{"id":15566,"date":"2026-09-18T05:45:42","date_gmt":"2026-09-18T05:45:42","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=15566"},"modified":"2026-09-18T05:45:42","modified_gmt":"2026-09-18T05:45:42","slug":"microsoft-sc-900-practice-test-questions-and-exam-dumps-part-17-q321-340","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/microsoft-sc-900-practice-test-questions-and-exam-dumps-part-17-q321-340\/","title":{"rendered":"Microsoft SC-900 Practice Test Questions and Exam Dumps Part 17 Q321-340"},"content":{"rendered":"

<\/h1>\n

View Full <\/b>Microsoft SC-900 Exam Dumps<\/b><\/a> and Practice Test Dumps<\/b><\/p>\n

 <\/p>\n

Question 321. Which Microsoft Entra capability allows administrators to manage authentication methods available to users?<\/b><\/h3>\n
    \n
  1. <\/b> Authentication Methods policies<\/span><\/li>\n
  2. <\/b> Microsoft Sentinel workbooks<\/span><\/li>\n
  3. <\/b> Azure Resource Locks<\/span><\/li>\n
  4. <\/b> Microsoft Purview Audit<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1. Authentication Methods policies.<\/b><\/p>\n

    Explanation:<\/b><\/p>\n

    Microsoft Entra Authentication Methods policies allow organizations to manage and control the authentication methods that users can use. Depending on the organization’s configuration, administrators can enable or disable supported methods and determine which users or groups can use them. Authentication methods can include options such as Microsoft Authenticator, FIDO2 security keys, and other supported approaches. Managing authentication methods is important because organizations may want to encourage stronger or passwordless authentication methods while limiting weaker options. These policies work alongside other identity controls such as Conditional Access, helping organizations establish a consistent authentication strategy.<\/span><\/p>\n

    Question 322. Which Microsoft Entra authentication method uses a mobile device to provide an authentication prompt or verification code?<\/b><\/h3>\n
      \n
    1. <\/b> Microsoft Authenticator<\/span><\/li>\n
    2. <\/b> Azure Policy<\/span><\/li>\n
    3. <\/b> Microsoft Purview eDiscovery<\/span><\/li>\n
    4. <\/b> Defender for Cloud Apps<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1. Microsoft Authenticator.<\/b><\/p>\n

      Explanation:<\/b><\/p>\n

      Microsoft Authenticator is an application that can be used with Microsoft Entra authentication to provide users with additional verification. Depending on the configured authentication method, users may approve a sign-in notification, use a time-based code, or use other supported authentication capabilities. Authenticator can therefore help organizations implement multifactor and passwordless authentication scenarios. It is important to protect the mobile device and authentication application because the device becomes part of the authentication process. Microsoft Authenticator is one of several authentication methods supported by Microsoft’s identity platform and can be managed through authentication method policies.<\/span><\/p>\n

      Question 323. What is the primary purpose of Microsoft Entra service principals?<\/b><\/h3>\n
        \n
      1. <\/b> To represent applications or services that need to access resources<\/span><\/li>\n
      2. <\/b> To store sensitive documents<\/span><\/li>\n
      3. <\/b> To monitor email attachments<\/span><\/li>\n
      4. <\/b> To create Sentinel workbooks<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1. To represent applications or services that need to access resources.<\/b><\/p>\n

        Explanation:<\/b><\/p>\n

        A service principal represents an application or service identity within Microsoft Entra so that the application can authenticate and access resources according to assigned permissions. Instead of relying on a human user’s identity, an application can use its service principal to perform authorized operations. Administrators should carefully control the permissions assigned to service principals because excessive application permissions can create security risks if the application’s credentials or identity are compromised. Service principals are commonly used for automation, application-to-application access, and other non-human identity scenarios. Their permissions should follow the principle of least privilege.<\/span><\/p>\n

        Question 324. What is the main security benefit of using managed identities for Azure resources?<\/b><\/h3>\n
          \n
        1. <\/b> They provide an identity for applications without requiring developers to manage credentials directly<\/span><\/li>\n
        2. <\/b> They eliminate the need for network security<\/span><\/li>\n
        3. <\/b> They replace Microsoft Sentinel<\/span><\/li>\n
        4. <\/b> They automatically classify all organizational data<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1. They provide an identity for applications without requiring developers to manage credentials directly.<\/b><\/p>\n

          Explanation:<\/b><\/p>\n

          Managed identities provide Azure resources with identities that can be used to authenticate to supported services without requiring developers to store and manage credentials such as passwords or secrets in application code. This can reduce the risk of credential exposure and simplify application authentication. Azure manages important aspects of the identity lifecycle, depending on the managed identity type and configuration. Administrators can then grant the identity only the permissions it needs. Managed identities are particularly useful for Azure workloads that need to access services such as Key Vault or other supported resources while following least-privilege principles.<\/span><\/p>\n

          Question 325. Which Microsoft Entra capability helps administrators periodically verify whether privileged roles are still required?<\/b><\/h3>\n
            \n
          1. <\/b> Access Reviews<\/span><\/li>\n
          2. <\/b> Microsoft Defender Antivirus<\/span><\/li>\n
          3. <\/b> Azure DDoS Protection<\/span><\/li>\n
          4. <\/b> Microsoft Sentinel notebooks<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1. Access Reviews.<\/b><\/p>\n

            Explanation:<\/b><\/p>\n

            Microsoft Entra Access Reviews help organizations periodically review whether users should continue to have access to supported resources, including certain privileged or sensitive access scenarios. Regular review is important because permissions can remain assigned after a user’s responsibilities change. Reviewers can examine access and confirm whether it should continue or be removed. Access Reviews support identity governance and the principle of least privilege by encouraging organizations to avoid permanent access that is no longer justified. They can complement Privileged Identity Management, which focuses on controlling and governing privileged role assignments and activation.<\/span><\/p>\n

            Question 326. Which Microsoft Entra feature can require approval before an eligible user activates a privileged role?<\/b><\/h3>\n
              \n
            1. <\/b> Privileged Identity Management<\/span><\/li>\n
            2. <\/b> Microsoft Purview Audit<\/span><\/li>\n
            3. <\/b> Microsoft Sentinel<\/span><\/li>\n
            4. <\/b> Azure Policy<\/span><\/li>\n<\/ol>\n

              Correct Answer: 1. Privileged Identity Management.<\/b><\/p>\n

              Explanation:<\/b><\/p>\n

              Microsoft Entra Privileged Identity Management can be configured to require approval before an eligible user activates certain privileged roles. This creates an additional governance step for sensitive administrative permissions. PIM can also support time-limited activation, justification, authentication requirements, and auditing depending on the configuration. The goal is to reduce unnecessary standing administrative privileges and provide greater control over privileged access. Approval workflows can be particularly useful for highly sensitive roles where organizations want another authorized person to review the request before elevated permissions become active.<\/span><\/p>\n

              Question 327. Which Microsoft Entra feature can dynamically add users to groups based on defined attributes?<\/b><\/h3>\n
                \n
              1. <\/b> Dynamic groups<\/span><\/li>\n
              2. <\/b> Microsoft Sentinel playbooks<\/span><\/li>\n
              3. <\/b> Microsoft Purview DLP<\/span><\/li>\n
              4. <\/b> Azure Key Vault<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1. Dynamic groups.<\/b><\/p>\n

                Explanation:<\/b><\/p>\n

                Microsoft Entra dynamic groups can automatically manage group membership based on defined user or device attributes. Instead of manually adding and removing every member, administrators can define membership rules that determine which identities should belong to a group. This can simplify administration in large environments where users frequently join, leave, or change roles. Dynamic groups can also support application assignments, licensing, and access management scenarios where group membership needs to reflect organizational attributes. Organizations should design membership rules carefully because incorrect rules could unintentionally grant or remove access from users.<\/span><\/p>\n

                Question 328. Which Microsoft Entra capability can automatically assign licenses to users based on group membership?<\/b><\/h3>\n
                  \n
                1. <\/b> Group-based licensing<\/span><\/li>\n
                2. <\/b> Defender for Identity<\/span><\/li>\n
                3. <\/b> Microsoft Sentinel analytics rules<\/span><\/li>\n
                4. <\/b> Azure Firewall<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1. Group-based licensing.<\/b><\/p>\n

                  Explanation:<\/b><\/p>\n

                  Group-based licensing allows organizations to assign supported Microsoft licenses to users through group membership. When users are added to a configured group, the applicable licenses can be assigned automatically according to the organization’s licensing configuration. When users leave the group, licensing can also be adjusted based on the configuration. This can reduce manual license administration and make licensing more consistent with organizational roles or departments. Group-based licensing is particularly useful in larger environments where manually assigning licenses to individual users would require significant administrative effort and could result in inconsistent assignments.<\/span><\/p>\n

                  Question 329. Which Microsoft Entra capability allows an organization to package multiple resources into a governed access request?<\/b><\/h3>\n
                    \n
                  1. <\/b> Access packages<\/span><\/li>\n
                  2. <\/b> Safe Links<\/span><\/li>\n
                  3. <\/b> Defender Vulnerability Management<\/span><\/li>\n
                  4. <\/b> Azure Resource Locks<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1. Access packages.<\/b><\/p>\n

                    Explanation:<\/b><\/p>\n

                    Access packages are a feature of Microsoft Entra entitlement management that allows organizations to bundle resources into a structured access package. A package can include supported groups, applications, and other resources that a user needs for a particular project or role. Policies can determine who can request access, whether approval is required, and how long access should remain available. This approach can simplify access governance because users can request a defined collection of resources rather than requiring administrators to manually manage every permission separately. Access packages are especially useful when access requirements are temporary or frequently changing.<\/span><\/p>\n

                    Question 330. Which Microsoft Entra feature can automatically remove access after a defined period when an access package is configured with expiration?<\/b><\/h3>\n
                      \n
                    1. <\/b> Entitlement management<\/span><\/li>\n
                    2. <\/b> Microsoft Defender Antivirus<\/span><\/li>\n
                    3. <\/b> Microsoft Purview Audit<\/span><\/li>\n
                    4. <\/b> Azure DDoS Protection<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1. Entitlement management.<\/b><\/p>\n

                      Explanation:<\/b><\/p>\n

                      Microsoft Entra entitlement management can support access expiration through policies associated with access packages. When an organization defines an expiration period, users can receive access for a limited duration rather than indefinitely. This is useful for temporary projects, external collaboration, contractors, and other situations where access should not remain permanently active. Expiration helps reinforce least privilege by limiting access to the period in which it is actually needed. Organizations can also combine expiration with access reviews and approval processes to create stronger governance around who receives access and how long that access remains valid.<\/span><\/p>\n

                      Question 331. Which Microsoft Entra capability helps organizations manage guest access to applications and resources?<\/b><\/h3>\n
                        \n
                      1. <\/b> Entitlement management<\/span><\/li>\n
                      2. <\/b> Microsoft Defender Antivirus<\/span><\/li>\n
                      3. <\/b> Azure Key Vault<\/span><\/li>\n
                      4. <\/b> Microsoft Sentinel notebooks<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1. Entitlement management.<\/b><\/p>\n

                        Explanation:<\/b><\/p>\n

                        Microsoft Entra entitlement management provides governance capabilities for access to resources, including scenarios involving external users. Organizations can use access packages and policies to define what resources external collaborators can access, who can request access, whether approval is required, and how long access should remain available. This creates a more controlled process than manually assigning individual permissions to guest users. Governance is particularly important for external access because guest identities may need temporary access to business applications or resources. Entitlement management helps organizations apply consistent access rules while maintaining appropriate oversight.<\/span><\/p>\n

                        Question 332. Which Microsoft Entra feature provides password reset capabilities directly to users without requiring an administrator to reset the password?<\/b><\/h3>\n
                          \n
                        1. <\/b> Self-service password reset<\/span><\/li>\n
                        2. <\/b> Microsoft Sentinel<\/span><\/li>\n
                        3. <\/b> Azure Firewall<\/span><\/li>\n
                        4. <\/b> Purview Data Map<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1. Self-service password reset.<\/b><\/p>\n

                          Explanation:<\/b><\/p>\n

                          Microsoft Entra self-service password reset allows users to reset or change their passwords through an identity verification process without requiring an administrator to manually perform every reset. This can reduce help-desk workload and provide users with a faster way to regain access when they forget their credentials. Organizations can configure authentication requirements and registration settings to support the process. Self-service password reset is an identity-management capability rather than a security monitoring feature. It should be implemented with appropriate verification controls so that an attacker cannot easily use the reset process to take control of another user’s account.<\/span><\/p>\n

                          Question 333. Which Microsoft Entra feature can help protect an organization from sign-ins that appear to originate from unusual locations or patterns?<\/b><\/h3>\n
                            \n
                          1. <\/b> Identity Protection<\/span><\/li>\n
                          2. <\/b> Azure Resource Locks<\/span><\/li>\n
                          3. <\/b> Microsoft Purview Records Management<\/span><\/li>\n
                          4. <\/b> Microsoft Intune App Management<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1. Identity Protection.<\/b><\/p>\n

                            Explanation:<\/b><\/p>\n

                            Microsoft Entra ID Protection can identify risk signals associated with user identities and sign-ins. Unusual authentication patterns, suspicious locations, and other indicators can contribute to risk detection depending on Microsoft’s available signals and the organization’s configuration. These risk signals can then be used with Conditional Access to apply additional controls. For example, a risky authentication attempt may be required to satisfy stronger authentication requirements. Identity Protection does not simply block every unusual sign-in automatically; organizations can configure policies and responses according to their risk tolerance and operational requirements.<\/span><\/p>\n

                            Question 334. Which Microsoft Entra capability can restrict access when a device does not meet an organization’s compliance requirements?<\/b><\/h3>\n
                              \n
                            1. <\/b> Conditional Access<\/span><\/li>\n
                            2. <\/b> Microsoft Purview eDiscovery<\/span><\/li>\n
                            3. <\/b> Azure Key Vault<\/span><\/li>\n
                            4. <\/b> Microsoft Sentinel Workbooks<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1. Conditional Access.<\/b><\/p>\n

                              Explanation:<\/b><\/p>\n

                              Microsoft Entra Conditional Access can use device compliance as a condition when determining whether access should be granted. Microsoft Intune can evaluate whether a managed device meets configured compliance requirements, and Conditional Access can then use that compliance status as part of an access decision. This creates an important connection between endpoint management and identity security. For example, an organization may require users to access a sensitive application only from devices that meet defined security requirements. This approach supports Zero Trust by considering the security state of the device rather than automatically trusting every authenticated user.<\/span><\/p>\n

                              Question 335. Which Microsoft Intune feature evaluates whether a device meets organizational requirements such as encryption or operating system conditions?<\/b><\/h3>\n
                                \n
                              1. <\/b> Device compliance policies<\/span><\/li>\n
                              2. <\/b> Application registrations<\/span><\/li>\n
                              3. <\/b> Sentinel analytics rules<\/span><\/li>\n
                              4. <\/b> Purview sensitivity labels<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1. Device compliance policies.<\/b><\/p>\n

                                Explanation:<\/b><\/p>\n

                                Intune device compliance policies evaluate managed devices against conditions established by the organization. Depending on supported platforms and configuration, these conditions can include encryption, operating system versions, password requirements, security settings, and other compliance criteria. The resulting compliance status can be integrated with Microsoft Entra Conditional Access to influence access decisions. Compliance policies are therefore different from configuration profiles. A configuration profile is generally used to deploy settings, while a compliance policy checks whether the device meets defined requirements. Using both together allows organizations to configure devices and then verify that they remain within acceptable security standards.<\/span><\/p>\n

                                Question 336. Which Microsoft Defender capability focuses specifically on protecting endpoints from threats such as malware and suspicious activity?<\/b><\/h3>\n
                                  \n
                                1. <\/b> Microsoft Defender for Endpoint<\/span><\/li>\n
                                2. <\/b> Microsoft Purview Compliance Manager<\/span><\/li>\n
                                3. <\/b> Microsoft Entra External ID<\/span><\/li>\n
                                4. <\/b> Azure Policy<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1. Microsoft Defender for Endpoint.<\/b><\/p>\n

                                  Explanation:<\/b><\/p>\n

                                  Microsoft Defender for Endpoint provides endpoint security capabilities designed to help prevent, detect, investigate, and respond to threats affecting supported devices. It can provide visibility into endpoint activity and support security operations through capabilities such as endpoint detection and response, vulnerability management, attack surface reduction, and investigation tools. Defender for Endpoint works as part of Microsoft’s broader Defender XDR ecosystem, allowing endpoint signals to be correlated with other security information. This makes it different from Microsoft Intune, which focuses primarily on device and application management, although the two services can work together.<\/span><\/p>\n

                                  Question 337. Which Microsoft Defender XDR capability helps analysts search across security data from multiple Microsoft security products?<\/b><\/h3>\n
                                    \n
                                  1. <\/b> Advanced hunting<\/span><\/li>\n
                                  2. <\/b> Access packages<\/span><\/li>\n
                                  3. <\/b> Data Lifecycle Management<\/span><\/li>\n
                                  4. <\/b> Security Defaults<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1. Advanced hunting.<\/b><\/p>\n

                                    Explanation:<\/b><\/p>\n

                                    Advanced hunting allows security analysts to query available security data across supported Microsoft Defender XDR sources. This capability can be used to investigate suspicious activity, search for indicators, identify relationships between events, and perform proactive threat hunting. Instead of waiting for a predefined alert, analysts can construct queries to investigate specific questions about the environment. Advanced hunting is particularly useful when an investigation requires broader visibility across identities, endpoints, email, and other security areas. It complements automated detections and incident management by giving security professionals greater flexibility when examining security telemetry.<\/span><\/p>\n

                                    Question 338. Which Microsoft Defender XDR capability provides a centralized view of related security alerts and investigation information?<\/b><\/h3>\n
                                      \n
                                    1. <\/b> Incidents<\/span><\/li>\n
                                    2. <\/b> Retention labels<\/span><\/li>\n
                                    3. <\/b> Access Reviews<\/span><\/li>\n
                                    4. <\/b> Azure Resource Locks<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1. Incidents.<\/b><\/p>\n

                                      Explanation:<\/b><\/p>\n

                                      Microsoft Defender XDR incidents provide a centralized way to examine related security alerts and associated investigation information. Multiple alerts generated by different security capabilities may be related to the same underlying attack, and grouping them into an incident helps analysts understand the broader activity. An incident can provide information that assists with investigation, response, and tracking. This is particularly valuable in complex attacks where an adversary may target identities, endpoints, email, and other resources during the same campaign. Centralized incident management can reduce fragmented investigations and help security teams prioritize related security activity.<\/span><\/p>\n

                                      Question 339. Which Microsoft Purview capability can help identify where sensitive data exists across an organization’s data estate?<\/b><\/h3>\n
                                        \n
                                      1. <\/b> Data Map<\/span><\/li>\n
                                      2. <\/b> Privileged Identity Management<\/span><\/li>\n
                                      3. <\/b> Defender for Endpoint<\/span><\/li>\n
                                      4. <\/b> Azure DDoS Protection<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1. Data Map.<\/b><\/p>\n

                                        Explanation:<\/b><\/p>\n

                                        Microsoft Purview Data Map provides a foundation for discovering and understanding data assets across supported data sources. It can help organizations build visibility into their data estate by capturing information about data assets and their metadata. This visibility supports broader data governance, discovery, classification, and management activities. Data Map is not primarily an endpoint security or identity management service. Its purpose is centered on understanding organizational data and its landscape. Having a clearer view of where data resides can help organizations make better decisions about governance, security, compliance, and data management.<\/span><\/p>\n

                                        Question 340. Which Microsoft Purview capability helps organizations maintain information as official business records according to defined policies?<\/b><\/h3>\n
                                          \n
                                        1. <\/b> Records Management<\/span><\/li>\n
                                        2. <\/b> Microsoft Sentinel<\/span><\/li>\n
                                        3. <\/b> Microsoft Defender Antivirus<\/span><\/li>\n
                                        4. <\/b> Microsoft Entra Cloud Sync<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1. Records Management.<\/b><\/p>\n

                                          Explanation:<\/b><\/p>\n

                                          Microsoft Purview Records Management helps organizations manage information that must be treated as official business records according to organizational, legal, or regulatory requirements. Records management can involve applying appropriate retention and disposition rules so that records are preserved for required periods and eventually handled according to approved policies. This is different from ordinary data storage because records often have additional governance requirements concerning retention, disposition, and immutability. Effective records management helps organizations maintain consistent information governance and supports compliance obligations while reducing the risks associated with retaining or disposing of business information incorrectly.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Microsoft SC-900 Exam Dumps and Practice Test Dumps   Question 321. Which Microsoft Entra capability allows administrators to manage authentication methods available to users? Authentication Methods policies Microsoft Sentinel workbooks Azure Resource Locks Microsoft Purview Audit Correct Answer: 1. Authentication Methods policies. Explanation: Microsoft Entra Authentication Methods policies allow organizations to manage and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/15566"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=15566"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/15566\/revisions"}],"predecessor-version":[{"id":15574,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/15566\/revisions\/15574"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=15566"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=15566"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=15566"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}