
Simulate the real exam experience with 50 questions and a 45-minute time limit. Practice with AI-verified answers and detailed explanations.
AI-Powered
Every answer is cross-verified by 3 leading AI models to ensure maximum accuracy. Get detailed per-option explanations and in-depth question analysis.
HOTSPOT - Select the answer that correctly completes the sentence. Hot Area:
______ a file makes the data in the file readable and usable to viewers that have the appropriate key.
Correct answer: D. Encrypting. Encrypting a file converts readable plaintext into unreadable ciphertext using an encryption algorithm and a cryptographic key. Only viewers (users, services, or applications) that have the appropriate key (and permission to use it) can decrypt the file and make the data readable and usable again. This directly matches the sentence’s wording: “readable and usable to viewers that have the appropriate key.” Why the other options are wrong: - A. Archiving: Typically bundles files and/or moves them to long-term storage (for retention, backup, or compliance). Archived data may still be readable without any key unless it is also encrypted. - B. Compressing: Reduces file size by encoding data more efficiently. Compressed files are still readable by anyone who can decompress them; no cryptographic key is inherently required. - C. Deduplicating: Eliminates duplicate data blocks to save storage. It changes how data is stored, not who can read it. Exam tip: if a question mentions “key,” “ciphertext,” “decrypt,” or “only authorized viewers can read,” it’s pointing to encryption.
HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:
You can create custom roles in Azure Active Directory (Azure AD).
Yes. You can create custom roles in Azure Active Directory (Microsoft Entra ID). These are commonly referred to as custom directory roles. They allow you to define a role with a specific set of permissions (directory-level permissions) rather than relying only on built-in roles like User Administrator or Security Administrator. This supports least privilege by granting only the exact permissions required for a job function. Why “No” is incorrect: Entra ID is not limited to only built-in roles. While many organizations start with built-in roles, custom roles are available to meet more granular administrative needs. Note the common exam trap: don’t confuse Entra ID custom directory roles with Azure RBAC custom roles. Both exist, but they apply to different scopes (directory vs Azure resources). The statement is still true because it explicitly says “in Azure AD.”
Global administrator is a role in Azure Active Directory (Azure AD).
Yes. Global administrator is a role in Azure Active Directory (Microsoft Entra ID). It is the highest-privileged directory role and has broad permissions across the tenant, including managing users, groups, app registrations, and many tenant-wide settings. Because of its power, best practice is to minimize the number of Global administrators, use dedicated admin accounts, and protect them with strong authentication (MFA) and privileged access controls. Why “No” is incorrect: Global administrator is one of the most fundamental built-in Entra ID roles and is frequently referenced in Microsoft identity documentation and exam objectives. Another common confusion is with Azure subscription roles (Owner/Contributor), but Global administrator is specifically a directory role, not an Azure resource RBAC role.
An Azure Active Directory (Azure AD) user can be assigned only one role.
No. An Azure AD (Microsoft Entra ID) user can be assigned multiple roles. Role assignments are not limited to a single role per user. For example, a user could be both a User Administrator and an Application Administrator, or hold additional roles for security and compliance operations. This flexibility supports real-world operational needs but must be governed carefully to avoid excessive privilege. Why “Yes” is incorrect: Entra ID role-based access is designed to be additive. Limiting users to only one role would be impractical and would force organizations into overly broad roles. From a security best-practice perspective, you should still follow least privilege and separation of duties, but the platform capability absolutely allows multiple role assignments (directly or via group-based role assignment where supported).
Want to practice all questions on the go?
Download Cloud Pass for free — includes practice tests, progress tracking & more.


Want to practice all questions on the go?
Get the free app
Download Cloud Pass for free — includes practice tests, progress tracking & more.
HOTSPOT - Select the answer that correctly completes the sentence. Hot Area:
With Windows Hello for Business, a user’s biometric data used for authentication ______
Correct answer: B. With Windows Hello for Business, a user’s biometric data (the biometric template) is stored on the local device only. The biometric is used as a local gesture to unlock a cryptographic key (typically protected by the TPM). Azure AD/Entra ID does not receive or store the biometric template; it only has the associated public key information needed to validate authentication. Why the others are wrong: A is incorrect because WHfB does not store biometric data on an external device as the standard model; the template is kept on the device where enrollment occurred. C is incorrect because Azure AD does not store biometric templates; storing biometrics centrally would increase privacy and breach risk. D is incorrect because biometric templates are not replicated across a user’s devices. Each device has its own local biometric enrollment and its own key material registration.
HOTSPOT - Select the answer that correctly completes the sentence. Hot Area:
Azure Active Directory (Azure AD) is ______ used for authentication and authorization.
Correct answer: B. an identity provider. Azure Active Directory (Azure AD), now branded as Microsoft Entra ID, is Microsoft’s cloud identity provider (IdP) and identity and access management service. It performs authentication (validating credentials and sign-in) and supports authorization by issuing security tokens (for example, OAuth 2.0/OpenID Connect/SAML tokens) containing claims that applications and Azure services use to grant access. It also integrates with Conditional Access, MFA, and RBAC to enforce access decisions. Why the others are wrong: A (XDR system): XDR (e.g., Microsoft Defender XDR) correlates and responds to threats across endpoints, identities, email, and apps; it is not the service that authenticates users. C (management group): Management groups are an Azure governance hierarchy for organizing subscriptions and applying policy/RBAC at scale; they don’t provide authentication. D (SIEM system): SIEM (e.g., Microsoft Sentinel) collects and analyzes logs/events for security monitoring and incident response; it doesn’t act as the IdP for sign-in and token issuance.
HOTSPOT - Select the answer that correctly completes the sentence. Hot Area:
You can use ______ in the Microsoft 365 security center to view an aggregation of alerts that relate to the same attack.
Correct answer: D. Incidents. In Microsoft 365 Defender, an incident is the primary container used to group and correlate multiple alerts that are determined to be part of the same attack or campaign. The incident view provides an aggregated “attack story,” showing related alerts, affected entities (users/devices/mailboxes), evidence, severity, and recommended remediation steps. This is exactly what the prompt describes: “an aggregation of alerts that relate to the same attack.” Why the others are wrong: - A. Reports: Reports provide dashboards and analytics (trends, volumes, security posture) but do not serve as the operational aggregation object for related alerts. - B. Hunting: Advanced hunting is for proactive investigation using queries (KQL) across telemetry; it helps you discover suspicious activity but does not automatically aggregate alerts into a single case. - C. Attack simulator: Used for simulated attacks (for example, phishing simulations) to train users and assess readiness, not for correlating real alerts from an active attack.
HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:
Azure Active Directory (Azure AD) Identity Protection can add users to groups based on the users’ risk level.
Azure AD (Microsoft Entra ID) Identity Protection does not add users to groups based on risk level. Identity Protection’s role is to detect and calculate risk (user risk and sign-in risk) and then enable administrators to respond using policies and workflows—most commonly via Conditional Access. Group membership automation is handled by other features, such as Entra ID dynamic groups (rule-based attributes like department, job title, etc.) or Identity Governance capabilities. Risk level is not used as a native rule to automatically place users into groups, and Identity Protection does not provide an action like “move user to high-risk group.” Why “Yes” is wrong: it confuses risk-based access enforcement (Conditional Access actions like require MFA/block) with identity lifecycle/governance functions (group assignment). In exam terms, think: Identity Protection = detect risk + feed Conditional Access; group management = Entra ID groups/governance.
Azure Active Directory (Azure AD) Identity Protection can detect whether user credentials were leaked to the public.
Azure AD (Microsoft Entra ID) Identity Protection can detect leaked credentials. One of the built-in risk detections is “Leaked credentials,” where Microsoft uses threat intelligence and monitoring of publicly available sources (often described as the public web/dark web) to find exposed username/password pairs. If those credentials match accounts in your tenant, Identity Protection raises the user risk. This is a detection capability, not merely a reporting feature: it contributes to the user risk score and can trigger remediation actions (for example, force password reset through a user risk policy or Conditional Access). Why “No” is wrong: it would imply Identity Protection only detects anomalous sign-ins (like impossible travel) but not credential exposure. In reality, leaked credentials is a core Identity Protection detection and a common SC-900 concept tied to preventing account takeover.
Azure Active Directory (Azure AD) Identity Protection can be used to invoke Multi-Factor Authentication based on a user's risk level.
Azure AD (Microsoft Entra ID) Identity Protection can be used to invoke Multi-Factor Authentication based on a user’s risk level by integrating with Conditional Access. In practice, you configure Conditional Access policies that use Identity Protection risk signals (user risk and/or sign-in risk) as conditions. When the risk meets a configured threshold (for example, medium or high), the policy can require MFA as a control. This is a key exam point: Identity Protection provides the risk assessment; Conditional Access enforces the response (require MFA, block access, require password change, etc.). Together they implement adaptive access aligned with Zero Trust. Why “No” is wrong: it overlooks the standard design pattern where risk-based Conditional Access uses Identity Protection signals. Even though Identity Protection itself isn’t the MFA provider, it is explicitly used to trigger MFA requirements through Conditional Access based on risk.
Which Microsoft 365 compliance center feature can you use to identify all the documents on a Microsoft SharePoint Online site that contain a specific key word?
Audit in Microsoft Purview records and lets you search activity logs (for example, file accessed, deleted, shared, permission changes) across Microsoft 365. It answers “who did what, when, and where,” which is critical for investigations and accountability. However, Audit does not search the full text/content of documents to find which files contain a specific keyword, so it’s not the right tool for content discovery.
Compliance Manager helps organizations assess and manage compliance posture using assessments, improvement actions, and a compliance score. It’s used to track controls, map requirements to Microsoft capabilities, and document evidence. It does not perform keyword searches across SharePoint Online documents. While it supports governance and compliance planning, it is not a discovery/search feature for locating content.
Content Search (in the Microsoft Purview compliance portal) is designed to locate content across Microsoft 365 workloads, including SharePoint Online sites. You can target a specific SharePoint site and run keyword/KQL queries to identify documents containing a particular word or phrase. Results can be previewed and exported, making it the correct feature for finding all documents on a SharePoint site that contain a specific keyword.
Alerts in Microsoft Purview (and related security/compliance solutions) notify administrators when certain events, risks, or policy matches occur—such as DLP policy triggers, suspicious activities, or compliance-related incidents. Alerts are reactive notifications and triage tools; they do not provide a mechanism to search all documents in a SharePoint Online site for a keyword. They may point you to an event, but they don’t perform content discovery.
Core Concept: This question tests Microsoft Purview (Microsoft 365 compliance) eDiscovery and search capabilities—specifically how to find content across Microsoft 365 locations (like SharePoint Online) based on keywords. In the Microsoft Purview compliance portal, the feature designed to locate items matching search criteria is Content search. Why the Answer is Correct: Content search allows compliance administrators to search across SharePoint Online sites (and other workloads such as Exchange mailboxes and OneDrive) for items containing specific keywords, phrases, or conditions. You can scope the search to a particular SharePoint site URL, choose locations, and then use keyword query language (KQL) to identify documents that contain the target term. The results can be previewed, exported, and used as input to further compliance workflows (for example, eDiscovery cases). Key Features / How it’s used: - Location targeting: Select SharePoint sites (specific site URLs) and optionally include OneDrive. - Keyword-based queries: Use KQL to search for words/phrases and refine by metadata (file type, author, date, etc.). - Actions on results: Preview, export results, and generate reports—useful for investigations, regulatory requests, and internal audits. - Governance alignment: Supports the Azure/Microsoft Well-Architected “Security” pillar principles (least privilege, auditability, and controlled access) by enabling controlled discovery of sensitive content. Common Misconceptions: People often confuse Audit with search. Audit logs record user/admin activities (who accessed what, what was changed), but they don’t enumerate all documents containing a keyword. Compliance Manager is a posture/assessment tool, not a content discovery engine. Alerts notify you about events or risks; they don’t perform keyword discovery across documents. Exam Tips: For SC-900, map the task to the right Purview capability: - “Find content by keyword across SharePoint/Exchange/OneDrive” = Content search (or eDiscovery for legal cases). - “Who did what and when” = Audit. - “Improve compliance score / assessments” = Compliance Manager. - “Notify on suspicious/compliance events” = Alerts. If the question is purely about identifying documents containing a keyword, Content search is the best match.
Which three authentication methods can be used by Azure Multi-Factor Authentication (MFA)? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.
Correct. SMS is a supported Azure MFA verification method where a one-time code is sent to the user’s registered mobile phone number. The user enters the code during sign-in to complete MFA. While supported, SMS is considered weaker than app-based methods due to risks like SIM swapping and interception, so it’s often allowed only as a fallback in stronger security postures.
Correct. The Microsoft Authenticator app is a primary Azure MFA method. It can provide push notifications (approve/deny) and time-based one-time passcodes (TOTP). This method is generally recommended over SMS/voice because it’s more secure and reliable, and it supports modern authentication experiences. It’s commonly used with Conditional Access MFA requirements in Microsoft Entra ID.
Incorrect. Email verification is not an Azure MFA sign-in method. Email is typically used for account recovery scenarios such as Self-Service Password Reset (SSPR) or to verify contact information, but it is not one of the standard Azure MFA verification methods for completing an MFA challenge during authentication.
Correct. Phone call is a supported Azure MFA method where the user receives an automated call and confirms sign-in (for example, by pressing a key). Like SMS, it is considered less secure than app-based methods due to telephony-based attack vectors and reliability issues, but it remains a valid Azure MFA option and appears frequently in exam questions.
Incorrect. Security questions are associated with Self-Service Password Reset (SSPR) and are generally discouraged because they can be guessed or socially engineered. They are not an Azure MFA authentication method for sign-in. On exams, security questions typically indicate password reset/recovery rather than MFA verification.
Core concept: This question tests Microsoft Entra ID (formerly Azure AD) Multi-Factor Authentication (MFA) authentication methods. MFA requires at least two independent factors (something you know, have, or are) to reduce account compromise risk. In Entra ID, MFA methods are configured per user (legacy per-user MFA) or, more commonly, enforced via Conditional Access policies. Why the answer is correct: Azure MFA supports multiple second-factor methods. The three classic, widely recognized Azure MFA methods are: 1) Text message (SMS) to a registered phone number. 2) Microsoft Authenticator app (push notification approval or time-based one-time passcode, TOTP). 3) Phone call to a registered phone number. These map directly to options A, B, and D. Key features and best practices: - Microsoft Authenticator app is generally preferred because it supports push and OTP, is more phishing-resistant than SMS/voice, and integrates well with modern authentication flows. - SMS and phone call are supported but are considered less secure due to SIM swap/social engineering and telephony reliability issues. Microsoft’s security guidance increasingly recommends moving away from SMS/voice where possible. - In Conditional Access, you can require “multifactor authentication” and then control which methods users can register/use via Authentication methods policy. You can also combine MFA with stronger controls like phishing-resistant methods (e.g., FIDO2 keys, certificate-based auth) for higher assurance. Common misconceptions: - Email verification is often used for self-service password reset (SSPR) or account recovery, but it is not an Azure MFA authentication method for sign-in. - Security questions are also associated with SSPR (and are discouraged for security reasons) rather than being an MFA sign-in method. Exam tips: For SC-900, remember the “classic Azure MFA methods”: Authenticator app, SMS, and phone call. If you see email or security questions, think “password reset/recovery,” not MFA for sign-in. Also note that Conditional Access is the modern way to require MFA in Entra ID, aligning with Zero Trust and Azure Well-Architected security principles (strong identity controls, least privilege, and risk-based access).
HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:
Azure Defender can detect vulnerabilities and threats for Azure Storage.
Yes. “Azure Defender” (now Microsoft Defender for Cloud’s workload protection plans) includes protection for Azure Storage. The Defender for Storage plan provides threat detection for suspicious activities such as unusual access patterns, potential data exfiltration, and malicious uploads, and it can surface security alerts related to Storage accounts. In addition, Defender for Cloud can identify certain security issues related to storage configuration (for example, overly permissive access settings) as part of posture management recommendations. Why not No: Storage is one of the core Azure resource types with a dedicated Defender plan. The exam often expects you to recognize that Defender for Cloud is not limited to VMs; it also covers PaaS services like Storage, SQL, and Kubernetes with specific threat detection capabilities (CWP).
Cloud Security Posture Management (CSPM) is available for all Azure subscriptions.
Yes. Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) capabilities for Azure subscriptions, including secure score, security recommendations, and policy-based assessment of resources. At the SC-900 level, this is treated as being available across Azure subscriptions once Defender for Cloud is used for that subscription. The statement is about Azure subscriptions specifically, not advanced multicloud or premium CSPM features. Therefore, No is incorrect because it overcomplicates the basic product capability being tested.
Azure Security Center can evaluate the security of workloads deployed to Azure or on-premises.
Yes. Azure Security Center (now Microsoft Defender for Cloud) can evaluate the security of workloads in Azure and extend to on-premises environments. For Azure resources, it natively assesses posture and can provide recommendations and secure score. For on-premises (and other clouds), you can onboard servers using agents and/or Azure Arc-enabled servers, allowing Defender for Cloud to collect security signals, assess configurations, and (with appropriate plans) provide threat protection. Why not No: A common exam concept is that Defender for Cloud is a cloud-native security management tool that supports hybrid scenarios. It is not restricted to Azure-only workloads; it can provide unified security management across Azure and non-Azure environments when those resources are connected/onboarded.
Which Microsoft 365 feature can you use to restrict communication and the sharing of information between members of two departments at your organization?
Sensitivity label policies (Microsoft Purview Information Protection) are used to classify and protect content such as documents and emails via encryption, access controls, and visual markings. They help control how information is shared (e.g., “Confidential—internal only”), but they do not directly prevent two departments from communicating in Teams or collaborating broadly. Labels are content-centric, not user-segmentation communication barriers.
Customer Lockbox is a Microsoft 365 feature that requires your explicit approval before Microsoft support engineers can access your content to troubleshoot issues. It is designed for customer control over Microsoft’s data access, not for restricting internal communication or sharing between departments. It addresses vendor access governance rather than user-to-user collaboration controls.
Information barriers are designed to restrict communication and collaboration between defined user segments (such as departments) to meet compliance requirements. They can prevent chats, calls, meetings, and directory lookups in Teams and limit sharing/collaboration in SharePoint and OneDrive between the segments. This is the direct, purpose-built feature for blocking information flow between two departments.
Privileged Access Management (PAM) focuses on controlling and auditing elevated administrative access, typically through just-in-time privilege elevation and time-bound approvals. It reduces standing admin privileges and supports least privilege for administrators. However, it does not control day-to-day communication or information sharing between standard users in different departments.
Core Concept: This question tests Microsoft Purview Information Barriers (IB), a compliance feature designed to prevent certain users or groups from communicating or collaborating with each other in Microsoft 365. It’s commonly used to meet regulatory, legal, or ethical separation requirements (for example, “Chinese walls” between departments). Why the Answer is Correct: Information barriers are specifically built to restrict communication and information sharing between segments of users (such as two departments). When configured, IB policies can block or limit interactions across Microsoft Teams, SharePoint Online, and OneDrive for Business (and other supported experiences depending on configuration). For example, you can prevent the Sales department from chatting with, calling, or sharing files with the Finance department, reducing the risk of conflicts of interest or inappropriate data flow. Key Features / How It Works: IB uses “segments” (often based on attributes in Microsoft Entra ID, such as Department, Group membership, or custom attributes) and policies that define who can communicate with whom. Policies can be bidirectional (mutual block) and can be scoped to specific workloads. In practice, you define segments (e.g., DeptA and DeptB) and then create an IB policy that blocks communication between them. This aligns with compliance and governance principles in the Microsoft Purview stack and supports the Azure Well-Architected Framework’s Security pillar by enforcing least privilege and reducing data exfiltration paths. Common Misconceptions: Many learners confuse sensitivity labels with communication restrictions. Sensitivity labels classify and protect content (encryption, markings, access restrictions on files/emails) but they don’t inherently stop two departments from chatting or collaborating. Customer Lockbox is about Microsoft support access to your data, not internal user-to-user restrictions. PAM is about privileged role elevation, not departmental communication controls. Exam Tips: For SC-900, map keywords to features: - “Restrict communication between groups/departments” => Information Barriers. - “Classify/protect documents/emails” => Sensitivity labels. - “Approve Microsoft support access” => Customer Lockbox. - “Just-in-time admin access” => PAM/PIM. Also remember IB is part of Microsoft Purview compliance capabilities, not primarily an identity or admin privilege tool.