Microsoft Fundamentals SC-900 Questions & Answers

• Question 171:

  What is a use case for implementing information barrier policies in Microsoft 365?

  A. to restrict unauthenticated access to Microsoft 365

  B. to restrict Microsoft Teams chats between certain groups within an organization

  C. to restrict Microsoft Exchange Online email between certain groups within an organization

  D. to restrict data sharing to external email recipients

  Correct Answer: B

  Information barriers are supported in Microsoft Teams, SharePoint Online, and OneDrive for Business. A compliance administrator or information barriers administrator can define policies to allow or prevent communications between groups of users in Microsoft Teams. Information barrier policies can be used for situations like these:

• Question 172:

  Which two tasks can you implement by using data loss prevention (DLP) policies in Microsoft 365? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. Display policy tips to users who are about to violate your organization's policies.

  B. Enable disk encryption on endpoints.

  C. Protect documents in Microsoft OneDrive that contain sensitive information.

  D. Apply security baselines to devices.

  Correct Answer: AC

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide

• Question 173:

  What is the purpose of Azure Active Directory (Azure AD) Password Protection?

  A. to control how often users must change their passwords

  B. to identify devices to which users can sign in without using multi-factor authentication (MFA)

  C. to encrypt a password by using globally recognized encryption standards

  D. to prevent users from using specific words in their passwords

  Correct Answer: D

  Azure AD Password Protection detects and blocks known weak passwords and their variants, and can also block additional weak terms that are specific to your organization.

  With Azure AD Password Protection, default global banned password lists are automatically applied to all users in an Azure AD tenant. To support your own business and security needs, you can define entries in a custom banned password list.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-password-ban-bad-on-premises

• Question 174:

  Which Azure Active Directory (Azure AD) feature can you use to evaluate group membership and automatically remove users that no longer require membership in a group?

  A. access reviews

  B. managed identities

  C. conditional access policies

  D. Azure AD Identity Protection

  Correct Answer: A

  Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

• Question 175:

  Which Azure Active Directory (Azure AD) feature can you use to provide just-in-time (JIT) access to manage Azure resources?

  A. conditional access policies

  B. Azure AD Identity Protection

  C. Azure AD Privileged Identity Management (PIM)

  D. authentication method policies

  Correct Answer: C

  Azure AD Privileged Identity Management (PIM) provides just-in-time privileged access to Azure AD and Azure resources

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

• Question 176:

  What should you use in the Microsoft 365 security center to view security trends and track the protection status of identities?

  A. Attack simulator

  B. Reports

  C. Hunting

  D. Incidents

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/reports-and-insights-in-security-and-compliance?view=o365-worldwide

• Question 177:

  What are two capabilities of Microsoft Defender for Endpoint? Each correct selection presents a complete solution. NOTE: Each correct selection is worth one point.

  A. automated investigation and remediation

  B. transport encryption

  C. shadow IT detection

  D. attack surface reduction

  Correct Answer: AD

  Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide

• Question 178:

  Which Microsoft 365 compliance center feature can you use to identify all the documents on a Microsoft SharePoint Online site that contain a specific key word?

  A. Audit

  B. Compliance Manager

  C. Content Search

  D. Alerts

  Correct Answer: C

  The Content Search tool in the Security and Compliance Center can be used to quickly find email in Exchange mailboxes, documents in SharePoint sites and OneDrive locations, and instant messaging conversations in Skype for Business.

  The first step is to starting using the Content Search tool to choose content locations to search and configure a keyword query to search for specific items.

  Reference:

  https://docs.microsoft.com/en-us/microsoft-365/compliance/search-for-content?view=o365-worldwide

• Question 179:

  In a hybrid identity model, what can you use to sync identities between Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD)?

  A. Active Directory Federation Services (AD FS)

  B. Azure Sentinel

  C. Azure AD Connect

  D. Azure Ad Privileged Identity Management (PIM)

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-azure-ad-connect

• Question 180:

  In the shared responsibility model for an Azure deployment, what is Microsoft solely responsible for managing?

  A. the management of mobile devices

  B. the permissions for the user data stored in Azure

  C. the creation and management of user accounts

  D. the management of the physical hardware

  Correct Answer: D