Microsoft Microsoft Certifications SC-900 Questions & Answers

• Question 131:

  You need to connect to an Azure virtual machine by using Azure Bastion. What should you use?

  A. an SSH client

  B. PowerShell remoting

  C. the Azure portal

  D. the Remote Desktop Connection client

  Correct Answer: C

  You can create an RDP connection to a Windows VM using Azure Bastion.

  Reference: https://docs.microsoft.com/en-us/azure/bastion/bastion-connect-vm-rdp-windows

• Question 132:

  When security defaults are enabled for an Azure Active Directory (Azure AD) tenant, which two requirements are enforced? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. All users must authenticate from a registered device.

  B. Administrators must always use Azure Multi-Factor Authentication (MFA).

  C. Azure Multi-Factor Authentication (MFA) registration is required for all users.

  D. All users must authenticate by using passwordless sign-in.

  E. All users must authenticate by using Windows Hello.

  Correct Answer: BC

  Security defaults make it easy to protect your organization with the following preconfigured security settings:

  1.

  Requiring all users to register for Azure AD Multi-Factor Authentication.

  2.

  Requiring administrators to do multi-factor authentication.

  3.

  Blocking legacy authentication protocols.

  4.

  Requiring users to do multi-factor authentication when necessary.

  5.

  Protecting privileged activities like access to the Azure portal.

• Question 133:

  Which compliance feature should you use to identify documents that are employee resumes?

  A. pre-trained classifiers

  B. Content explorer

  C. Activity explorer

  D. eDiscovery

  Correct Answer: A

  Microsoft Information Protection - Trainable Classifiers

  Leverage user-friendly, pre-trained or trainable Machine Learning classifiers to identify various types of content in your organization.

  Microsoft provides a list of classifiers which are pre-trained (based on sample documents like Legal, Finance, Manufacturing, Supply Chain etc.) and use Machine Learning to identify the classification of the documents in user-configured

  target locations.

  Incorrect:

  Not B: How is activity explorer helpful to a compliance administrator?

  Activity explorer provides a historical view of activities on your labeled content. The activity information is collected from the Microsoft 365 unified audit logs, transformed, and made available in the Activity explorer UI.

  Creating a custom trainable classifier first involves giving it samples that are human picked and positively match the category.

  Not C: Electronic discovery, or eDiscovery, is the process of identifying and delivering electronic information that can be used as evidence in legal cases.

  Not D: Content explorer shows a current snapshot of the items that have a sensitivity label, a retention label or have been classified as a sensitive information type in your organization.

  Reference: https://www.infotechtion.com/post/microsoft-trainable-classifiers

• Question 134:

  What is a characteristic of a sensitivity label in Microsoft 365?

  A. encrypted

  B. restricted to predefined categories

  C. persistent

  Correct Answer: C

  How sensitivity labels work in Power BI

  When you apply a sensitivity label to Power BI content and files, it's similar to applying a tag on that resource that has the following benefits:

  Customizable - you can create categories for different levels of sensitive content in your organization, such as Personal, Public, General, Confidential, and Highly Confidential.

  Clear text - since the label is in clear text, it's easy for users to understand how to treat the content according to sensitivity label guidelines.

  Persistent - after a sensitivity label has been applied to content, it accompanies that content when it's exported to Excel, PowerPoint and PDF files, downloaded to .pbix, or saved (in Desktop) and becomes the basis for applying and enforcing

  policies.

  Reference: https://docs.microsoft.com/en-us/power-bi/enterprise/service-security-sensitivity-label-overview

• Question 135:

  You need to create a data loss prevention (DLP) policy. What should you use?

  A. the Microsoft 365 admin center

  B. the Microsoft Endpoint Manager admin center

  C. the Microsoft 365 Defender portal

  D. the Microsoft 365 Compliance center

  Correct Answer: A

  "you can configure DLP policies for all workloads through the Microsoft Purview compliance portal," https://docs.microsoft.com/en-us/microsoft-365/compliance/create-test-tune-dlp-policy

• Question 136:

  Which Microsoft 365 feature can you use to restrict communication and the sharing of information between members of two departments at your organization?

  A. sensitivity label policies

  B. Customer Lockbox

  C. information Barriers

  D. Privileged Access Management (PAM)

  Correct Answer: C

• Question 137:

  You have an Azure subscription.

  You need to implement approval-based, time-bound role activation.

  What should you use?

  A. Windows Hello for Business

  B. Azure Active Directory (Azure AD) Identity Protection

  C. access reviews in Azure Active Directory (Azure AD)

  D. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

• Question 138:

  Which three statements accurately describe the guiding principles of Zero Trust? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. Define the perimeter by physical locations.

  B. Use identity as the primary security boundary.

  C. Always verify the permissions of a user explicitly.

  D. Always assume that the user system can be breached.

  E. Use the network as the primary security boundary.

  Correct Answer: BCD

  Reference: https://docs.microsoft.com/en-us/security/zero-trust/

• Question 139:

  You have a Microsoft 365 tenant that uses trainable classifiers.

  You are creating a custom trainable classifier.

  You collect 300 sample file types from various geographical locations to use as seed content. Some of the file samples are encrypted.

  You organize the files into categories as shown in the following table.

  

  Which file categories can be used as seed content?

  A. Category2, Category3, and Category5 only

  B. Category1 and Category3 only

  C. Category4 and Category6 only

  D. Category4 and Category5 only

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/classifier-get-started-with?view=o365-worldwide https://docs.microsoft.com/en-us/sharepoint/technical-reference/default-crawled-file-name-extensions-and-parsed-file-types

• Question 140:

  You need to test Microsoft Office 365 Message Encryption (OME) capabilities for your company. The test must verify the following information:

  1.

  The acquired default template names

  2.

  The encryption and decryption verification status Which PowerShell cmdlet should you run?

  A. Test-ClientAccessRule

  B. Test-Mailflow

  C. Test-OAuthConnectivity

  D. Test-IRMConfiguration

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/set-up-new-message-encryption-capabilities?view=o365-worldwide