Microsoft SC-900 Practice Questions with Explanations

Correct answer: D

Compliance Score specifically measures an organization's progress in completing actions that reduce risks associated with data protection and regulatory compliance standards. It tracks improvements in security posture relative to regulatory requirements like GDPR, HIPAA, and ISO standards. Microsoft Secure Score focuses on general security improvements, Productivity Score measures organizational efficiency, and Azure Security Center Secure Score addresses infrastructure-level security risks.

Why the other options are wrong:

• A. Microsoft Secure Score measures general security improvements across Microsoft 365 and Azure, not specifically compliance and regulatory standards.
• B. Productivity Score measures organizational efficiency and user engagement, not compliance or risk reduction.
• C. Azure Security Center Secure Score focuses on infrastructure and resource-level security recommendations, not regulatory compliance tracking.

Correct answer: D

Connectors are the mechanism used to provide real-time integration between Azure Sentinel and other security sources, data sources, and applications. Connectors enable continuous data ingestion and synchronization from external systems into Azure Sentinel for analysis and threat detection. Azure AD Connect is for directory synchronization, Log Analytics workspaces are storage repositories, and Azure Information Protection is a data governance tool.

Why the other options are wrong:

• A. Azure AD Connect is used for synchronizing on-premises directories with Azure AD, not for integrating security sources with Sentinel.
• B. Log Analytics workspaces store and analyze data but are not the mechanism for real- time integration with external security sources.
• C. Azure Information Protection is a data classification and protection tool, unrelated to Sentinel integration with security sources.

Correct answer: C

The Microsoft Service Trust Portal is the dedicated resource that provides detailed information about how Microsoft cloud services comply with various regulatory standards including ISO, HIPAA, GDPR, SOC 2, and others. It contains compliance reports, audit findings, and trust documentation. Endpoint Manager is for device management, Cost Management is for billing analysis, and Azure AD admin center is for identity management.

Why the other options are wrong:

• A. Microsoft Endpoint Manager admin center is used for managing devices and applications, not for viewing regulatory compliance information.
• B. Azure Cost Management + Billing is for tracking and optimizing cloud spending, not for compliance documentation.
• D. The Azure Active Directory admin center manages user identities and access controls, not regulatory compliance information.

Correct answer: D

In the Azure shared responsibility model, Microsoft is solely responsible for managing the physical hardware, data centers, network infrastructure, and physical security. Customers are responsible for managing their own data, applications, user accounts, identities, and access permissions. Mobile device management, user permissions, and user account creation are customer responsibilities.

Why the other options are wrong:

• A. Mobile device management is a customer responsibility within the shared responsibility model.
• B. Permissions for user data stored in Azure are managed by the customer, not Microsoft.
• C. Creation and management of user accounts is the customer's responsibility in Azure deployments.

Correct answer: B

Encryption at rest specifically refers to encrypting data when it is stored or dormant on physical media. Encrypting a virtual machine disk is a classic example of encryption at rest, protecting stored data from unauthorized access. Site-to-site VPN encryption protects data in transit, HTTPS encryption is for data in transit over networks, and encrypted email protects data in transit during transmission.

Why the other options are wrong:

• A. Site-to-site VPN encryption protects data in transit between networks, not at rest.
• C. HTTPS encryption secures communications in transit, which is encryption in transit, not at rest.
• D. Sending encrypted email protects data during transmission, which is encryption in transit, not at rest.

Correct answer: A

Azure AD Privileged Identity Management (PIM) enables time-bound access elevation for administrative tasks, allowing organizations to grant users elevated permissions for a specific duration (such as a two-hour window). PIM is specifically designed for just-in-time privileged access. MFA is for authentication verification, Identity Protection is for anomalous sign-in detection, and conditional access enforces access policies but does not specifically provide time-limited administrative access windows.

Why the other options are wrong:

• B. Azure Multi-Factor Authentication verifies user identity through multiple factors but does not provide time-limited access windows for administrative tasks.
• C. Azure AD Identity Protection detects anomalous and risky sign-in patterns but does not provide time-limited administrative access.
• D. Conditional access policies enforce access rules and conditions but are not specifically designed for time-limited administrative task windows like PIM provides.

Correct answer: C

Azure AD Connect is the Microsoft tool designed specifically to synchronize identities between on-premises Active Directory Domain Services and Azure Active Directory. It enables hybrid identity management by ensuring consistent user accounts, groups, and contacts across both environments.

Why the other options are wrong:

• A. AD FS is used for federation and single sign-on, not for identity synchronization between AD DS and Azure AD.
• B. Microsoft Sentinel is a security information and event management (SIEM) solution, not an identity synchronization tool.
• D. Azure AD PIM is for privileged identity management and access control, not for syncing identities between directories.

Correct answer: D

Azure AD Password Protection prevents users from using weak passwords by maintaining a global banned password list and custom banned password lists specific to organizations. It blocks passwords containing common words, variations of the organization name, and other easily guessable terms.

Why the other options are wrong:

• A. Password expiration policies are controlled through separate password policy settings, not Password Protection specifically.
• B. Device access without MFA is controlled through conditional access policies, not Password Protection.
• C. Encryption of passwords is a security transport mechanism, not the purpose of Password Protection which focuses on preventing weak password choices.

Correct answer: A

Access reviews in Azure AD allow organizations to periodically review group memberships and automatically remove users who no longer require access. Reviewers can certify that users should remain members or remove them based on changed business requirements.

Why the other options are wrong:

• B. Managed identities are used for authenticating Azure services, not for evaluating and managing group membership.
• C. Conditional access policies control access based on conditions like location and device state, not group membership review and removal.
• D. Azure AD Identity Protection detects and responds to security risks, not for managing group memberships.

Correct answer: C

Azure AD Privileged Identity Management (PIM) provides just-in-time access to Azure resources by allowing administrators to request temporary activation of privileged roles with defined time limits. This minimizes standing administrative access and reduces security exposure.

Why the other options are wrong:

• A. Conditional access policies enforce access requirements based on conditions but do not provide time-bound role activation.
• B. Identity Protection detects and responds to identity-based risks rather than managing privileged access.
• D. Authentication method policies define which authentication methods users can use, not time-bound role activation.

Correct answer: C

Information barriers in Microsoft 365 allow organizations to restrict communication and information sharing between specific groups or departments. This compliance feature prevents cross-department collaboration when regulatory or business policies require separation.

Why the other options are wrong:

• A. Sensitivity label policies control how information is classified and protected, but do not restrict communication between departments.
• B. Customer Lockbox provides audit capabilities and approval controls for Microsoft personnel access, not for internal department separation.
• D. Privileged Access Management (PAM) controls elevated access to systems, not communication and information sharing between departments.

Correct answer: D

Azure AD Privileged Identity Management (PIM) is designed to implement approval-based, time-bound role activation. It enables organizations to grant temporary elevated permissions that expire automatically, require manager approval for activation, and maintain audit logs of all privileged access.

Why the other options are wrong:

• A. Windows Hello for Business is an authentication method for device logon, not for managing privileged role activation.
• B. Identity Protection detects and mitigates identity risks rather than managing approval- based role activation.
• C. Access reviews evaluate current group and role memberships but do not provide the approval and time-bound activation mechanisms required.

Correct answer: D

When you register an application with Azure AD, a service principal is created. The service principal is the identity object that represents the application within the Azure AD tenant, allowing the application to authenticate and receive permissions for accessing resources.

Why the other options are wrong:

• A. A user account is for human users, not applications.
• B. A user-assigned managed identity is a separate Azure resource for assigning identities to other Azure resources.
• C. A system-assigned managed identity is automatically created for Azure resources but is distinct from the identity created during app registration.

Correct answer: D

Network protection in Microsoft Defender for Endpoint provides the first line of defense by reducing the attack surface. It blocks malicious connections at the network level, preventing threats from reaching endpoints and protecting against network-based attacks before they can compromise systems.

Why the other options are wrong:

• A. Automated remediation responds to threats after detection, not as a first line of defense.
• B. Automated investigation analyzes and responds to detected threats, occurring after initial defense.
• C. Advanced hunting is used to proactively search for threats, not to prevent them initially.

Correct answer: C

Defense in depth is the security methodology that implements multiple layers of defense throughout a network infrastructure. This approach ensures that if one security layer is compromised, additional layers remain in place to protect assets, reducing overall risk through redundancy and diversity of controls.

Why the other options are wrong:

• A. Threat modeling is a process for identifying and analyzing potential security threats, not a layered defense strategy.
• B. Identity as the security perimeter is a modern security approach focusing on user and device verification rather than network perimeter defense.
• D. The shared responsibility model describes how cloud providers and customers divide security responsibilities, not a defense layering strategy.

Correct answer: A

Microsoft Defender for Office 365 provides the capability to scan email attachments for malware and forward them to recipients only if they are clean. This protects users from malware delivered via email and includes features like safe attachments that detonate files in a sandbox environment before delivery.

Why the other options are wrong:

• B. Microsoft Defender Antivirus protects endpoints but is not specifically designed for scanning email attachments in transit.
• C. Microsoft Defender for Identity focuses on detecting identity-based attacks and compromised credentials, not email attachment scanning.
• D. Microsoft Defender for Endpoint protects individual devices but is not the service used to scan email attachments at the email gateway level.

Correct answer: C

Azure Sentinel provides extended detection and response (XDR) capabilities through its integration with Microsoft 365 Defender, which allows it to correlate and analyze security signals from across Microsoft's security stack including endpoints, email, identity, and cloud apps. This integration enables comprehensive threat detection and response workflows.

Why the other options are wrong:

• A. Integration with Microsoft 365 compliance center relates to data governance and compliance, not XDR detection capabilities.
• B. Threat hunting is a separate feature for proactive investigation, not the primary XDR capability provider.
• D. Azure Monitor Workbooks are visualization tools for monitoring, not the core XDR feature.

Correct answer: C

Microsoft Defender for Cloud provides threat detection capabilities for Azure SQL Managed Instance through advanced threat protection features that monitor for suspicious activities and potential vulnerabilities, offering real-time security monitoring and alerts.

Why the other options are wrong:

• A. Microsoft Secure Score is a measurement tool for security posture, not a threat detection mechanism.
• B. Application security groups are network-level access control tools, not threat detection solutions.
• D. Azure Bastion provides secure remote access to virtual machines, not SQL threat detection.

Correct answer: C

Conditional access policies in Azure AD allow organizations to restrict access to corporate resources based on device compliance status, including Intune-managed device requirements. This enables enforcement of managed device policies before granting access.

Why the other options are wrong:

• A. Network security groups control network traffic but cannot enforce Intune device compliance requirements.
• B. Privileged Identity Management manages elevated access permissions, not device compliance restrictions.
• D. Resource locks prevent resource deletion or modification, not device-based access restrictions.

Correct answer: B

The Reports section in the Microsoft 365 Defender portal provides dashboards and visualizations for viewing security trends, tracking protection status across identities, devices, and applications, and monitoring the effectiveness of security controls.

Why the other options are wrong:

• A. Attack simulator is used for testing security awareness and defenses, not viewing security trends.
• C. Hunting is used for proactive threat investigation, not for viewing overall security status and trends.
• D. Incidents shows detected security events requiring response, not aggregate trends and protection status.

Correct answer: C

With a Microsoft 365 E3 subscription using Basic Audit, audit records in the unified audit log are retained for 90 days by default. This provides a standard retention period for compliance and security investigation purposes.

Why the other options are wrong:

• A. 15 days is too short for typical audit retention requirements in E3 licenses.
• B. 30 days is shorter than the standard 90-day retention period for Basic Audit.
• D. 180 days would apply to Advanced Audit or premium compliance configurations, not Basic Audit with E3.

Correct answer: C

Azure Bastion provides secure remote access to Azure virtual machines through the Azure portal using RDP or SSH protocols without requiring public IP addresses or VPN connections.

Why the other options are wrong:

• A. Azure Files is a cloud storage service that does not require Azure Bastion for secure access.
• B. Azure SQL Managed Instances are databases that use other security mechanisms and connection methods.
• D. Azure App Service is a web hosting service that uses different access mechanisms than Azure Bastion.

Correct answer: B

Azure Bastion provides secure remote access to Azure virtual machines through the Azure portal interface directly, eliminating the need for RDP/SSH clients or exposed public IP addresses. Users simply navigate to the VM in the portal and select Connect via Bastion.

Why the other options are wrong:

• A. PowerShell remoting requires direct network connectivity and is not the Azure Bastion connection method.
• C. While Remote Desktop Connection could technically work, Azure Bastion's primary interface is through the Azure portal without needing the RDP client.
• D. SSH clients may be used with Bastion for Linux VMs but the connection originates through the Azure portal, not directly via SSH.

Correct answer: C

Microsoft Defender for Endpoint alerts can be managed from the Microsoft 365 Defender portal. The portal provides centralized alert management for endpoint security incidents, allowing security teams to view, investigate, and respond to endpoint threats in a unified interface.

Why the other options are wrong:

• A. Microsoft Defender for Storage is an Azure-based service managed through the Azure portal, not the Microsoft 365 Defender portal.
• B. Microsoft Defender for SQL is managed through the Azure portal and SQL-specific interfaces, not primarily through Microsoft 365 Defender.
• D. Microsoft Defender for IoT is managed through Azure portals and IoT-specific management tools, not the Microsoft 365 Defender portal.

Correct answer: B

Information barrier policies are designed to restrict communication and collaboration between specific groups within an organization. The primary use case is preventing Microsoft Teams chats (and other collaboration) between defined user segments to maintain information silos, such as between competing business units or to ensure compliance with regulatory requirements.

Why the other options are wrong:

• A. Information barriers do not address unauthenticated access; authentication is handled by separate identity and access management mechanisms.
• C. While information barriers can affect Exchange email, the primary and most common use case is Teams chat restrictions, making this less complete than option B.
• D. Information barriers do not restrict sharing to external recipients; they restrict internal communication between specific groups within the organization.

Correct answer: B

Azure Blueprints enable you to deploy Azure resources across multiple subscriptions in a consistent and repeatable manner. Blueprints allow you to define a reusable set of Azure resources with policies and role assignments that can be deployed consistently across different subscriptions and environments.

Why the other options are wrong:

• A. Microsoft Defender for Cloud is a security posture management and threat protection service, not a resource deployment tool.
• C. Microsoft Sentinel is a cloud-native SIEM solution for security monitoring and threat detection, not for resource deployment.
• D. Azure Policy enforces compliance standards and governance rules but does not deploy resources across multiple subscriptions in a templated manner like Blueprints.