View Full Microsoft SC-900 Exam Dumps and Practice Test Dumps

 

Question 161. Which concept describes how security responsibilities are divided between a cloud provider and a customer?

1. Shared responsibility model
2. Single sign-on model
3. Zero Trust model
4. Defense-in-depth model

Correct Answer: 1. Shared responsibility model

Explanation:

The shared responsibility model explains how security and operational responsibilities are divided between the cloud service provider and the customer. Microsoft is responsible for securing the underlying cloud infrastructure, while customers retain responsibilities that depend on the service they use, such as managing identities, configuring access, protecting data, and maintaining appropriate security settings. The exact division changes between SaaS, PaaS, and IaaS. Understanding this model helps organizations avoid assuming that the cloud provider automatically handles every aspect of security. It also helps customers identify which controls they must configure and maintain themselves.

Question 162. In a Zero Trust security approach, which principle treats identity as a primary security boundary?

1. Trust every internal user
2. Identity verification and access control
3. Disable authentication after login
4. Allow unrestricted network access

Correct Answer: 2. Identity verification and access control

Explanation:

Zero Trust treats identity as an important security perimeter because users, devices, applications, and workloads can access resources from many locations and networks. Instead of assuming that a user is trusted because they are connected to an internal network, organizations continuously evaluate identity, device state, location, risk, and other signals. Microsoft Entra ID provides identity and access capabilities that support this approach. Strong authentication, Conditional Access, least-privilege access, and identity monitoring can all help enforce Zero Trust principles. This model reduces dependence on traditional network boundaries and focuses security decisions on verified identities and contextual signals.

Question 163. Which Microsoft Entra authentication method allows users to authenticate against Microsoft Entra ID by validating passwords against on-premises Active Directory?

1. Pass-through Authentication
2. Security Defaults
3. Passwordless authentication
4. Self-service password reset

Correct Answer: 1. Pass-through Authentication

Explanation:

Microsoft Entra Pass-through Authentication allows users to sign in to cloud services while their passwords are validated against the organization’s on-premises Active Directory. Authentication requests are passed to an on-premises agent, which validates the credentials against Active Directory. This can allow organizations to maintain password validation on-premises while using Microsoft Entra ID for cloud identity and access. It differs from Password Hash Synchronization, where a representation of the password hash is synchronized to Microsoft Entra ID. Understanding the distinction is important when selecting an identity architecture based on organizational requirements and authentication needs.

Question 164. Which Microsoft Entra feature synchronizes a transformed representation of an on-premises user’s password hash to Microsoft Entra ID?

1. Federation
2. Pass-through Authentication
3. Password Hash Synchronization
4. Access Reviews

Correct Answer: 3. Password Hash Synchronization

Explanation:

Password Hash Synchronization, commonly called PHS, synchronizes a hash of the on-premises Active Directory password to Microsoft Entra ID. Microsoft does not synchronize the user’s actual plain-text password. The synchronized representation enables Microsoft Entra ID to authenticate users for cloud services without contacting the on-premises domain controller for every sign-in. PHS is commonly used to provide a straightforward hybrid identity solution and can also support Microsoft Entra features such as Identity Protection. It is different from Pass-through Authentication, which validates the user’s password against on-premises Active Directory through authentication agents.

Question 165. Which identity architecture uses an external identity provider to authenticate users and issue authentication information to Microsoft Entra ID?

1. Federation
2. Dynamic groups
3. RBAC
4. Device compliance

Correct Answer: 1. Federation

Explanation:

Federation allows an organization to use an external identity provider or federation service to authenticate users while Microsoft Entra ID provides access to Microsoft cloud resources. In a federated arrangement, Microsoft Entra ID can redirect authentication to the organization’s federation service, which performs the authentication and returns the required authentication information. This approach can be useful when an organization has existing identity infrastructure or specific authentication requirements. Federation differs from Password Hash Synchronization and Pass-through Authentication because authentication is delegated to a federation service rather than being directly validated through Microsoft Entra’s synchronized password information.

Question 166. Which Microsoft Entra feature is designed to provide domain services such as domain join, LDAP, and Kerberos authentication without requiring domain controllers to be managed by the customer?

1. Microsoft Entra Domain Services
2. Microsoft Entra External ID
3. Microsoft Entra PIM
4. Microsoft Entra ID Protection

Correct Answer: 1. Microsoft Entra Domain Services

Explanation:

Microsoft Entra Domain Services provides managed domain capabilities in Azure, including domain join, LDAP, Kerberos, and NTLM authentication. It is useful for applications and workloads that depend on traditional domain services but do not require an organization to deploy and maintain its own domain controllers in Azure. Microsoft manages the underlying domain service infrastructure while administrators configure appropriate settings and access. Entra Domain Services is different from Microsoft Entra ID itself because Entra ID is primarily a cloud identity and access service, whereas Domain Services provides managed compatibility with traditional Active Directory-dependent applications.

Question 167. Which Microsoft Entra feature is most appropriate for allowing business users to request access to approved groups and applications through predefined packages?

1. Microsoft Entra entitlement management
2. Microsoft Entra ID Protection
3. Microsoft Defender for Identity
4. Microsoft Secure Score

Correct Answer: 1. Microsoft Entra entitlement management

Explanation:

Microsoft Entra entitlement management helps organizations manage identity governance by using access packages. An access package can bundle resources such as groups, applications, and SharePoint sites and define policies for how users can request access. Organizations can also establish approval requirements, expiration dates, and other governance controls. This makes entitlement management useful when users need controlled access to multiple resources without administrators manually processing every request. It also supports lifecycle-oriented access governance by helping organizations ensure that access is granted according to defined policies and can be removed when it is no longer required.

Question 168. What is the primary purpose of a dynamic group in Microsoft Entra ID?

1. Automatically add or remove members based on defined attributes
2. Encrypt every file in Microsoft 365
3. Replace Microsoft Sentinel analytics rules
4. Create Azure virtual networks

Correct Answer: 1. Automatically add or remove members based on defined attributes

Explanation:

Dynamic groups in Microsoft Entra ID can automatically manage group membership based on rules that evaluate user or device attributes. For example, an organization could create a group containing users whose department attribute equals a particular department. When an object’s attributes change, group membership can be updated automatically according to the configured rule. This reduces manual administration and can support access assignment, application deployment, and policy targeting. Dynamic groups are different from manually managed security groups because administrators do not need to individually add or remove every member when qualifying attributes change.

Question 169. Which Microsoft Entra capability can assign applications or services to users through group-based licensing and access management?

1. Microsoft Entra groups
2. Microsoft Sentinel workbooks
3. Microsoft Purview eDiscovery
4. Azure DDoS Protection

Correct Answer: 1. Microsoft Entra groups

Explanation:

Microsoft Entra groups can simplify identity and access administration by allowing organizations to manage users collectively. Groups can be used in access assignments and, where supported, group-based licensing can automatically assign Microsoft 365 or other eligible licenses to group members. This approach reduces the need to configure each user individually and helps maintain consistent access as employees join, change roles, or leave the organization. Groups can also be combined with dynamic membership rules to automate membership based on attributes. Administrators should still review group membership and access assignments to ensure users receive only the permissions and licenses they require.

Question 170. Which Microsoft Entra feature helps organizations create reusable access packages for internal and external users?

1. Entitlement management
2. Defender Antivirus
3. Microsoft Sentinel
4. Azure Firewall

Correct Answer: 1. Entitlement management

Explanation:

Microsoft Entra entitlement management provides identity governance capabilities for managing access packages. An access package can contain multiple resources and can be assigned to users according to defined policies. Organizations can use this functionality for employees, guests, and other external collaborators when controlled access to resources is required. Policies can include request processes, approval requirements, assignment duration, and expiration. By centralizing these controls, entitlement management helps reduce unmanaged access and provides a structured method for granting resources based on organizational requirements. It is particularly useful when access needs to be requested and governed rather than permanently assigned.

Question 171. Which Microsoft Entra capability can automate identity-related tasks when employees join, move within, or leave an organization?

1. Lifecycle Workflows
2. Microsoft Sentinel workbooks
3. Azure Firewall
4. Microsoft Purview eDiscovery

Correct Answer: 1. Lifecycle Workflows

Explanation:

Microsoft Entra Lifecycle Workflows help automate identity lifecycle processes associated with employees joining an organization, changing roles, or leaving. Organizations can configure workflows to perform supported tasks at appropriate stages of a user’s lifecycle. Automating these activities can reduce repetitive administrative work and help ensure that identity-related processes are performed consistently. For example, onboarding tasks may include preparing accounts or assigning appropriate resources, while offboarding processes can help remove or restrict access. Lifecycle Workflows complement broader identity governance capabilities by connecting identity lifecycle events with repeatable administrative actions.

Question 172. Which authentication approach is specifically designed to resist phishing by using cryptographic credentials associated with a device or security key?

1. FIDO2 passwordless authentication
2. Basic password authentication
3. Security Defaults only
4. Email-based authentication

Correct Answer: 1. FIDO2 passwordless authentication

Explanation:

FIDO2 authentication uses public-key cryptography and can provide phishing-resistant authentication without requiring users to enter traditional passwords. A compatible security key or platform authenticator protects the private key, while the corresponding public key is registered with the service. During authentication, the authenticator performs a cryptographic operation rather than sending a reusable password to the service. This makes credential theft through common phishing techniques significantly more difficult. Microsoft Entra ID supports passwordless authentication methods, including FIDO2 security keys, allowing organizations to strengthen authentication while also reducing dependence on traditional passwords.

Question 173. Which Microsoft Entra capability allows administrators to define stronger authentication requirements for specific sensitive resources or scenarios?

1. Conditional Access authentication strengths
2. Dynamic groups
3. Access Reviews
4. Password Hash Synchronization

Correct Answer: 1. Conditional Access authentication strengths

Explanation:

Conditional Access authentication strengths allow organizations to require specific levels or combinations of authentication methods for selected access scenarios. For example, access to a highly sensitive application can be configured to require a stronger or phishing-resistant authentication method rather than accepting every available MFA method. This provides more precise control than simply requiring generic multifactor authentication. Authentication strengths can be incorporated into Conditional Access policies alongside conditions such as user, application, device, location, and risk. This helps organizations align authentication requirements with the sensitivity of the resource and the security context of the sign-in.

Question 174. Which Microsoft Intune capability ensures that only devices meeting defined security requirements can access protected organizational resources?

1. Device compliance policies
2. Microsoft Sentinel workbooks
3. Purview eDiscovery
4. Azure DDoS Protection

Correct Answer: 1. Device compliance policies

Explanation:

Microsoft Intune device compliance policies define requirements that devices must meet to be considered compliant. Conditions can include operating system requirements, encryption status, password configuration, threat protection, and other supported security settings. Compliance information can then be used with Microsoft Entra Conditional Access to restrict access when a device does not meet organizational requirements. This creates an important connection between device management and identity-based access control. Instead of automatically trusting a device simply because it belongs to the organization, administrators can require evidence that the device satisfies defined security conditions before allowing access to protected resources.

Question 175. What is the primary purpose of Microsoft Intune enrollment?

1. Register devices for management by the organization
2. Create Microsoft Sentinel incidents
3. Discover sensitive information in documents
4. Replace Azure Active Directory with a firewall

Correct Answer: 1. Register devices for management by the organization

Explanation:

Microsoft Intune enrollment brings a device under organizational management so administrators can apply configuration, compliance, application, and security policies. After enrollment, Intune can manage supported settings and provide information about the device’s management state. Enrollment is therefore an important starting point for endpoint management because the organization needs a management relationship before it can consistently apply many policies. Enrollment should be distinguished from compliance: enrollment makes the device manageable, while compliance policies determine whether the device satisfies defined security requirements. Conditional Access can then use compliance information as part of access decisions.

Question 176. Which Microsoft Defender for Endpoint capability helps reduce the attack surface by controlling or restricting behaviors commonly exploited by attackers?

1. Attack Surface Reduction rules
2. Microsoft Purview eDiscovery
3. Microsoft Sentinel workbooks
4. Service Trust Portal

Correct Answer: 1. Attack Surface Reduction rules

Explanation:

Attack Surface Reduction rules in Microsoft Defender for Endpoint help organizations reduce opportunities for attackers to exploit common behaviors and techniques. Depending on the rule, organizations can restrict activities associated with malicious documents, scripts, credential theft, or other attack techniques. These controls are designed as preventive security measures and can complement antivirus, endpoint detection, vulnerability management, and other Defender capabilities. Administrators should test and appropriately configure rules because overly restrictive policies can affect legitimate business applications. Attack Surface Reduction is therefore an important part of endpoint security that focuses on preventing or limiting risky behaviors before they lead to successful compromise.

Question 177. Which Microsoft Defender XDR capability allows security analysts to query security data across supported Microsoft security sources?

1. Advanced hunting
2. Access Reviews
3. Sensitivity labels
4. Group-based licensing

Correct Answer: 1. Advanced hunting

Explanation:

Advanced hunting in Microsoft Defender XDR provides a query-based investigation capability that allows security analysts to examine security data across supported Microsoft security products. Analysts can use queries to investigate suspicious activity, search for indicators, identify patterns, and explore relationships between events. It can be particularly useful when an analyst needs to investigate beyond the information presented in a predefined incident view. Advanced hunting supports proactive threat hunting as well as investigation activities. Its purpose is different from automated detection rules because analysts can formulate queries to explore available telemetry and investigate specific security questions.

Question 178. Which Microsoft Sentinel capability uses behavioral analytics to help identify unusual activities associated with users and entities?

1. User and Entity Behavior Analytics (UEBA)
2. Group-based licensing
3. Sensitivity labeling
4. Device enrollment

Correct Answer: 1. User and Entity Behavior Analytics (UEBA)

Explanation:

User and Entity Behavior Analytics, or UEBA, helps Microsoft Sentinel identify unusual behavior by analyzing activities associated with users, hosts, IP addresses, applications, and other entities. Rather than relying only on fixed signatures, behavioral analytics can establish patterns and help identify activity that differs from expected behavior. This can provide useful context during security investigations, especially when an account appears to behave differently from its normal pattern. UEBA does not replace other detection methods; it complements analytics rules, threat intelligence, and incident investigation. Analysts can use behavioral insights to prioritize and investigate potentially suspicious activities.

Question 179. Which Microsoft Sentinel capability can provide context about known malicious indicators such as suspicious IP addresses or domains?

1. Threat intelligence
2. Device enrollment
3. Group-based licensing
4. Sensitivity labels

Correct Answer: 1. Threat intelligence

Explanation:

Threat intelligence provides information about known or suspected malicious indicators and can help security teams add context to security events. Indicators may include IP addresses, domains, URLs, file hashes, or other observable artifacts associated with threats. Microsoft Sentinel can use threat intelligence as part of security monitoring and investigation so analysts can compare observed activity with known threat information. This context can help improve detection and investigation efficiency, although threat intelligence should be evaluated for quality, relevance, and freshness. It works alongside analytics rules, incidents, automation, and other security capabilities rather than replacing them.

Question 180. Which Microsoft Sentinel feature can automatically execute a sequence of actions in response to a security event?

1. Playbooks
2. Workbooks
3. Data connectors
4. Analytics rules

Correct Answer: 1. Playbooks

Explanation:

Microsoft Sentinel playbooks are automated workflows that can execute actions in response to security events or other triggers. They are commonly built using Azure Logic Apps and can perform tasks such as sending notifications, creating or updating records, enriching information, or interacting with other services. Playbooks help security teams reduce repetitive manual work and standardize response procedures. They are different from analytics rules, which are primarily used to detect suspicious activity and generate alerts or incidents. Workbooks are mainly used for visualization and analysis, while data connectors help bring relevant data into Sentinel for monitoring and investigation.