Microsoft Security, Compliance, and Identity Fundamentals (SC-900) Exam Questions

Correct answer: C
In the shared responsibility model, the division of work changes with the service type (on-premises, IaaS, PaaS, SaaS). But some responsibilities always stay with the customer: the information and data they store, the devices (endpoints) that access the service, and the accounts and identities they create and manage.

Why other options are incorrect
A. Physical hosts, the physical network, and the physical datacenter are always Microsoft’s responsibility in any cloud service type.
B. In SaaS, the cloud provider manages the operating system. Customers patch the OS only in IaaS (and on-premises).
D. In SaaS, network controls are managed by the cloud provider. They’re a customer or shared responsibility only in IaaS and PaaS.

Source: Shared responsibility in the cloud - Microsoft Learn

Correct answer: A
Defense in depth uses layers of protection, so that if one layer is breached, the next layer stops the attacker from going further. Microsoft describes these layers as physical security, identity and access, perimeter, network, compute, application, and data, with data as the innermost layer. The overall goal is to protect confidentiality, integrity, and availability (the CIA triad).

Why other options are incorrect
B. The shared responsibility model divides security tasks between the cloud provider and the customer. It doesn’t describe layering controls against an attack.
C. Hashing is a one-way function mainly used to store passwords and check integrity. It’s a single technique, not a layered security strategy.
D. Federation creates trust between identity providers so users can reach resources across organizations. It has nothing to do with layering controls.

Source: Describe defense in depth - Training | Microsoft Learn

Correct answer: D
Zero Trust has three guiding principles: verify explicitly, use least privilege access, and assume breach. Assume breach means designing security controls on the expectation that attackers might already be inside the environment. The focus is on limiting the impact of a breach (for example, through segmentation and encryption) and on detecting and responding to threats quickly.

Why other options are incorrect
A. Verify explicitly means authenticating and authorizing every access request using all available signals. It’s about the access decision, not about containing an attacker who is already inside.
B. Use least privilege access means giving users and workloads only the access they need, for the shortest time required. It limits permissions, not what happens after a breach.
C. Defense in depth is a separate layered-security approach, not one of the three Zero Trust guiding principles.

Source: Zero Trust as a security foundation - Microsoft Learn

Correct answer: B
Hashing is a one-way process. It turns any input into a fixed-length hash, and the hash can’t be reversed to get the original input back. The same input always gives the same hash, so at sign-in the system hashes the password the user entered and compares the two hashes. Adding a unique, random salt to each password before hashing means identical passwords produce different hashes, which makes precomputed rainbow table attacks useless.

Why other options are incorrect
A. Symmetric encryption can be reversed by anyone who has the key, so an administrator with the key could recover the passwords.
C. Asymmetric encryption can also be reversed with the private key. It’s used for key exchange, HTTPS, and digital signatures, not for storing passwords.
D. Base64 is an encoding, not a security control. Anyone can decode it back to the original text.

Source: Describe encryption and hashing - Training | Microsoft Learn

Correct answer: C
Data sovereignty is the concept that data, especially personal data, is subject to the laws and regulations of the country or region where it was physically collected, held, or processed. It can mean several countries’ rules apply to the same data as it moves across borders.

Why other options are incorrect
A. Data residency is about regulations that control where data may physically be stored, and how and when it can be moved across borders. It’s about location, not which country’s laws apply to the data.
B. Data privacy is about being transparent about how personal data is collected, processed, used, and shared, and handling it properly. It isn’t specifically about which country’s laws apply.
D. Data classification categorizes data by sensitivity (for example, confidential or public). It’s an information protection practice, not a legal-jurisdiction concept.

Source: Describe security and compliance concepts - Training | Microsoft Learn

Correct answer: A
Federation lets users access services across organizational or domain boundaries by creating trust relationships between the identity providers involved. The partner’s resources trust the user’s home identity provider to authenticate them, so the user doesn’t need a separate set of credentials for each organization.

Why other options are incorrect
B. A directory service (such as Active Directory Domain Services) stores and manages identity information within an organization. By itself, it doesn’t set up trust with another organization’s identity provider.
C. Authorization decides what an already authenticated identity is allowed to do. It doesn’t let one organization accept identities authenticated by another.
D. Multifactor authentication strengthens sign-in by requiring more than one form of verification. It doesn’t create trust between organizations.

Source: Describe identity concepts - Training | Microsoft Learn

Correct answer: B
Managed identities are a type of workload identity (a special kind of service principal) that removes the need for developers to manage credentials. A system-assigned managed identity is created as part of an Azure resource, is tied to that resource’s lifecycle, and is deleted automatically when the resource is deleted.

Why other options are incorrect
A. A client secret in app settings is exactly the kind of stored credential the team wants to avoid, and someone has to rotate it manually.
C. Guest (B2B) accounts are for external people collaborating with your organization, not for applications authenticating to Azure services.
D. A shared administrator user account is a human identity with a password to store and manage, and it breaks least privilege. It’s never an appropriate workload identity.

Source: What is managed identities for Azure resources? - Microsoft Learn

Correct answer: D
Microsoft Entra B2B collaboration, part of Microsoft Entra External ID, lets you invite external business partners to your workforce tenant as guest users. They sign in with their own identities (for example, their own Microsoft Entra account), and they appear in your directory, where they can be added to groups and given access to Microsoft 365 and other apps.

Why other options are incorrect
A. Creating separate member accounts gives partners a second set of credentials to manage and ignores their existing identities, which is what B2B avoids.
B. An external tenant is for publishing apps to consumers and business customers, with users managed in a separate tenant. It’s not for giving partners access to the company’s own Microsoft 365 resources.
C. Microsoft Entra Connect syncs the company’s own on-premises Active Directory to its Microsoft Entra tenant. It isn’t used to bring in another organization’s users.

Source: What is Microsoft Entra B2B collaboration? - Microsoft Learn

Correct answer: C
With password hash synchronization, Microsoft Entra Connect syncs a hash of the user’s password (never the plain-text password) from on-premises Active Directory to Microsoft Entra ID. Microsoft Entra ID then authenticates the user in the cloud, so users keep one password and no on-premises component has to be reachable at sign-in time.

Why other options are incorrect
A. Federation hands authentication off to an on-premises federation service such as AD FS, which is the most infrastructure-heavy option and must be available for every sign-in.
B. Pass-through authentication validates passwords against on-premises Active Directory through agents installed on-premises, so those agents must be running for users to sign in.
D. Microsoft Entra Domain Services provides managed domain services (such as domain join and LDAP) in Azure. It isn’t a hybrid sign-in method for Microsoft 365.

Source: What is password hash synchronization with Microsoft Entra ID? - Microsoft Learn

Correct answer: A
Microsoft lists FIDO2 security keys and passkeys, Windows Hello for Business, and certificate-based authentication as phishing-resistant methods. They use public-key cryptography bound to the device and the sign-in origin, so there’s no code or approval a user can be tricked into handing to an attacker’s fake site.

Why other options are incorrect
B. An SMS code can be phished (typed into a fake sign-in page) or intercepted, so it isn’t phishing-resistant, even though it can be used for MFA.
C. A voice call is a second factor for MFA and SSPR, but it isn’t phishing-resistant.
D. Authenticator push notifications are a strong MFA method, but they aren’t in Microsoft’s phishing-resistant category, because a user can still be tricked into approving an attacker’s sign-in.

Source: Microsoft Entra authentication overview - Microsoft Learn

Correct answer: B
Microsoft Entra multifactor authentication requires two or more different kinds of verification: something you know (such as a password), something you have (such as a trusted phone or hardware key), and something you are (biometrics such as a fingerprint or face scan). A password (know) plus a code from the Authenticator app on a registered phone (have) combines two different factors.

Why other options are incorrect
A. A password and a security-question answer are both “something you know”, so this is still single-factor authentication.
C. A password and a memorized PIN are both “something you know”. Two secrets of the same kind don’t make MFA.
D. A username only identifies the user. The password is the only verification, so this is single-factor authentication.

Source: How it works: Microsoft Entra multifactor authentication - Microsoft Learn

Correct answer: D
Microsoft Entra self-service password reset (SSPR) lets users change or reset their password, or unlock their account, without an administrator or help desk. Users first register authentication methods, then prove their identity with one or more of those methods before they reset.

Why other options are incorrect
A. Privileged Identity Management controls just-in-time activation of privileged roles. It doesn’t help regular users reset forgotten passwords.
B. Password Protection blocks weak and commonly used passwords when a password is set or changed, but it doesn’t give users a self-service reset process.
C. ID Protection detects and responds to identity risk (such as leaked credentials). It can require a secure password change for risky users, but SSPR is the self-service reset feature.

Source: How it works: Microsoft Entra self-service password reset - Microsoft Learn

Correct answer: C
Microsoft Entra Password Protection lets administrators add up to 1,000 organization-specific terms (such as brand names, product names, and locations) to a custom banned password list. It’s used together with the global banned password list, and it automatically detects and blocks common variations of each term. Password Protection can also be extended to on-premises Active Directory Domain Services in hybrid environments.

Why other options are incorrect
A. The global banned password list is maintained by Microsoft from real-world telemetry and applies automatically. Administrators can’t view or edit it, so it can’t hold organization-specific terms.
B. Self-service password reset lets users reset their own passwords. It doesn’t decide which passwords are banned.
D. Conditional Access controls access at sign-in based on signals (user, location, device, risk). It doesn’t enforce rules on password content.

Source: Eliminate bad passwords using Microsoft Entra Password Protection - Microsoft Learn

Correct answer: A
Conditional Access is Microsoft Entra’s policy engine. It combines signals such as the user or group, IP location, device, application, and real-time risk to make an access decision, such as block access, grant access, or require multifactor authentication. Conditional Access requires Microsoft Entra ID P1 licenses.

Why other options are incorrect
B. Security defaults turn on a fixed, preconfigured set of protections (such as requiring MFA and blocking legacy authentication) for the whole tenant. They can’t be customized by application or location.
C. Access reviews periodically check whether users still need their group memberships, app access, or roles. They don’t evaluate individual sign-ins.
D. Privileged Identity Management manages just-in-time activation of privileged roles. It doesn’t apply location-based access rules to apps.

Source: What is Conditional Access? - Microsoft Learn

Correct answer: B
Microsoft Entra roles control access to Microsoft Entra resources such as users, groups, and applications. Azure roles (Azure RBAC) control access to Azure resources such as virtual machines and storage. Resetting user passwords is a directory task, so it needs a narrowly scoped Microsoft Entra built-in role, not a subscription role and not the most powerful directory role.

Why other options are incorrect
A and C. Owner and Contributor are Azure RBAC roles that grant access to Azure resources in a subscription. They give no permission to manage Microsoft Entra user accounts.
D. Global Administrator could reset passwords, but it grants full control of the entire tenant, which breaks the principle of least privilege.

Source: Overview of role-based access control in Microsoft Entra ID - Microsoft Learn

Correct answer: D
The Azure built-in Reader role can view all resources but can’t make any changes. That’s the least-privilege choice for an auditor who only needs read-only visibility.

Why other options are incorrect
A. Owner grants full access to manage all resources, including assigning roles to others.
B. Contributor grants full access to create and manage resources (it just can’t assign roles), which is far more than read-only.
C. User Access Administrator lets someone manage user access to Azure resources, which the auditor must not be able to do.

Source: Azure built-in roles - Microsoft Learn

Correct answer: C
Microsoft Entra access reviews let organizations efficiently manage group memberships, access to enterprise applications, and role assignments by regularly reviewing user access, so only the right people keep it. Reviews can recur (for example, quarterly), can be assigned to group owners or managers, and can automatically remove access that reviewers deny.

Why other options are incorrect
A. Privileged Identity Management provides just-in-time, time-bound activation of privileged roles. It isn’t the tool for recurring guest membership recertification (though it can use access reviews for roles).
B. Entitlement management packages resources into access packages that users request. The recurring “does this person still need access?” check is done by access reviews.
D. Conditional Access evaluates each sign-in against policy. It doesn’t periodically recertify who belongs to a group.

Source: What are access reviews? - Microsoft Learn

Correct answer: A
Microsoft Entra entitlement management lets organizations define access packages that bundle group memberships, application roles, and SharePoint Online roles, with approval workflows and expiration. For external users, it can specify which partner organizations may request access, add approved users as B2B guests automatically, and remove them when their access expires or is revoked.

Why other options are incorrect
B. Access reviews recertify access that already exists. They don’t give users a way to request a bundle of resources with approval and expiration.
C. Conditional Access enforces conditions at sign-in. It doesn’t package resources or handle access requests and approvals.
D. ID Protection detects and remediates identity risk. It has no role in requesting or granting access to resources.

Source: What is Microsoft Entra ID Governance? - Microsoft Learn

Correct answer: B
Privileged Identity Management provides just-in-time privileged access to Microsoft Entra ID and Azure resources, time-bound access using start and end dates, approval to activate privileged roles, MFA to activate any role, justification, notifications when roles are activated, access reviews, and audit history. PIM is part of Microsoft Entra ID Governance and requires licensing.

Why other options are incorrect
A. Access reviews periodically check whether role assignments are still needed. They don’t control the moment a role is activated.
C. ID Protection detects risky users and sign-ins. It doesn’t manage eligible and active privileged role assignments.
D. Entitlement management handles access packages for groups, apps, and sites. Just-in-time activation of privileged directory roles is PIM’s job.

Source: What is Microsoft Entra Privileged Identity Management? - Microsoft Learn

Correct answer: D
Microsoft Entra ID Protection detects risky behavior such as anonymous IP address use, password spray, leaked credentials, and atypical travel. It calculates sign-in risk (how likely a specific sign-in is compromised) and user risk (how likely the account itself is compromised). These risk levels can then drive risk-based Conditional Access policies, which require Microsoft Entra ID P2.

Why other options are incorrect
A. Microsoft Defender for Identity is part of Defender XDR. It mainly monitors identity signals from on-premises Active Directory (for example, domain controllers) to detect attacks like lateral movement. It isn’t the Microsoft Entra feature that calculates user and sign-in risk.
B. Conditional Access uses risk as a signal, but the risk detections themselves come from ID Protection.
C. PIM manages privileged role activation. It doesn’t detect compromised credentials or risky sign-ins.

Source: What is Microsoft Entra ID Protection? - Microsoft Learn

Correct answer: C
Azure DDoS Protection defends Azure resources against distributed denial-of-service attacks. The DDoS Network Protection tier provides enhanced mitigation for resources in a virtual network, with always-on monitoring and adaptive real-time tuning, plus DDoS rapid response support and cost protection. The DDoS IP Protection tier offers a pay-per-protected-IP model.

Why other options are incorrect
A. Azure Firewall filters traffic with network and application rules. It isn’t built to absorb large-scale volumetric DDoS floods.
B. NSGs allow or deny traffic by IP address, port, and protocol. They can’t mitigate a volumetric flood aimed at a public IP.
D. A WAF protects web apps from application-layer exploits such as SQL injection and cross-site scripting, not network-layer volumetric floods.

Source: What is Azure DDoS Protection? - Microsoft Learn

Correct answer: A
Azure Firewall is a cloud-native, intelligent network firewall security service. It’s a fully stateful firewall as a service with built-in high availability and unlimited cloud scalability, and it comes in Basic, Standard, and Premium SKUs. It’s typically deployed centrally (for example, in a hub virtual network) to control and log traffic for many virtual networks.

Why other options are incorrect
B. NSGs provide basic allow/deny filtering on subnets and network interfaces. They aren’t a centralized, managed firewall service with application-level rules and threat intelligence.
C. Azure Bastion provides secure RDP/SSH access to virtual machines. It doesn’t filter traffic across virtual networks.
D. DDoS Protection mitigates denial-of-service attacks. It doesn’t enforce connectivity rules for applications and networks.

Source: What is Azure Firewall? - Microsoft Learn

Correct answer: B
Azure Web Application Firewall protects web applications from common exploits and vulnerabilities, such as SQL injection and cross-site scripting, which are among the most common attacks. It can be deployed with Azure Application Gateway, Application Gateway for Containers, Azure Front Door, and Azure Content Delivery Network.

Why other options are incorrect
A. NSGs filter by IP address, port, and protocol. They can’t inspect HTTP request content for SQL injection or XSS.
C. DDoS Protection mitigates volumetric denial-of-service attacks, not application-layer exploits hidden in otherwise valid requests.
D. Key Vault stores secrets, keys, and certificates. It doesn’t inspect or filter web traffic.

Source: What is Azure Web Application Firewall? - Microsoft Learn

Correct answer: D
NSG security rules have a priority from 100 to 4096. Lower numbers are processed first (higher priority), and once traffic matches a rule, processing stops. Here, the Deny rule at priority 100 matches before the Allow rule at 200, so the connection is denied.

Why other options are incorrect
A. Allow rules don’t automatically override Deny rules. Only priority order decides which rule applies.
B. The opposite is true: the lower priority number is evaluated first and wins.
C. The default rules (such as DenyAllInbound at 65500) have the lowest priority and are evaluated last, so custom rules always come first.

Source: Azure network security groups overview - Microsoft Learn

Correct answer: C
An Azure virtual network provides an isolated private network in Azure, and it can be split into subnets to segment workloads. Traffic between subnets can then be filtered with network security groups (and application security groups) that define inbound and outbound security rules, so each tier accepts only the traffic it needs.

Why other options are incorrect
A. A single subnet with public IPs on every VM removes segmentation and exposes the database directly to the internet.
B. Microsoft Entra tenants separate identity directories. They don’t segment network traffic between application tiers.
D. Storing the connection string in Key Vault protects a secret, but it doesn’t restrict which networks can reach the database.

Source: What is Azure Virtual Network? - Microsoft Learn

Correct answer: A
Azure Bastion is a fully managed service that provides secure RDP and SSH connectivity to virtual machines over TLS on port 443, directly from the Azure portal. The VMs don’t need public IP addresses, agents, or client software, so RDP/SSH ports are never exposed to the internet.

Why other options are incorrect
B. Public IPs with open RDP/SSH ports expose the VMs to internet scanning and brute-force attacks, which is exactly what the requirement rules out.
C. DDoS Protection defends against denial-of-service attacks. It doesn’t provide remote access to VMs.
D. A WAF protects HTTP/HTTPS web applications. It doesn’t broker RDP or SSH sessions.

Source: What is Azure Bastion? - Microsoft Learn

Correct answer: B
Azure Key Vault centrally stores and controls access to secrets (tokens, passwords, API keys), keys (encryption keys), and certificates (public and private TLS/SSL certificates). The Standard tier uses software-protected keys, and the Premium tier offers HSM-protected keys that never leave the HSM boundary.

Why other options are incorrect
A. A storage account stores blobs, files, queues, and tables. It isn’t a secure secrets and key management service with fine-grained access control.
C. Azure Policy evaluates and enforces rules on resource configuration. It doesn’t store secrets or keys.
D. Defender for Cloud assesses security posture and detects threats (including for Key Vault), but it isn’t where secrets, keys, and certificates are stored.

Source: About Azure Key Vault - Microsoft Learn

Correct answer: D
Secure score in Defender for Cloud combines security findings into a single score that shows your current cloud security posture. It’s based on the open security recommendations, mainly from the Microsoft cloud security benchmark, and the higher the score, the lower the identified risk level. Fixing recommendations raises the score.

Why other options are incorrect
A. Secure score measures security posture against recommendations. It isn’t a guarantee of regulatory compliance.
B. The number of resources monitored doesn’t by itself raise the score. Fixing recommendations does.
C. Security alerts come from workload threat detection. A higher secure score comes from fewer or less severe open recommendations, not from more alerts.

Source: Secure score in Defender for Cloud - Microsoft Learn

Correct answer: C
In Defender for Cloud, security standards define the controls and assessment logic, and security recommendations are generated when resources don’t meet those controls. The Microsoft cloud security benchmark (MCSB) is the default built-in standard. For example, MCSB includes the control “Storage accounts should restrict network access using virtual network rules”, and noncompliant storage accounts produce a recommendation to fix it.

Why other options are incorrect
A, B, and D. ISO 27001, NIST SP 800-53, and PCI DSS are regulatory compliance standards that can be added to Defender for Cloud for compliance assessments, but none of them is the default built-in security benchmark behind the standard recommendations.

Source: Security policies in Defender for Cloud - Microsoft Learn

Correct answer: A
Defender for Cloud is a cloud-native application protection platform (CNAPP) with three pillars: CSPM, CWPP, and DevOps security. The CWPP capabilities come from Defender plans that protect specific workloads (servers, containers, storage, databases, and more) with threat detection and security alerts, across Azure, AWS, Google Cloud, and on-premises environments.

Why other options are incorrect
B. CSPM assesses configuration and posture (secure score, recommendations, attack paths). Real-time threat detection on workloads is CWPP.
C. DevOps security covers code-level and pipeline security (for example, finding infrastructure-as-code misconfigurations and exposed secrets in GitHub, Azure DevOps, and GitLab).
D. SIEM is Microsoft Sentinel’s role (collecting and analyzing security data from across the enterprise), not a Defender for Cloud pillar.

Source: What is Microsoft Defender for Cloud? - Microsoft Learn

Correct answer: B
Foundational CSPM is free and includes asset inventory, the Microsoft cloud security benchmark, secure score, security recommendations, and remediation tools. The paid Defender CSPM plan adds advanced capabilities such as attack path analysis, cloud security explorer, risk prioritization, agentless vulnerability scanning, and data security posture management, across Azure, AWS, and GCP.

Why other options are incorrect
A. Attack path analysis and cloud security explorer aren’t part of the free foundational CSPM tier.
C. Defender for Servers is a workload protection (CWPP) plan for machines. It doesn’t provide the Defender CSPM attack path features.
D. Azure Policy enforces resource configuration rules. It doesn’t analyze attack paths across the environment.

Source: What is Cloud Security Posture Management (CSPM) - Microsoft Learn

Correct answer: D
SOAR takes alerts from many sources and triggers automated workflows and responses, such as running playbooks that disable accounts or open tickets. Microsoft Sentinel is a cloud-native SIEM and SOAR solution. Its SOAR side uses automation rules and playbooks built on Azure Logic Apps, with connectors to services such as ServiceNow and Jira.

Why other options are incorrect
A. SIEM collects, aggregates, and analyzes security data to detect threats and raise alerts. Automatically running response workflows is the SOAR side.
B. CSPM assesses cloud configuration posture. It doesn’t run incident-response workflows.
C. XDR (such as Microsoft Defender XDR) provides detection and response across endpoints, identities, email, and apps. The scenario describes orchestrated automation across different tools, which is SOAR.

Source: Automate threat response with playbooks in Microsoft Sentinel - Microsoft Learn

Correct answer: C
Microsoft Sentinel’s first capability is collecting data at scale. It has out-of-the-box data connectors for Microsoft sources (such as Microsoft Entra ID and Azure Activity) and many third-party solutions, and it also supports custom connectors. Once data is ingested, Sentinel can detect threats (analytics rules, threat intelligence), investigate them, and respond to them.

Why other options are incorrect
A. Workbooks visualize and report on data that has already been ingested. They don’t bring data in.
B. Playbooks automate responses to incidents (SOAR). They don’t ingest log data.
D. Analytics rules query ingested data to detect threats and create incidents, so they depend on data connectors bringing the data in first.

Source: What is Microsoft Sentinel security information and event management (SIEM)? - Microsoft Learn

Correct answer: A
Microsoft Defender XDR is a unified enterprise defense suite. It coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications, and it correlates alerts from these sources into incidents. The Microsoft Defender portal (security.microsoft.com) brings these capabilities together in one place, alongside other solutions such as Microsoft Sentinel, Defender for Cloud, and Defender Vulnerability Management.

Why other options are incorrect
B. The Microsoft Purview portal is for data security, compliance, and governance solutions (such as DLP, sensitivity labels, and eDiscovery), not for investigating Defender incidents.
C. The Microsoft Entra admin center manages identities and access. It doesn’t correlate threat alerts from the Defender products.
D. Azure Advisor gives best-practice recommendations for Azure resources. It isn’t a threat investigation portal.

Source: Microsoft Defender XDR in the Microsoft Defender portal - Microsoft Learn

Correct answer: B
Safe Links in Microsoft Defender for Office 365 scans and rewrites URLs and checks them at the time of click, in email messages, Microsoft Teams, and supported Office 365 apps. This protects users even when a link was weaponized after the message was delivered. Safe Links is available in both Defender for Office 365 Plan 1 and Plan 2.

Why other options are incorrect
A. Safe Attachments detonates email attachments in a sandbox to detect malware. It doesn’t check links when they’re clicked.
C. Attack simulation training (Plan 2) runs realistic phishing simulations to train users. It doesn’t protect against real links in real time.
D. Threat Explorer (Plan 2) is an investigation and hunting tool. It doesn’t block a malicious URL at the moment of click.

Source: Safe Links in Microsoft Defender for Office 365 - Microsoft Learn

Correct answer: D
Microsoft Defender for Endpoint is an enterprise endpoint security platform that helps organizations prevent, detect, investigate, and respond to advanced threats on devices. Its capabilities include attack surface reduction, next-generation protection, endpoint detection and response (EDR), and automatic attack disruption, and it’s part of the Defender XDR suite.

Why other options are incorrect
A. Defender for Identity monitors identity signals (for example, from on-premises Active Directory) to detect identity-based attacks, not device-level malware.
B. Defender for Office 365 protects email and collaboration (Exchange Online, Teams, Office apps), not device operating systems.
C. Defender for Cloud Apps protects SaaS applications and cloud app usage, not endpoints.

Source: Microsoft Defender for Endpoint overview - Microsoft Learn

Correct answer: C
Microsoft Defender for Cloud Apps provides cloud access security broker (CASB) capabilities, including shadow IT discovery, visibility into cloud app usage, app risk assessment using 90+ risk indicators, and policy-based protection. It also includes SaaS security posture management and integrates with Microsoft Purview to protect sensitive data.

Why other options are incorrect
A. Defender for Endpoint secures devices. Its signals can feed cloud discovery, but the CASB discovery and app risk catalog belong to Defender for Cloud Apps.
B. Defender for Cloud protects Azure, multicloud, and hybrid infrastructure workloads, not SaaS app usage.
D. Azure Firewall filters network traffic for Azure virtual networks. It doesn’t catalog and risk-score SaaS apps.

Source: Microsoft Defender for Cloud Apps overview - Microsoft Learn

Correct answer: A
Microsoft Defender for Identity uses lightweight sensors and behavioral analytics to monitor identity signals, including on-premises Active Directory. It detects attacks across the kill chain: reconnaissance, compromised credentials (for example, brute force), lateral movement, and domain dominance (for example, Golden Ticket activity and DCShadow). It’s part of Microsoft Defender XDR.

Why other options are incorrect
B. Microsoft Entra ID Protection evaluates risk for cloud sign-ins and users in Microsoft Entra ID. It doesn’t analyze on-premises domain controller traffic for attacks like Golden Ticket.
C. Defender for Endpoint secures devices with EDR and next-generation protection. Active Directory-specific identity attack detection is Defender for Identity’s focus.
D. Defender for Cloud protects cloud and hybrid infrastructure workloads. It isn’t the Defender XDR identity-threat solution for Active Directory.

Source: Microsoft Defender for Identity overview - Microsoft Learn

Correct answer: B
Microsoft Defender Vulnerability Management is a risk-based vulnerability management solution with three core capabilities: continuous asset discovery and monitoring (software, certificates, hardware and firmware, browser extensions), risk-based intelligent prioritization using Microsoft threat intelligence and breach likelihood, and remediation and tracking, including creating remediation tasks in Microsoft Intune. It’s used in the Microsoft Defender portal.

Why other options are incorrect
A. Secure score summarizes cloud security posture from Defender for Cloud recommendations. It isn’t a device software and vulnerability inventory with Intune remediation.
C. Defender for Identity detects identity-based attacks. It doesn’t inventory device software vulnerabilities.
D. Compliance Manager tracks regulatory compliance and improvement actions, not device vulnerabilities.

Source: What is Microsoft Defender Vulnerability Management - Microsoft Learn

Correct answer: D
Threat intelligence in Microsoft Defender provides threat articles (attack patterns, threat actors, campaigns, tools, vulnerabilities), an Intel explorer for searching and filtering intelligence by type (including threat actors and indicators), threat analytics reports from Microsoft security researchers, and enrichment of entities such as IP addresses, domains, URLs, and files with Microsoft Threat Intelligence data.

Why other options are incorrect
A. The Service Trust Portal provides Microsoft’s audit reports, certifications, and compliance documentation. It isn’t a threat actor research tool.
B. ID Protection uses Microsoft’s threat intelligence internally to score identity risk, but it doesn’t let analysts research threat actors and campaigns.
C. Compliance Manager helps manage regulatory compliance. It has no threat intelligence research features.

Source: Threat intelligence in Microsoft Defender - Microsoft Learn

Correct answer: C
The Microsoft Service Trust Portal publishes audit reports from independent external auditors, certification and standards information (such as ISO/IEC, SOC 1/2/3, FedRAMP, and PCI DSS), whitepapers, and other compliance resources for Microsoft cloud services. Many documents require signing in with a Microsoft cloud services (Microsoft Entra) account and accepting a non-disclosure agreement.

Why other options are incorrect
A. Compliance Manager helps you assess and manage your own organization’s compliance with improvement actions. It isn’t where Microsoft’s third-party audit reports are published.
B. Defender for Cloud’s regulatory compliance dashboard shows how your Azure resources measure against selected standards. It doesn’t publish Microsoft’s audit reports.
D. Azure Advisor gives cost, reliability, security, and performance recommendations. It doesn’t provide compliance documentation.

Source: Get started with Microsoft Service Trust Portal - Microsoft Learn

Correct answer: A
Under the principle “Microsoft defends your data”, Microsoft protects customer data through clearly defined response policies, strong contractual commitments, and, if necessary, the courts. Its position is that government requests for your data should be directed to you, and Microsoft doesn’t give any government direct or unfettered access to customer data.

Why other options are incorrect
B. “Know where your data is located” is about customers choosing the service and data location (for example, the Azure region) that’s right for their business.
C. “Your data is secured at rest and in transit” is about Microsoft’s use of encryption, including multiple independent encryption layers.
D. “You control your data” means your data belongs to you, you can access, modify, or delete it at any time, and Microsoft uses it only with your agreement to provide the services you chose.

Source: Describe Microsoft’s privacy principles - Training | Microsoft Learn

Correct answer: B
Compliance Manager, in the Microsoft Purview portal, organizes regulatory requirements into assessments built from controls (Microsoft-managed, customer-managed, and shared) and recommends improvement actions. Compliance score weights each action by the risk it addresses. Actions are preventative, detective, or corrective, and either mandatory (centrally enforced, can’t be bypassed) or discretionary (depends on user behavior). Preventative mandatory actions carry the most points (27).

Why other options are incorrect
A. Detective discretionary actions carry the fewest points (1), because they depend on users and only detect issues after the fact.
C. Corrective mandatory actions are worth 3 points. They reduce the impact of an incident rather than preventing it.
D. Preventative discretionary actions are worth 9 points, because they rely on users following them rather than being centrally enforced.

Source: Compliance Manager scoring - Microsoft Learn

Correct answer: D
Trainable classifiers learn to recognize types of content by looking at examples, rather than matching a pattern. Microsoft provides pretrained classifiers that are ready to use (for common categories such as resumes and contracts), and organizations can build custom trainable classifiers by providing their own positive and negative examples.

Why other options are incorrect
A. Sensitive information types are pattern-based classifiers (regular expressions, keywords, checksums) for well-structured data like credit card or bank account numbers. They can’t reliably recognize a category of document such as a contract.
B. A keyword dictionary matches specific words. It doesn’t understand what kind of document it’s looking at, so it would produce many false matches here.
C. Exact data match detects specific known values from a sensitive database (such as a list of customer records). It doesn’t classify documents by type.

Source: Learn about trainable classifiers - Microsoft Learn

Correct answer: C
Activity explorer shows activities on labeled and classified content, such as a label applied, changed (upgraded or downgraded), or removed, a file read, DLP policy matches, and endpoint activities like copying to USB. It covers up to 30 days of data, taken from the Microsoft 365 unified audit log.

Why other options are incorrect
A. Content explorer shows a current snapshot of items that have sensitivity labels, retention labels, or sensitive information types, and where they’re stored. It doesn’t show the history of actions users took on them.
B. Compliance Manager tracks regulatory compliance posture and improvement actions, not user activity on labeled files.
D. The Service Trust Portal provides Microsoft’s compliance and audit documentation. It has no view of activity in your tenant.

Source: Get started with activity explorer - Microsoft Learn

Correct answer: A
Sensitivity labels in Microsoft Purview Information Protection can apply encryption (controlling who can access content), content markings (watermarks, headers, and footers), and protection for containers such as Teams, Microsoft 365 Groups, and SharePoint sites. A label is stored in clear-text metadata and is persistent, so it travels with the content wherever it’s stored or shared. Label policies publish labels to users and groups and can require mandatory labeling or set a default label.

Why other options are incorrect
B. Retention labels control how long content is kept and when it’s deleted. They don’t encrypt content or add visual markings.
C. Conditional Access controls access to apps at sign-in. It doesn’t encrypt or mark individual files that travel outside the organization.
D. Key Vault stores keys and secrets for applications. Its access policies don’t classify or protect individual Office documents and emails.

Source: Learn about sensitivity labels - Microsoft Learn

Correct answer: B
Microsoft Purview data loss prevention (DLP) policies detect sensitive items (such as credit card numbers) across locations including Exchange, SharePoint, OneDrive, Teams chat and channel messages, and devices. They can take protective actions such as showing a policy tip, blocking sharing with an override that captures a justification, blocking with no override, or sending notifications.

Why other options are incorrect
A. Insider Risk Management correlates many risk indicators to detect risky user behavior over time. It doesn’t block individual messages in real time with policy tips.
C. Records management governs how long content is kept and declares items as records. It doesn’t block sharing.
D. eDiscovery finds, holds, and exports content for legal cases. It doesn’t prevent data from being shared.

Source: Learn about data loss prevention - Microsoft Learn

Correct answer: D
When several retention settings apply to the same item, Microsoft Purview uses the principles of retention: (1) retention wins over deletion, (2) the longest retention period wins, (3) explicit wins over implicit for deletions, and (4) the shortest deletion period wins. Here, both settings retain content, so the document is kept until the end of the longer 7-year period.

Why other options are incorrect
A. Container-level retention policies don’t take precedence over longer retention periods. The longest retention period always wins.
B. Retention settings don’t cancel each other out, and while retention applies, content can’t be permanently deleted just because a user deletes it.
C. Conflicting retention settings never cause immediate deletion. Retention always wins over deletion.

Source: Learn about retention policies and retention labels - Microsoft Learn

Correct answer: C
Microsoft Purview records management uses retention labels to declare items as records. For regulatory records, editing the content, deleting the item, and changing or removing the label are all blocked, and no one can change this once it’s applied, including global administrators. Records management also provides file plans, disposition review, and proof of disposition.

Why other options are incorrect
A. A retention policy keeps content for a period of time, but it doesn’t make items immutable records whose label can never be removed.
B. A sensitivity label with encryption controls who can read content. It doesn’t stop authorized users from editing or deleting it.
D. DLP stops sensitive content from being shared inappropriately. It doesn’t make content immutable for a retention period.

Source: Learn about records management - Microsoft Learn

Correct answer: A
Microsoft Purview Insider Risk Management helps detect, investigate, and act on malicious and inadvertent insider risks. It has policy templates such as data theft by departing users and data leaks, and follows a workflow of policies, alerts, triage, investigation, and action. It’s built with privacy by design, with usernames pseudonymized by default and role-based access controls.

Why other options are incorrect
B. Audit records user and admin activities for searching and investigation, but it doesn’t correlate risk indicators into insider risk alerts using policy templates.
C. ID Protection detects external identity compromise (for example, leaked credentials). It isn’t designed to detect data theft by legitimate employees.
D. Compliance Manager measures regulatory compliance posture. It doesn’t monitor user behavior.

Source: Learn about Insider Risk Management - Microsoft Learn

Correct answer: B
Microsoft Purview eDiscovery is built around cases, which hold the searches, holds (to preserve electronically stored information from deletion), and exports for an investigation. It can search Exchange Online, Teams, Microsoft 365 Groups, OneDrive, SharePoint, and Viva Engage. Premium features, such as review sets, analytics, and near-duplicate detection, require an E5 subscription.

Why other options are incorrect
A. DLP prevents sensitive data from being shared. It doesn’t preserve content for litigation or export it for legal review.
C. Content explorer shows a snapshot of where labeled and sensitive items are. It can’t place content on legal hold or export it for a case.
D. Activity explorer shows the history of actions on labeled content. It doesn’t preserve or export content for litigation.

Source: Learn about eDiscovery - Microsoft Learn

Correct answer: D
Audit (Premium) builds on Audit (Standard) with intelligent insights, such as the MailItemsAccessed event, which shows when mail items were accessed and helps investigators work out the scope of a compromise. It also offers one-year default retention for Exchange, SharePoint, Microsoft Entra ID, and OneDrive audit records (up to 10 years with an add-on license), and higher-bandwidth access to the Office 365 Management Activity API.

Why other options are incorrect
A. Audit (Standard) has 180-day default retention and doesn’t include the intelligent insight events such as MailItemsAccessed.
B. Activity explorer shows activity on labeled content over up to 30 days. It isn’t a mailbox forensic audit tool with year-long retention.
C. Communication Compliance detects inappropriate or risky messages based on policy. It isn’t used to rebuild which mailbox items an attacker accessed.

Source: Learn about auditing solutions in Microsoft Purview - Microsoft Learn