Microsoft SC-900 Online Practice Questions and Exam Preparation

Microsoft SC-900 Online Questions & Answers

• Question 211:

  What can you use to provide threat detection for Azure SQL Managed Instance?

  A. Microsoft Secure Score
  B. application security groups
  C. Microsoft Defender for Cloud
  D. Azure Bastion
  C. Microsoft Defender for Cloud

• Question 212:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

  ---

  Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication.

  Here are some of the benefits of using managed identities:

  You don't need to manage credentials. Credentials aren't even accessible to you.

  You can use managed identities to authenticate to any resource that supports Azure AD authentication, including your own applications.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

• Question 213:

  Which three tasks can be performed by using Azure Active Directory (Azure AD) Identity Protection? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Configure external access for partner organizations.
  B. Export risk detection to third-party utilities.
  C. Automate the detection and remediation of identity based-risks.
  D. Investigate risks that relate to user authentication.
  E. Create and automatically assign sensitivity labels to data.
  B. Export risk detection to third-party utilities.
  C. Automate the detection and remediation of identity based-risks.
  D. Investigate risks that relate to user authentication.

• Question 214:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

• Question 215:

  DRAG DROP

  Match the pillars of Zero Trust to the appropriate requirements.

  To answer, drag the appropriate pillar from the column on the left to its requirement on the right. Each pillar may be used once, more than once, or not at all.

  NOTE: Each correct match is worth one point.

  Select and Place:

  

  

  ---

  Box 1: Networks

  Network

  Ensure devices and users aren't trusted just because they're on an internal network. Encrypt all internal communications, limit access by policy, and employ microsegmentation and real-time threat detection.

  Box 2: Identities

  Identities

  Verify and secure each identity with strong authentication across your entire digital estate.

  Box 3: Data

  Data

  Move from perimeter-based data protection to data-driven protection. Use intelligence to classify and label data. Encrypt and restrict access based on organizational policies.

  References:

  https://www.microsoft.com/en-us/security/business/zero-trust

• Question 216:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Azure AD supports custom roles.

  Box 2: Yes

  Global Administrator has access to all administrative features in Azure Active Directory.

  Box 3: No

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/roles/concept-understand-roleshttps://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

• Question 217:

  Which Microsoft 365 feature can automatically apply protection to content based on detected sensitive information?

  A. Retention labels
  B. Sensitivity labels with auto-labeling
  C. Audit log search
  D. Insider risk management
  B. Sensitivity labels with auto-labeling

  ---

  Explanation

  Auto-labeling allows sensitivity labels to be applied automatically based on content inspection and predefined conditions.

• Question 218:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

  ---

  https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/whatis-fed

• Question 219:

  Which Microsoft 365 feature can block the sharing of sensitive information via email?

  A. Sensitivity labels
  B. Data loss prevention (DLP)
  C. Retention policies
  D. eDiscovery
  B. Data loss prevention (DLP)

  ---

  Explanation

  DLP policies help prevent accidental or intentional sharing of sensitive information by monitoring and blocking data transfers.

• Question 220:

  HOTSPOT

  You are implementing Microsoft Office 365 Message Encryption (OME) for a Microsoft 365 tenant named contoso.com.

  You need to meet the following requirements:

  1. All email to a domain named fabrikam.com must be encrypted automatically.

  2. Encrypted emails must expire seven days after they are sent.

  What should you configure for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.