Authentication manages backups, while authorization manages network traffic<\/span><\/li>\n<\/ol>\nCorrect Answer: 2. Authentication verifies identity, while authorization determines what an authenticated identity is permitted to access.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Authentication and authorization are related but perform different security functions. Authentication establishes that a person, application, or service is really who or what it claims to be. Examples include passwords, Microsoft Authenticator, security keys, and other authentication methods. Authorization happens after authentication and determines which resources or actions the authenticated identity is allowed to use. Microsoft Entra ID can authenticate users and support authorization through roles, groups, Conditional Access, and other controls. Understanding this distinction is fundamental to identity security because successfully proving an identity does not automatically grant unrestricted access to organizational resources.<\/span><\/p>\nQuestion 262. Which Microsoft Entra capability helps administrators assign permissions to resources according to job responsibilities?<\/b><\/h3>\n\n- <\/b> Role-based access control<\/span><\/li>\n
- <\/b> Microsoft Sentinel<\/span><\/li>\n
- <\/b> Microsoft Purview Audit<\/span><\/li>\n
- <\/b> Microsoft Defender Antivirus<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Role-based access control.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Role-based access control, commonly called RBAC, allows permissions to be associated with defined roles rather than being assigned individually to every user for every resource. This makes access management easier to administer and supports the principle of least privilege. For example, an administrator might receive permissions appropriate for managing a particular resource, while another employee receives only permissions required for viewing it. Microsoft platforms use role-based access concepts extensively. By organizing permissions around responsibilities, organizations can reduce unnecessary access and make it easier to review, modify, and revoke privileges when job responsibilities change.<\/span><\/p>\nQuestion 263. Which Microsoft Entra feature provides single sign-on so users can access multiple supported applications after signing in?<\/b><\/h3>\n\n- <\/b> Microsoft Defender for Cloud<\/span><\/li>\n
- <\/b> Microsoft Sentinel<\/span><\/li>\n
- <\/b> Microsoft Entra single sign-on<\/span><\/li>\n
- <\/b> Microsoft Purview eDiscovery<\/span><\/li>\n<\/ol>\n
Correct Answer: 3. Microsoft Entra single sign-on.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Entra single sign-on, or SSO, allows users to authenticate once and then access multiple applications that are configured to work with the organization’s identity provider. This can improve the user experience by reducing repeated sign-in prompts and can also simplify identity administration. SSO does not mean that applications become unsecured or that authentication is eliminated. Instead, the identity platform handles authentication and provides the appropriate application access based on configured trust and authorization settings. Organizations can combine SSO with MFA, Conditional Access, and other identity controls to maintain security while reducing unnecessary authentication friction.<\/span><\/p>\nQuestion 264. Which authentication approach is generally considered passwordless?<\/b><\/h3>\n\n- <\/b> Reusing the same password across applications<\/span><\/li>\n
- <\/b> Increasing password length only<\/span><\/li>\n
- <\/b> Writing passwords in a password manager<\/span><\/li>\n
- <\/b> Using Windows Hello for Business<\/span><\/li>\n<\/ol>\n
Correct Answer: 4. Using Windows Hello for Business.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Windows Hello for Business provides a passwordless authentication experience by allowing users to authenticate with device-bound credentials combined with methods such as a PIN, fingerprint, or facial recognition, depending on the device and configuration. The PIN is associated with the specific device rather than functioning as a traditional reusable password across services. Passwordless authentication can reduce exposure to common password-based attacks such as credential theft and password spraying. Microsoft Entra ID supports passwordless authentication methods as part of its identity security capabilities, allowing organizations to improve authentication security while providing users with convenient ways to sign in.<\/span><\/p>\nQuestion 265. What is a major security benefit of phishing-resistant authentication methods?<\/b><\/h3>\n\n- <\/b> They eliminate the need for authorization<\/span><\/li>\n
- <\/b> They reduce the effectiveness of attacks that attempt to steal or trick users into revealing authentication secrets<\/span><\/li>\n
- <\/b> They automatically encrypt every database<\/span><\/li>\n
- <\/b> They replace all network firewalls<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. They reduce the effectiveness of attacks that attempt to steal or trick users into revealing authentication secrets.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Phishing-resistant authentication methods are designed to prevent attackers from successfully using credentials or authentication information obtained through phishing techniques. Methods such as FIDO2 security keys use cryptographic mechanisms that bind authentication to the legitimate service, making common credential-harvesting techniques much less effective. This differs from traditional passwords and some authentication methods that can potentially be entered into a fraudulent website. Microsoft Entra supports strong authentication options that can be used to strengthen identity security. Phishing-resistant authentication is particularly valuable for protecting privileged accounts and other identities that could provide significant access if compromised.<\/span><\/p>\nQuestion 266. Which Conditional Access condition can be used to apply access policies based on the network location from which a user signs in?<\/b><\/h3>\n\n- <\/b> Location<\/span><\/li>\n
- <\/b> File extension<\/span><\/li>\n
- <\/b> Database schema<\/span><\/li>\n
- <\/b> Retention label<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Location.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Entra Conditional Access can evaluate the location associated with a sign-in and apply policies based on configured network locations. Administrators can define trusted locations and use location conditions as part of broader access policies. For example, an organization may require additional controls when users sign in from unfamiliar locations or allow different access requirements for recognized corporate networks. Location is only one possible signal; Conditional Access can also evaluate users, applications, devices, risk, authentication strength, and other conditions. Combining several signals allows organizations to make access decisions based on the context of a particular sign-in rather than relying solely on usernames and passwords.<\/span><\/p>\nQuestion 267. Which Conditional Access condition allows an organization to target policies specifically at certain cloud applications?<\/b><\/h3>\n\n- <\/b> User risk<\/span><\/li>\n
- <\/b> Named location<\/span><\/li>\n
- <\/b> Cloud apps or actions<\/span><\/li>\n
- <\/b> Device storage capacity<\/span><\/li>\n<\/ol>\n
Correct Answer: 3. Cloud apps or actions.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Conditional Access policies can be targeted to specific cloud applications or actions so that different security requirements can be applied depending on what a user is attempting to access. An organization might require stronger authentication for a sensitive business application while applying different requirements to a lower-risk application. The cloud apps or actions condition is therefore useful for creating granular access policies. Conditional Access can combine this condition with other signals such as user membership, device state, location, sign-in risk, and authentication strength. This enables organizations to enforce security requirements appropriate to the sensitivity and context of the requested resource.<\/span><\/p>\nQuestion 268. Which Microsoft Entra ID Protection signal indicates that a user’s account may have been compromised?<\/b><\/h3>\n\n- <\/b> User risk<\/span><\/li>\n
- <\/b> Storage capacity<\/span><\/li>\n
- <\/b> Application size<\/span><\/li>\n
- <\/b> Device battery level<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. User risk.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Entra ID Protection uses identity-related signals to identify potentially compromised users and risky authentication activity. User risk represents the likelihood that a particular identity has been compromised based on detected signals. Administrators can use this information with Conditional Access policies to require actions such as multifactor authentication or password changes when appropriate. User risk differs from sign-in risk, which focuses on the likelihood that a particular authentication attempt is suspicious. Understanding these risk concepts helps organizations respond to identity threats dynamically instead of treating every authentication request as equally trustworthy.<\/span><\/p>\nQuestion 269. Which statement best describes multifactor authentication?<\/b><\/h3>\n\n- <\/b> It requires only a longer password<\/span><\/li>\n
- <\/b> It requires two or more different authentication factors<\/span><\/li>\n
- <\/b> It disables authorization controls<\/span><\/li>\n
- <\/b> It only works for administrators<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. It requires two or more different authentication factors.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Multifactor authentication, or MFA, strengthens identity verification by requiring multiple types of authentication evidence. These factors can include something the user knows, such as a password; something the user has, such as a security key or phone; or something the user is, such as a biometric characteristic. The purpose is to prevent a stolen password from being sufficient by itself to gain access. Microsoft Entra supports MFA and can enforce it through Conditional Access and other identity security configurations. MFA is an important identity protection measure because attackers often target passwords as an initial way to compromise accounts.<\/span><\/p>\nQuestion 270. What is the main purpose of Microsoft Intune device compliance policies?<\/b><\/h3>\n\n- <\/b> To determine whether devices meet defined organizational security requirements<\/span><\/li>\n
- <\/b> To replace Microsoft Sentinel<\/span><\/li>\n
- <\/b> To create database tables<\/span><\/li>\n
- <\/b> To perform legal discovery<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. To determine whether devices meet defined organizational security requirements.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Intune compliance policies evaluate devices against requirements established by an organization. These requirements can include conditions such as operating system versions, encryption status, password settings, device security configuration, or other supported compliance criteria. Compliance information can then be used with Microsoft Entra Conditional Access to help control access to organizational resources. A compliance policy does not simply mean that Intune manages the device; it specifically evaluates whether the device satisfies the organization’s defined conditions. This separation between configuration and compliance is important when designing endpoint security and access policies.<\/span><\/p>\nQuestion 271. What is the primary purpose of an Intune configuration profile?<\/b><\/h3>\n\n- <\/b> To investigate security incidents<\/span><\/li>\n
- <\/b> To configure settings on managed devices<\/span><\/li>\n
- <\/b> To discover cloud applications<\/span><\/li>\n
- <\/b> To perform eDiscovery searches<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. To configure settings on managed devices.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Intune configuration profiles are used to deploy and manage settings on enrolled devices. Administrators can use profiles to configure supported operating-system and device settings according to organizational requirements. Examples can include security settings, restrictions, connectivity configurations, and other device-management options. Configuration profiles are different from compliance policies. A configuration profile tells a device how certain settings should be configured, while a compliance policy evaluates whether the device meets specified requirements. Organizations often use both capabilities together so that Intune can configure devices and then evaluate whether those devices continue to satisfy security expectations.<\/span><\/p>\nQuestion 272. Which Intune capability can help deploy applications to managed devices?<\/b><\/h3>\n\n- <\/b> Microsoft Purview Audit<\/span><\/li>\n
- <\/b> Microsoft Sentinel workbooks<\/span><\/li>\n
- <\/b> Intune app management<\/span><\/li>\n
- <\/b> Azure DDoS Protection<\/span><\/li>\n<\/ol>\n
Correct Answer: 3. Intune app management.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Intune provides application management capabilities that help organizations deploy and manage applications on supported managed devices. Administrators can configure applications and assign them to users or device groups according to organizational requirements. This allows organizations to control which business applications are available and helps simplify application deployment at scale. Intune can manage applications alongside device configuration and compliance capabilities, creating a broader endpoint-management approach. Application management can also be used with other Microsoft security controls to help protect organizational data and ensure that users access business resources through appropriately managed applications and devices.<\/span><\/p>\nQuestion 273. Which Microsoft Defender capability provides antivirus protection for supported endpoints?<\/b><\/h3>\n\n- <\/b> Microsoft Defender Antivirus<\/span><\/li>\n
- <\/b> Microsoft Purview Data Map<\/span><\/li>\n
- <\/b> Microsoft Sentinel notebooks<\/span><\/li>\n
- <\/b> Microsoft Entra Access Reviews<\/span><\/li>\n<\/ol>\n
Correct Answer: 1. Microsoft Defender Antivirus.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Defender Antivirus provides antimalware and antivirus protection for supported devices by helping detect, prevent, and respond to malicious software. It is an endpoint security capability rather than an identity governance or compliance feature. Defender Antivirus works as part of Microsoft’s broader endpoint protection ecosystem and can be complemented by Microsoft Defender for Endpoint capabilities. Defender for Endpoint adds broader endpoint detection, investigation, vulnerability management, and response functionality. Understanding the distinction is important for SC-900 because Microsoft security products are designed for different security domains, and Defender Antivirus specifically addresses malware protection on supported endpoints.<\/span><\/p>\nQuestion 274. What is a key purpose of Attack Surface Reduction rules in Microsoft Defender for Endpoint?<\/b><\/h3>\n\n- <\/b> To create retention labels<\/span><\/li>\n
- <\/b> To reduce opportunities for common attack techniques to succeed<\/span><\/li>\n
- <\/b> To manage Microsoft Entra groups<\/span><\/li>\n
- <\/b> To create Sentinel workbooks<\/span><\/li>\n<\/ol>\n
Correct Answer: 2. To reduce opportunities for common attack techniques to succeed.<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Attack Surface Reduction rules are designed to help prevent or reduce behaviors commonly associated with malicious activity. They can provide controls that restrict risky application behaviors and techniques frequently used during attacks. This helps organizations reduce the number of pathways an attacker may use to compromise endpoints. Attack Surface Reduction is different from simply detecting an attack after it has occurred because the objective is to prevent or limit risky behavior in advance. Microsoft Defender for Endpoint includes endpoint security capabilities that can help organizations establish layered defenses across devices, supporting the broader principle of reducing exposure to threats.<\/span><\/p>\nQuestion 275. Which Microsoft Defender XDR capability can automatically investigate certain alerts and take supported remediation actions?<\/b><\/h3>\n\n- <\/b> Automated investigation and response<\/span><\/li>\n
- <\/b> Data Lifecycle Management<\/span><\/li>\n
- <\/b> Access Reviews<\/span><\/li>\n