Step2Study

Microsoft Security, Compliance, and Identity Fundamentals (SC-900) practice questions

310 free questions with answers and explanations.

Practice test
  1. 201.A small business is setting up its Microsoft Entra ID tenant. They want to enable their employees to use a single set of credentials to access multiple cloud applications, such as Microsoft 365, Salesforce, and Dropbox, without re-entering their username and password each time. Which Microsoft Entra capability enables this functionality?Describe the capabilities of Microsoft Entra
  2. 202.A regulatory body has mandated that a healthcare organization must be able to demonstrate that all changes to patient medical records are recorded, attributed to a specific user, and timestamped. This is crucial for verifying compliance and investigating incidents. Which security concept directly addresses this requirement?Describe the concepts of security, compliance, and identity
  3. 203.A multinational corporation uses Microsoft Entra ID and has a complex organizational structure. They want to delegate the management of user access to specific resources (e.g., SharePoint sites, applications) to individual department managers, allowing them to approve or deny access requests without IT intervention. Which Microsoft Entra capability should be used?Describe the capabilities of Microsoft Entra
  4. 204.A security analyst is reviewing logs to detect unusual login patterns, such as multiple failed login attempts from different geographic locations within a short period. The goal is to identify potential unauthorized access or brute-force attacks. Which security concept is the analyst applying?Describe the concepts of security, compliance, and identity
  5. 205.A company wants to allow its employees to securely access on-premises web applications from outside the corporate network without using a VPN. They need a Microsoft Entra capability that acts as a reverse proxy to publish these internal applications externally. Which capability should they use?Describe the capabilities of Microsoft Entra
  6. 206.A large multinational corporation with a complex on-premises Active Directory infrastructure needs to synchronize user identities, groups, and contacts from their on-premises environment to Microsoft Entra ID. They require a robust and reliable solution for hybrid identity. Which Microsoft Entra component is designed for this purpose?Describe the capabilities of Microsoft Entra
  7. 207.A security operations center (SOC) analyst observes a significant increase in sign-ins from unfamiliar locations and activities indicating potential credential compromise. The organization uses Microsoft Entra ID. They need a proactive solution that can detect these identity-related risks and automatically take action, such as blocking sign-ins or requiring password resets. Which Microsoft Entra capability should be implemented?Describe the capabilities of Microsoft Entra
  8. 208.A global enterprise needs to manage access to thousands of applications, both cloud-based and on-premises. They want to centralize the management of user access, provisioning, and single sign-on (SSO) for all these applications within Microsoft Entra ID. Which core Microsoft Entra capability is designed for this purpose?Describe the capabilities of Microsoft Entra
  9. 209.A security administrator needs to configure Microsoft Entra ID to automatically revoke access for users who have been inactive for a specified period and require re-approval to regain access. Which Microsoft Entra governance capability can achieve this?Describe the capabilities of Microsoft Entra
  10. 210.A financial institution needs to provision user accounts and synchronize their attributes from Microsoft Entra ID to a newly adopted cloud-based HR application (SaaS) and ensure that changes made in Entra ID are automatically reflected in the HR app. Which Microsoft Entra capability automates this identity provisioning?Describe the capabilities of Microsoft Entra
  11. 211.A large pharmaceutical company needs to ensure that only specific individuals in their research and development department can view highly confidential drug formulas. Access should be controlled based on their job title and department, not individual user accounts directly. Which access control model is most appropriate for this requirement?Describe the concepts of security, compliance, and identity
  12. 212.A security architect is designing a system for a critical infrastructure company. They need to ensure that the system can withstand significant cyberattacks and continue to operate, albeit potentially in a degraded state, without complete failure. Which security principle is being prioritized here?Describe the concepts of security, compliance, and identity
  13. 213.A security architect is designing an identity solution for a company that requires users to securely access on-premises web applications from outside the corporate network, without using a VPN. Which Microsoft Entra capability can provide this secure remote access?Describe the capabilities of Microsoft Entra
  14. 214.A small business is concerned about the impact of a potential ransomware attack. They want to implement a security measure that ensures even if their primary systems are infected and data is encrypted, they can restore their operations quickly without paying a ransom. Which core security principle is being directly addressed by this strategy?Describe the concepts of security, compliance, and identity
  15. 215.A global consulting firm uses Microsoft Entra ID and has a policy requiring that all users, especially those in administrative roles, confirm their identity using at least two different authentication factors before accessing sensitive corporate resources. Which Microsoft Entra capability should be configured to enforce this policy?Describe the capabilities of Microsoft Entra
  16. 216.A regulatory body requires that an organization must be able to demonstrate that its data processing activities comply with data privacy laws and that all access to sensitive information is logged for retrospective analysis. Which security concept is primarily being addressed by this requirement?Describe the concepts of security, compliance, and identity
  17. 217.A company is migrating several legacy applications to Azure. These applications rely heavily on traditional LDAP and Kerberos authentication, and re-writing them is not feasible. The company needs to provide managed domain services in Azure to support these applications. Which Microsoft Entra capability should they use?Describe the capabilities of Microsoft Entra
  18. 218.A financial institution is implementing a new system for managing customer accounts. They need to ensure that customer data remains unreadable to unauthorized parties, even if the storage system is breached. What security concept directly addresses this requirement?Describe the concepts of security, compliance, and identity
  19. 219.A global enterprise needs to manage access for its employees across various cloud services and on-premises applications. They want a centralized system that allows them to define user identities and their corresponding access rights uniformly, and then synchronize these identities and rights across all connected systems. Which identity concept best describes this requirement?Describe the concepts of security, compliance, and identity
  20. 220.A financial institution needs to secure access to its core banking applications. They want to ensure that even if an attacker gains access to a user's password, they still cannot access the system without a second verification step, such as a code from a mobile app or a biometric scan. Which identity security control is being described?Describe the concepts of security, compliance, and identity
  21. 221.A compliance administrator wants to quickly assess the organization's current compliance posture against various regulations and industry standards. They need a centralized dashboard that provides actionable insights and tracks progress. Which Microsoft Purview capability should they use?Describe the capabilities of Microsoft compliance solutions
  22. 222.A multinational corporation needs to categorize and protect a large volume of unstructured data, including documents and emails, based on its sensitivity. They want to automate the application of labels like 'Confidential HR' or 'Public' to content without manual intervention, and then enforce protection policies based on these labels. Which Microsoft Purview capability is most effective for this automation?Describe the capabilities of Microsoft compliance solutions
  23. 223.A financial services company needs to identify and protect highly sensitive customer financial data, such as credit card numbers and bank account details, across all their Microsoft 365 services. They want a solution that can automatically detect and label this data, and also prevent its unauthorized sharing. Which Microsoft Purview capability is best suited for this requirement?Describe the capabilities of Microsoft compliance solutions
  24. 224.A legal department frequently handles litigation cases that require collecting vast amounts of electronic information from various sources, including emails, documents, and chat messages. They need a solution that can efficiently identify, collect, preserve, and review this data for legal proceedings. Which Microsoft Purview capability is best suited for this task?Describe the capabilities of Microsoft compliance solutions
  25. 225.A compliance officer at a financial institution needs to demonstrate to auditors that the organization adheres to strict regulatory requirements regarding data residency and data handling. They want to access official documentation and certifications from Microsoft that validate Microsoft 365's compliance posture. Which Microsoft Purview feature or portal provides this information?Describe the capabilities of Microsoft compliance solutions
  26. 226.An organization is concerned about potential data exfiltration by employees nearing termination. They want to identify unusual activities like mass downloads to USB drives or access to sensitive files outside of normal working hours, and receive alerts to investigate these behaviors. Which Microsoft Purview capability is most suitable for this scenario?Describe the capabilities of Microsoft compliance solutions
  27. 227.An HR department wants to ensure that employees do not share confidential salary information or performance reviews with unauthorized individuals, particularly outside the HR team. They need a solution that can automatically detect and block such sharing attempts within Microsoft Teams and Outlook. Which Microsoft Purview capability should they implement?Describe the capabilities of Microsoft compliance solutions
  28. 228.A pharmaceutical company is conducting a clinical trial and needs to ensure that all research data, including patient information, is accessible only to authorized research team members. They also need to restrict communication between the research team and the marketing department to prevent premature disclosure of trial results. Which Microsoft Purview capability can enforce these communication restrictions?Describe the capabilities of Microsoft compliance solutions
  29. 229.A financial institution is subject to strict regulatory requirements, including the need to prevent information leakage between specific groups of employees, such as traders and advisors, to avoid conflicts of interest. Which Microsoft Purview solution can enforce these digital communication barriers?Describe the capabilities of Microsoft compliance solutions
  30. 230.A university is concerned about students sharing copyrighted material or engaging in academic dishonesty through their Microsoft 365 accounts. They want to proactively identify and investigate patterns of potentially risky behavior, such as unusual download activity or suspicious sharing of files, especially around exam periods. Which Microsoft Purview capability is designed to address these concerns?Describe the capabilities of Microsoft compliance solutions
  31. 231.A global enterprise needs to ensure that all email communications related to specific projects are retained for seven years, regardless of where they are stored within Microsoft 365. After this period, the emails must be automatically deleted to comply with data minimization principles. Which Microsoft Purview capability is most appropriate for this task?Describe the capabilities of Microsoft compliance solutions
  32. 232.A multinational corporation frequently engages in mergers and acquisitions. During due diligence, they often need to quickly identify and collect all relevant communications and documents from specific custodians across Exchange Online mailboxes, SharePoint Online sites, and Microsoft Teams for legal review. This process must be defensible and auditable. Which Microsoft Purview capability is designed to facilitate this complex data collection and review for legal purposes?Describe the capabilities of Microsoft compliance solutions
  33. 233.A legal team needs to monitor all internal and external communication channels (email, Microsoft Teams chats, Yammer) for specific keywords related to harassment, discrimination, or confidential project names. They need to be able to flag these communications for review by designated compliance officers and ensure appropriate action is taken. Which Microsoft Purview capability provides this oversight and review capability?Describe the capabilities of Microsoft compliance solutions
  34. 234.A company is concerned about its employees inadvertently sharing sensitive customer data on social media platforms or other non-sanctioned communication channels. They want to proactively detect and block such sharing attempts from within their Microsoft 365 environment. While Data Loss Prevention (DLP) can detect sensitive data, which specific capability within Microsoft Purview extends DLP to cover a broader range of third-party platforms and provides insights into data movement across the digital estate?Describe the capabilities of Microsoft compliance solutions
  35. 235.An organization is concerned about potential insider risks, specifically the exfiltration of intellectual property by departing employees. They want to implement a solution that can detect unusual data download activities, email forwarding, and file renaming by users who have recently resigned. Which Microsoft Purview capability is best suited for this scenario?Describe the capabilities of Microsoft compliance solutions
  36. 236.A company is implementing a new policy that requires all email communications containing financial forecasts to be retained for 10 years, while ensuring that all other marketing-related emails are deleted after 1 year. This needs to apply consistently across Exchange Online and SharePoint Online. Which Microsoft Purview capability is most effective for this granular, automated information lifecycle management?Describe the capabilities of Microsoft compliance solutions
  37. 237.An organization is using Microsoft Purview to manage its compliance posture. They need a centralized dashboard that provides a clear overview of their compliance score, recommended actions to improve compliance, and the ability to track progress against various regulatory standards like GDPR and ISO 27001. Which Microsoft Purview feature offers this comprehensive compliance management view?Describe the capabilities of Microsoft compliance solutions
  38. 238.A compliance officer needs to provide evidence to an auditor about Microsoft's security practices, compliance certifications, and privacy commitments for the cloud services their organization uses. They require access to official audit reports, whitepapers, and FAQs. Which portal should the compliance officer access?Describe the capabilities of Microsoft compliance solutions
  39. 239.A small business is using Microsoft 365 and wants to understand Microsoft's commitment to data privacy and compliance. They need to find official documentation and reports that detail how Microsoft handles data, security, and regulatory adherence. Which Microsoft Purview tool should they use to access this information?Describe the capabilities of Microsoft compliance solutions
  40. 240.A pharmaceutical company is subject to strict regulatory requirements, including the need to prevent certain research teams from communicating with specific sales teams to avoid potential conflicts of interest or inappropriate information sharing. This restriction must be enforced at the communication level within Microsoft Teams, SharePoint, and Exchange Online. Which Microsoft Purview capability is designed to establish and enforce these organizational communication boundaries?Describe the capabilities of Microsoft compliance solutions
  41. 241.A healthcare provider is required by HIPAA regulations to maintain patient records for a minimum of 7 years and ensure they are immutably preserved during this period, even if users attempt to delete them. After 7 years, these records must be automatically disposed of. Which Microsoft Purview capability should be implemented to meet these specific requirements for both retention and disposal?Describe the capabilities of Microsoft compliance solutions
  42. 242.A compliance officer needs to monitor internal communications within Microsoft Teams and Exchange Online for potential harassment, discrimination, or other policy violations. The goal is to proactively identify and review messages that contain sensitive language or violate company conduct policies, without infringing on legitimate privacy. Which Microsoft Purview solution should be deployed?Describe the capabilities of Microsoft compliance solutions
  43. 243.A healthcare organization needs to ensure that all patient records are retained for a minimum of 7 years as mandated by HIPAA, and then securely disposed of. They also need to ensure that some specific financial records are retained permanently. Which Microsoft Purview capability primarily supports these requirements?Describe the capabilities of Microsoft compliance solutions
  44. 244.A global company operates in multiple regions, each with distinct data residency and privacy regulations. They need to categorize and label documents containing personally identifiable information (PII) so that appropriate retention and access policies can be automatically applied, regardless of where the data is stored within Microsoft 365. Which Microsoft Purview capability enables this automatic classification and policy application?Describe the capabilities of Microsoft compliance solutions
  45. 245.A legal department needs to ensure that all email communications related to specific projects are preserved for 10 years, regardless of whether employees try to delete them. Additionally, they need to be able to place a legal hold on these communications if a lawsuit arises, making them discoverable. This must apply to both current and future emails. Which Microsoft Purview capability allows for the creation of immutable retention policies and supports legal holds across Exchange Online?Describe the capabilities of Microsoft compliance solutions
  46. 246.A global manufacturing company needs to ensure that sensitive intellectual property (IP) contained in design documents is not inadvertently shared outside the organization. They also need to classify these documents so that only authorized personnel can access them, regardless of where they are stored or shared. Which Microsoft Purview capability best addresses these requirements?Describe the capabilities of Microsoft compliance solutions
  47. 247.A large enterprise is migrating a vast amount of legacy data from on-premises file shares and third-party cloud storage solutions into Microsoft 365. They need to ensure that this ingested data is automatically scanned for sensitive information (e.g., healthcare records, intellectual property) and that appropriate retention labels are applied according to corporate policy, even before users interact with it. Which Microsoft Purview capability, in conjunction with Data Lifecycle Management, can achieve this automated scanning and labeling of ingested data?Describe the capabilities of Microsoft compliance solutions
  48. 248.A global organization is concerned about employees accidentally or maliciously sharing sensitive customer data, such as credit card numbers or personally identifiable information (PII), with unauthorized external parties. They need a solution that can identify this sensitive information in emails, chat messages, and documents, and then prevent it from being shared outside the organization. Which Microsoft Purview capability directly addresses this need?Describe the capabilities of Microsoft compliance solutions
  49. 249.A data privacy officer needs a centralized view of personal data within the organization's Microsoft 365 environment, including where it resides, who has access to it, and its classification. They want to identify potential privacy risks, such as overexposed PII in SharePoint sites. Which Microsoft Purview capability provides this comprehensive data mapping and insights?Describe the capabilities of Microsoft compliance solutions
  50. 250.A company is implementing Microsoft Purview and needs to ensure that sensitive financial data, such as credit card numbers, is not inadvertently shared outside the organization. Which Microsoft Purview capability should they configure to automatically detect and prevent this type of data exfiltration?Describe the capabilities of Microsoft compliance solutions