs to a different control area: Microsoft Entra Connect synchronization. Its appropriate purpose is: Directory synchronization must be scoped and observed; enabling it without verifying source objects can create identity drift. For the stated case, Conditional Access locations is the closer match. Conditional Access can evaluate network locations alongside identities and risk, but location by itself should not be assumed trustworthy.
D:Users sign in with the intended phishing-resistant cryptographic authentication method instead of sharing reusable secrets. This item belongs to a different control area: Passkeys and FIDO2. Its appropriate purpose is: FIDO2 passkeys bind authentication to the legitimate relying party and resist credential phishing more effectively than SMS codes. For the stated case, Conditional Access locations is the closer match. Conditional Access can evaluate network locations alongside identities and risk, but location by itself should not be assumed trustworthy.
E:Inspect tenant user and group objects, enterprise application registration and sign-in events. This item belongs to a different control area: Microsoft Entra ID cloud identity. Its appropriate purpose is: Microsoft Entra ID provides cloud directory and identity services, not network packet filtering or document retention. For the stated case, Conditional Access locations is the closer match. Conditional Access can evaluate network locations alongside identities and risk, but location by itself should not be assumed trustworthy.
Question 805
An email security review finds malicious files that users downloaded from apparently ordinary messages. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect Safe Attachments policy scope, file verdicts and attachment detection reports.
- Inspect analytic rule query logic, schedule, thresholds and representative matching events.
- Inspect VNet and subnet address plans, peering relationships and route tables.
- Inspect policy assignments, noncompliant resources and recommendation-to-remediation mappings.
Explanation
Correct Answer
A:Inspect Safe Attachments policy scope, file verdicts and attachment detection reports. This is the relevant evidence check for this situation. Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs.
Incorrect Answers
B:Inspect analytic rule query logic, schedule, thresholds and representative matching events. This item belongs to a different control area: Microsoft Sentinel analytics rules. Its appropriate purpose is: Sentinel analytics rules evaluate telemetry to raise detections; collecting logs alone is insufficient to identify a defined pattern. For the stated case, Defender for Office 365 Safe Attachments is the closer match. Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs.
C:Inspect VNet and subnet address plans, peering relationships and route tables. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Office 365 Safe Attachments is the closer match. Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs.
D:Inspect policy assignments, noncompliant resources and recommendation-to-remediation mappings. This item belongs to a different control area: Cloud security policies and recommendations. Its appropriate purpose is: A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources. For the stated case, Defender for Office 365 Safe Attachments is the closer match. Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs.
Question 806
A compliance director wants a numerical view of progress on assessed control improvements. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect score breakdown, applicable improvement actions and updates to action completion.
- Inspect policy indicators, generated alerts, case evidence and role-controlled access.
- Inspect Service Trust Portal document categories and available audit reports for the requested service.
- Inspect label configuration, policy publication or auto-application scope and labeled item status.
Explanation
Correct Answer
A:Inspect score breakdown, applicable improvement actions and updates to action completion. This is the relevant evidence check for this situation. Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee.
Incorrect Answers
B:Inspect policy indicators, generated alerts, case evidence and role-controlled access. This item belongs to a different control area: Insider risk management. Its appropriate purpose is: Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy. For the stated case, Compliance score is the closer match. Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee.
C:Inspect Service Trust Portal document categories and available audit reports for the requested service. This item belongs to a different control area: Service Trust Portal. Its appropriate purpose is: The Service Trust Portal offers Microsoft service assurance resources; customers remain responsible for their own compliance obligations. For the stated case, Compliance score is the closer match. Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee.
D:Inspect label configuration, policy publication or auto-application scope and labeled item status. This item belongs to a different control area: Retention labels. Its appropriate purpose is: Retention labels govern specific items; a broad location-level retention policy does not provide the same fine-grained labeling behavior. For the stated case, Compliance score is the closer match. Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee.
Question 807
A regulated company needs to view Azure configuration gaps grouped against a recognized control standard. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect portal incident queues, product-specific alerts, assets and investigation links.
- Inspect firewall policies, rule collections, traffic logs and routed connection paths.
- Inspect assigned compliance standards, evaluated controls and their associated resource assessments.
- Inspect Safe Attachments policy scope, file verdicts and attachment detection reports.
Explanation
Correct Answer
C:Inspect assigned compliance standards, evaluated controls and their associated resource assessments. This is the relevant evidence check for this situation. Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance.
Incorrect Answers
A:Inspect portal incident queues, product-specific alerts, assets and investigation links. This item belongs to a different control area: Microsoft Defender portal. Its appropriate purpose is: The Defender portal provides a unified security operations interface; it is not a replacement for configuring every underlying product. For the stated case, Defender for Cloud regulatory compliance is the closer match. Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance.
B:Inspect firewall policies, rule collections, traffic logs and routed connection paths. This item belongs to a different control area: Azure Firewall. Its appropriate purpose is: Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool. For the stated case, Defender for Cloud regulatory compliance is the closer match. Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance.
D:Inspect Safe Attachments policy scope, file verdicts and attachment detection reports. This item belongs to a different control area: Defender for Office 365 Safe Attachments. Its appropriate purpose is: Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs. For the stated case, Defender for Cloud regulatory compliance is the closer match. Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance.
Question 808
A cloud team needs a consolidated view of misconfigured resources across subscriptions. Which TWO steps together provide the most directly applicable response AND an evidence check for this specific requirement? Select TWO.
- Inspect session policy scope, controlled activities and matched cloud app session events.
- Use Microsoft Defender for Identity to detect suspicious identity activity involving supported on-premises Active Directory environments.
- Use Microsoft Defender for Cloud to review Azure and multicloud security posture and workload protection recommendations.
- Inspect asset inventory, secure score, alerts, plans and recommendations in Defender for Cloud.
- Malicious attachments are blocked or handled according to the configured action before users consume them.
Explanation
Correct Answers
C:Use Microsoft Defender for Cloud to review Azure and multicloud security posture and workload protection recommendations. This is the directly applicable response. Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group.
D:Inspect asset inventory, secure score, alerts, plans and recommendations in Defender for Cloud. This is the relevant evidence check for this situation. Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group.
Incorrect Answers
A:Inspect session policy scope, controlled activities and matched cloud app session events. This item belongs to a different control area: Defender for Cloud Apps session controls. Its appropriate purpose is: Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors. For the stated case, Defender for Cloud unified security posture is the closer match. Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group.
B:Use Microsoft Defender for Identity to detect suspicious identity activity involving supported on-premises Active Directory environments. This item belongs to a different control area: Defender for Identity. Its appropriate purpose is: Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog. For the stated case, Defender for Cloud unified security posture is the closer match. Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group.
E:Malicious attachments are blocked or handled according to the configured action before users consume them. This item belongs to a different control area: Defender for Office 365 Safe Attachments. Its appropriate purpose is: Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs. For the stated case, Defender for Cloud unified security posture is the closer match. Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group.
Question 809
An Azure server displays suspicious process behavior and the cloud team needs threat alerts for the workload. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Inspect incident timelines, alert evidence, related entities and assigned ownership.
- Inspect protected resource coverage, workload alerts, enabled plans and alert investigation evidence.
- Inspect VNet and subnet address plans, peering relationships and route tables.
- Inspect firewall policies, rule collections, traffic logs and routed connection paths.
Explanation
Correct Answer
B:Inspect protected resource coverage, workload alerts, enabled plans and alert investigation evidence. This is the relevant evidence check for this situation. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.
Incorrect Answers
A:Inspect incident timelines, alert evidence, related entities and assigned ownership. This item belongs to a different control area: Microsoft Sentinel incident investigation. Its appropriate purpose is: Incident management helps investigate and coordinate alerts; it differs from automatic enforcement through a playbook. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.
C:Inspect VNet and subnet address plans, peering relationships and route tables. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.
D:Inspect firewall policies, rule collections, traffic logs and routed connection paths. This item belongs to a different control area: Azure Firewall. Its appropriate purpose is: Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.
Question 810
A software team moves its application to Azure virtual machines and assumes Microsoft now patches the guest operating systems. Before changing configuration, which evidence should the team examine to assess THIS particular requirement?
- Review identities, sign-in activity, access entitlements and whether resource decisions use identity signals.
- Compare authentication records with resource permission grants and denied-operation logs.
- Inspect the service model and the tenant's IAM, application, data and guest-OS control assignments.
- Review the federation trust, issuer metadata, accepted tokens and sign-in transaction records.
Explanation
Correct Answer
C:Inspect the service model and the tenant's IAM, application, data and guest-OS control assignments. This is the relevant evidence check for this situation. Shared responsibility divides security obligations according to the cloud service model; provider data-center security does not replace tenant controls.
Incorrect Answers
A:Review identities, sign-in activity, access entitlements and whether resource decisions use identity signals. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Cloud shared responsibility is the closer match. Shared responsibility divides security obligations according to the cloud service model; provider data-center security does not replace tenant controls.
B:Compare authentication records with resource permission grants and denied-operation logs. This item belongs to a different control area: Authentication and authorization. Its appropriate purpose is: Authentication proves identity or possession of credentials; authorization determines what that identity may do. For the stated case, Cloud shared responsibility is the closer match. Shared responsibility divides security obligations according to the cloud service model; provider data-center security does not replace tenant controls.
D:Review the federation trust, issuer metadata, accepted tokens and sign-in transaction records. This item belongs to a different control area: Identity federation. Its appropriate purpose is: Federation extends authentication trust across security domains; it does not automatically grant unrestricted permissions. For the stated case, Cloud shared responsibility is the closer match. Shared responsibility divides security obligations according to the cloud service model; provider data-center security does not replace tenant controls.
