Microsoft SC-900 Online Practice Questions and Exam Preparation

Microsoft SC-900 Online Questions & Answers

• Question 31:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

• Question 32:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

  ---

  Azure Active Directory (Azure AD) is a cloud-based user identity and authentication service.

  References:

  https://docs.microsoft.com/en-us/microsoft-365/enterprise/about-microsoft-365-identity?view=o365-worldwide

• Question 33:

  Which Azure Active Directory (Azure AD) feature can you use to evaluate group membership and automatically remove users that no longer require membership in a group?

  A. access reviews
  B. managed identities
  C. conditional access policies
  D. Azure AD Identity Protection
  A. access reviews

  ---

  Explanation

  Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

• Question 34:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

  ---

  When you register an application through the Azure portal, an application object and service principal are automatically created in your home directory or tenant.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal

• Question 35:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Select authentication methods and registration options.

  When users need to unlock their account or reset their password, they're prompted for another confirmation method. This extra authentication factor makes sure that Azure AD finished only approved SSPR events. You can choose which authentication methods to allow, based on the registration information the user provides.

  The following authentication methods are available for SSPR:

  Mobile app notification

  Mobile app code

  * Email

  Mobile phone

  Office phone (available only for tenants with paid subscriptions) Security questions

  Box 2: Yes

  The following authentication methods are available for SSPR:

  * Mobile app notification (Authenticator app)

  Mobile app code

  Email

  Mobile phone

  Office phone (available only for tenants with paid subscriptions) Security questions

  Note: The Authenticator app can't be selected as the only authentication method when only one method is required. Similarly, the Authenticator app and only one additional method cannot be selected when requiring two methods.

  When configuring SSPR policies that include the Authenticator app as a method, at least one additional method should be selected when one method is required, and at least two additional methods should be selected when configuring two methods are required.

  This requirement is because the current SSPR registration experience doesn't include the option to register the authenticator app. The option to register the authenticator app is included with the new combined registration experience.

  Allowing policies that only use the Authenticator app (when one method is required), or the Authenticator app and only one additional method (when two methods are required), could lead to users being blocked from registering for SSPR until they're configured to use the new combined registration experience.

  Box 3: No

  How does the password reset process work?

  A user can reset or change their password using the SSPR portal. They must first have registered their desired authentication methods. When a user accesses the SSPR portal, the Azure platform considers the following factors:

  How should the page be localized?

  Is the user account valid?

  What organization does the user belong to?

  Where is the user's password managed?

  After the SSPR portal is displayed in the required language, the user is prompted to enter a user ID and pass a captcha. Azure AD now verifies that the user is able to use SSPR by doing the following checks:

  * Checks that the user has SSPR enabled

  * Checks that the user has the right authentication methods defined on their account in accordance with administrator policy.

  * Checks to see if the user's password is managed on-premises, such as if the Azure AD tenant is using federated, pass-through authentication, or password hash synchronization

  If all of the previous checks are successfully completed, the user is guided through the process to reset or change their password.

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks

• Question 36:

  Which Azure service provides centralized secret management?

  A. Azure Policy
  B. Azure Key Vault
  C. Azure Monitor
  D. Azure Bastion
  B. Azure Key Vault

  ---

  Explanation

  Azure Key Vault securely stores and manages secrets, keys, and certificates used by applications and services.

• Question 37:

  What is a key characteristic of cloud security under the shared responsibility model?

  A. The provider manages all security aspects
  B. The customer manages all security aspects
  C. Security responsibilities are shared between provider and customer
  D. Security is optional for customers
  C. Security responsibilities are shared between provider and customer

  ---

  Explanation

  The shared responsibility model defines that cloud providers and customers each have specific security responsibilities depending on the service model.

• Question 38:

  DRAG DROP

  Match the Microsoft Purview Insider Risk Management workflow step to the appropriate task.

  To answer, drag the appropriate step from the column on the left to its task on the right. Each step may be used once, more than once, or not at all.

  NOTE: Each correct match is worth one point.

  Select and Place:

  

  

  ---

  Box 1: Triage

  New user activities that need investigation automatically generate alerts that are assigned a Needs review status. Reviewers can quickly identify and review, evaluate, and triage these alerts.

  Alerts are resolved by opening a new case, assigning the alert to an existing case, or dismissing the alert. Using alert filters, it's easy to quickly identify alerts by status, severity, or time detected. As part of the triage process, reviewers can view alert details for the activities identified by the policy, view user activity associated with the policy match, see the severity of the alert, and review user profile information.

  Box 2: Investigate

  Investigate

  Quickly investigate all activities for a selected user with User activity reports (preview). These reports allow investigators in your organization to examine activities for specific users for a defined time period without having to assign them temporarily or explicitly to an insider risk management policy. After examining activities for a user, investigators can dismiss individual activities as benign, share or email a link to the report with other investigators, or choose to assign the user temporarily or explicitly to an insider risk management policy.

  Cases are created for alerts that require deeper review and investigation of the activity details and circumstances around the policy match.

  Box 3: Action

  After cases are investigated, reviewers can quickly act to resolve the case or collaborate with other risk stakeholders in your organization. If users accidentally or inadvertently violate policy conditions, a simple reminder notice can be sent to the user from notice templates you can customize for your organization. These notices may serve as simple reminders or may direct the user to refresher training or guidance to help prevent future risky behavior.

  References:

  https://docs.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management

• Question 39:

  Which two tasks can you implement by using data loss prevention (DLP) policies in Microsoft 365? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Display policy tips to users who are about to violate your organization's policies.
  B. Enable disk encryption on endpoints.
  C. Protect documents in Microsoft OneDrive that contain sensitive information.
  D. Apply security baselines to devices.
  A. Display policy tips to users who are about to violate your organization's policies.
  C. Protect documents in Microsoft OneDrive that contain sensitive information.

  ---

  Explanation

  References:

  https://docs.microsoft.com/en-us/microsoft-365/compliance/dlp-learn-about-dlp?view=o365-worldwide

• Question 40:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  Software tokens is a time-based one-time passcodes (TOTP) solution.

  Microsoft Authenticator, which is a passwordless solution, uses software tokens though.

  Note: Authentication methods in Azure Active Directory - OATH tokens OATH TOTP (Time-based One Time Password) is an open standard that specifies how one-time password (OTP) codes are generated. OATH TOTP can be implemented using either software or hardware to generate the codes. Azure AD doesn't support OATH HOTP, a different code generation standard.

  OATH software tokens

  Software OATH tokens are typically applications such as the Microsoft Authenticator app and other authenticator apps. Azure AD generates the secret key, or seed, that's input into the app and used to generate each OTP.

  Box 2: Yes

  Each organization has different needs when it comes to authentication. Microsoft global Azure and Azure Government offer the following three passwordless authentication options that integrate with Azure Active Directory (Azure AD):

  Windows Hello for Business Microsoft Authenticator FIDO2 security keys

  Box 3: Yes

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordlesshttps://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-oath-tokens