Free SC-900 practice questions

An organisation wants posture management in Defender for Cloud without paying for an extra plan. Which CSPM plan is enabled by default for onboarded subscriptions at no cost?

• ADefender CSPM, the paid plan that adds capabilities such as attack path analysis and risk prioritisation.
• BDefender for Servers, the paid plan that provides threat detection for Windows and Linux machines.
• CFoundational CSPM, the free plan enabled by default for onboarded subscriptions and accounts.check_circle Correct
• DDefender for Storage, the paid plan that protects storage accounts against malware and threats.

Why A is wrong: Defender CSPM is the paid plan that adds advanced features, so it is not the free option enabled by default that the scenario requires.

Why B is wrong: Defender for Servers is a workload protection plan for machines, not a CSPM plan, and it is a paid plan rather than the free posture option.

Why C is correct: Correct. The grounding states that Defender for Cloud offers two CSPM plans and that Foundational CSPM is free and enabled by default for all onboarded subscriptions and accounts, while Defender CSPM is the paid plan with extra capabilities.

Why D is wrong: Defender for Storage is a paid workload protection plan for storage accounts, not the free posture management plan enabled by default.

A team wants protection against malware, sensitive data leakage, and Shared Access Signature token misuse for their Azure storage accounts. Which Defender for Cloud plan addresses this?

• ADefender for Key Vault, which detects unusual attempts to access or exploit Key Vault accounts.
• BDefender for Resource Manager, which monitors resource management operations for harmful activity.
• CDefender for Storage, which protects against malware, sensitive data leakage, and token misuse.check_circle Correct
• DDefender for Databases, which provides attack detection and threat response for database types in Azure.

Why A is wrong: Defender for Key Vault protects Key Vault accounts, not storage accounts, so it does not address malware or Shared Access Signature token misuse on storage.

Why B is wrong: Defender for Resource Manager watches management operations rather than protecting storage accounts against malware and token misuse.

Why C is correct: Correct. The grounding states that Defender for Storage protects against malware, storage specific threats, sensitive data leakage, and Shared Access Signature token misuse.

Why D is wrong: Defender for Databases protects the database estate, not storage accounts, so it does not cover the storage specific threats described.

A malicious file is detected on an endpoint protected by Defender for Endpoint. In Defender XDR, what cross-product action does this trigger so the file is blocked across the suite?

• AIt opens a manual ticket and waits for an analyst to clear the file from mailboxes by hand.
• BIt quarantines only the single endpoint and takes no further action elsewhere in the suite.
• CIt instructs Defender for Office 365 to scan and remove that file from all email messages.check_circle Correct
• DIt disables the suite's automation until an administrator reviews and re-enables sharing.

Why A is wrong: The grounding describes automatic real-time sharing between products, not a manual ticket; relying on hand clearance contradicts the suite's automated response design.

Why B is wrong: Limiting action to one endpoint misses the cross-product point; the grounding describes the file being blocked across the entire Microsoft 365 security suite, not on one device.

Why C is correct: Correct. The grounding gives this exact example: if a malicious file is detected on an endpoint protected by Defender for Endpoint, it instructs Defender for Office 365 to scan and remove the file from all email messages, and the file is blocked on sight by the entire Microsoft 365 security suite.

Why D is wrong: Defender XDR shares critical threat information in real time to stop an attack; it does not disable its own automation and wait for re-enablement, which is the opposite of automatic response.

A new administrator asks what role Microsoft Entra ID plays within the Microsoft Entra product family. Which statement best describes Microsoft Entra ID?

• AIt is the foundational cloud-based identity and access management service for users, devices, and apps.check_circle Correct
• BIt is a managed domain service that provides group policy, LDAP, and Kerberos for legacy applications.
• CIt is a credential verification service for issuing decentralised verifiable credentials to users.
• DIt is the service that secures remote access to private apps, corporate networks, and multicloud resources.

Why A is correct: Correct. The grounding states Microsoft Entra ID is the foundational product of Microsoft Entra: a cloud-based identity and access management service that provides authentication, policy enforcement, and protection for users, devices, apps, and resources.

Why B is wrong: Group policy, LDAP, and Kerberos for legacy apps describe Microsoft Entra Domain Services, a separate product in the family, not Microsoft Entra ID itself.

Why C is wrong: Issuing decentralised verifiable credentials describes Microsoft Entra Verified ID, a different product, not the foundational identity and access management service.

Why D is wrong: Securing remote access to private apps and corporate networks describes Microsoft Entra Private Access, not the core identity and access management service.

A security lead is describing why an organisation adopts the Microsoft Entra product family. Which overall security strategy is the Microsoft Entra family designed to help organisations implement?

• AA flat network model that trusts all traffic once it is inside the corporate perimeter.
• BA Zero Trust security strategy that verifies identities and validates access conditions.check_circle Correct
• CA single sign-on only strategy that removes the need to check access conditions at all.
• DA backup and disaster recovery strategy focused on restoring lost data as quickly as possible.

Why A is wrong: Trusting all internal traffic is the implicit-trust perimeter model that Zero Trust replaces, so it is the opposite of what the family is built for.

Why B is correct: Correct. The grounding states Microsoft Entra is a family of identity and network access products that helps organisations implement a Zero Trust security strategy, used to verify identities, validate access conditions, check permissions, and monitor for compromise.

Why C is wrong: Removing access-condition checks contradicts the family's purpose, which explicitly includes validating access conditions and checking permissions.

Why D is wrong: Backup and disaster recovery is unrelated to the identity and network access focus of the Microsoft Entra family.

Several Azure virtual machines must all use the same identity to reach a shared storage account, and that identity must keep its permissions even when individual virtual machines are recycled. Which managed identity type fits this requirement?

• AA system-assigned managed identity, which is tied to one resource and deleted with it.
• BA service principal of the legacy type, created without an app registration.
• CA user-assigned managed identity, which can be shared across multiple Azure resources.check_circle Correct
• DAn application object, which is the global blueprint stored in the home tenant.

Why A is wrong: A system-assigned managed identity cannot be shared and is associated with only a single Azure resource, so it cannot serve several virtual machines at once.

Why B is wrong: A legacy service principal represents an old app without an app registration and is not the managed identity construct for sharing one identity across Azure compute resources.

Why C is correct: Correct. The grounding states a user-assigned managed identity is created as a stand-alone Azure resource with an independent life cycle and can be associated with more than one Azure resource, which is the recommended type for workloads where resources are recycled but permissions should stay consistent.

Why D is wrong: An application object is the global template for creating service principals, not an identity you assign to virtual machines to access a storage account.

An organisation wants Microsoft Purview to recognise a category of business content that simple keyword or pattern rules cannot reliably identify, by showing it examples to learn from. Which classification capability fits this need?

• AA sensitive information type, which matches predefined patterns such as bank account numbers.
• BA trainable classifier, which you train to recognise content by giving it samples.check_circle Correct
• CDocument fingerprinting, which recognises an item because it is a variation on a template.
• DExact data match, which detects the presence of specific exact strings.

Why A is wrong: A sensitive information type matches known patterns of data and is an automated pattern-matching method; it is not trained from samples the way a trainable classifier is.

Why B is correct: Correct. The grounding defines a Microsoft Purview trainable classifier as a tool you can train to recognise various types of content by giving it samples to evaluate, after which it can identify items for use in solutions such as Office sensitivity labels and retention label policies.

Why C is wrong: Document fingerprinting is an automated pattern-matching technique tied to a template; it does not learn a content category from sample documents.

Why D is wrong: Exact data match looks for specific exact strings and is a pattern-matching method, not a classifier you train by evaluating samples.

An administrator wants to review DLP events in Microsoft Purview, such as which labels were changed and which files matched a rule. According to the grounding, which tool shows this activity?

• AThe Classifiers page, where trainable classifiers are created and then managed.
• BActivity explorer, which has filters to view DLP events such as label changes.check_circle Correct
• CThe DLP Overview page, which shows policy sync status and overall device health.
• DContent Search, which finds items that have a specific retention label applied to them.

Why A is wrong: The Classifiers page is where you build and manage classifiers; it does not present the DLP activity events that the grounding attributes to Activity explorer.

Why B is correct: Correct. The grounding states that the Activity explorer tab on the DLP page has multiple filters to view DLP events, used to review activity such as what labels were changed, which files were modified, and which matched a rule, with the last 30 days available.

Why C is wrong: The DLP Overview page summarises policy sync, device status, and top activities; the per-event view of label changes and rule matches is in Activity explorer.

Why D is wrong: Content Search locates items by conditions such as a retention label; it does not list the DLP activity events described here.

A business wants to classify documents and emails and apply protection such as encryption and a visible watermark, with the protection staying attached to the file wherever it travels. Which Microsoft Purview capability provides this?

• ARetention labels, which set how long an item is kept and when it is permanently deleted.
• BSensitivity labels, which classify content and can apply encryption and markings.check_circle Correct
• CDLP policies, which monitor activities and block the inappropriate sharing of sensitive items.
• DSensitive information types, which match predefined patterns like credit card numbers.

Why A is wrong: Retention labels control how long content is retained and when it is deleted; they do not apply the encryption and content markings the scenario asks for.

Why B is correct: Correct. The grounding states that sensitivity labels from Microsoft Purview Information Protection let you classify and protect data, providing protection settings that include encryption and content markings such as headers, footers, and watermarks, and that the protection then stays with the content.

Why C is wrong: DLP policies detect and prevent oversharing of sensitive data; they do not classify a document and attach encryption and watermarks to it as a label does.

Why D is wrong: Sensitive information types identify data by matching patterns; they are an input to classification, not the label that applies encryption and markings.

A security architect is applying a defence in depth strategy so that a single failed control does not expose the whole system. Which TWO of the following are recognised layers of a defence in depth approach? Select TWO.

• AA physical security layer that restricts who can enter the datacentre and touch the hardware directly.check_circle Correct
• BA non-repudiation algorithm that mathematically guarantees no control can ever be bypassed.
• CAn identity and access layer that controls who can sign in and what they are permitted to reach.check_circle Correct
• DA shared responsibility layer that the cloud provider always owns in full on the customer's behalf.
• EA single perimeter firewall that, on its own, fully secures every resource behind it.

Why A is correct: Physical security is the outermost layer of defence in depth, controlling bodily access to facilities and devices.

Why B is wrong: Non-repudiation proves an action occurred and is not a defence in depth layer; no algorithm guarantees no control is bypassed.

Why C is correct: Identity and access is a core defence in depth layer governing authentication and access to resources.

Why D is wrong: Shared responsibility is a separate model, not a defence layer, and responsibility shifts by service type.

Why E is wrong: Relying on one perimeter contradicts defence in depth, which assumes any single layer can fail.

An instructor is explaining the cloud shared responsibility model. Which responsibility area stays with the customer across on-premises, IaaS, PaaS, and SaaS deployments alike?

• AData and identities, which the customer is responsible for protecting in every deployment type.check_circle Correct
• BThe physical hosts, which the customer is responsible for maintaining in every deployment type.
• CThe physical datacenter, which the customer is responsible for securing in every deployment type.
• DThe hypervisor layer, which the customer is responsible for managing in every deployment type.

Why A is correct: Correct. The grounding states that for all cloud deployment types you own your data and identities, and that data and accounts and access management are responsibilities you always retain regardless of the deployment type.

Why B is wrong: Physical hosts are a Microsoft responsibility in IaaS, PaaS, and SaaS; only on-premises leaves them with the customer, so they are not always retained.

Why C is wrong: Securing the physical datacenter shifts to Microsoft once you move to any cloud model, so it is not a responsibility the customer always retains.

Why D is wrong: The grounding lists the hypervisor as a Microsoft responsibility for the virtualization layer, so the customer does not retain it.

A developer wants to protect data while it travels between a client system and an Azure service over the public internet. Which mechanism described in the grounding provides this protection in transit?

• ATransparent Data Encryption, which encrypts the database data files in real time as they sit on disk.
• BTransport Layer Security, which gives authentication, message privacy, and integrity in transit.check_circle Correct
• CStorage Service Encryption, which encrypts blob and file data before it is written to storage.
• DCustomer-managed keys, which let you control and rotate the keys used to encrypt stored data.

Why A is wrong: Transparent Data Encryption protects database files at rest in real time, not data travelling between a client and a service, so it does not cover the transit case.

Why B is correct: Correct. The grounding states Microsoft gives customers the ability to use the Transport Layer Security protocol to protect data when it is travelling between cloud services and customers, and that TLS provides strong authentication, message privacy, and integrity.

Why C is wrong: Storage Service Encryption encrypts data at rest before it is stored, not data in motion between a client and a service.

Why D is wrong: Customer-managed keys are a key management option for encryption at rest, not a protocol that protects data as it travels in transit.