Get Microsoft SC-900 Exam Practice Questions - Real and Updated

Answer : D

In Microsoft's shared responsibility model for Azure, responsibilities are divided between Microsoft and the customer. Microsoft Learn explains that Microsoft is responsible for security of the cloud, while customers are responsible for security in the cloud. The platform owner's scope includes the underlying facilities and infrastructure. As the documentation states: ''Microsoft is responsible for the security OF the cloud, which includes protecting the infrastructure that runs all of the services offered in Microsoft Azure,'' and this encompasses ''physical datacenters, physical hosts, and the physical network.'' The customer, by contrast, is responsible for items within their tenant and workloads, including ''data, endpoints, accounts, and access management,'' as well as configuration of services, identities, and devices.

Applied to the options given: managing mobile devices (A), setting permissions for user data (B), and creating/managing user accounts (C) fall under the customer's responsibility because they relate to identity, access, data, and endpoint management within the tenant. The one item that Microsoft solely manages is the physical layer---the ''physical hardware and facilities'' that host Azure services. Therefore, the correct answer is D. the management of the physical hardware.

Answer : A, B, D

Microsoft Purview Data Loss Prevention (DLP) defines supported service locations for policy enforcement. The Microsoft Learn/SCI materials state that DLP policies ''help protect sensitive information across Microsoft 365 services'' and can be scoped to common workloads. In the DLP overview, Microsoft explicitly lists the core cloud locations: ''You can create DLP policies that protect content in Exchange Online, SharePoint Online, and OneDrive for Business.'' The Teams workload is also included: ''DLP can monitor and take protective actions on Microsoft Teams chat and channel messages.'' These statements confirm that applying a DLP policy to Exchange Online email (A), OneDrive accounts (B), and Teams chat and channel messages (D) is supported.

By contrast, Exchange Online public folders (C) are not listed among supported DLP locations in the SCI documentation, and Viva Engage (formerly Yammer) (E) is not a standard Microsoft Purview DLP location in the core list above (Viva Engage has separate governance and communication compliance controls). Therefore, from the supported locations enumerated in Microsoft's DLP guidance, the correct answers are Exchange Online email, OneDrive accounts, and Teams chat and channel messages.

Answer : D

To on-board Azure Sentinel, you first need to connect to your security sources. Azure Sentinel comes with a number of connectors for Microsoft solutions, including Microsoft 365 Defender solutions, and Microsoft 365 sources, including Office 365, Azure AD, Microsoft Defender for Identity, and Microsoft Cloud App Security, etc.

https://docs.microsoft.com/en-us/azure/sentinel/overview

Answer : A, C

Microsoft Purview Data Loss Prevention (DLP) is designed to prevent the inadvertent or inappropriate sharing of sensitive data across Microsoft 365 services. Microsoft's guidance states that DLP ''helps you discover, monitor, and protect sensitive items across Microsoft 365,'' and that with DLP policies you can ''identify, monitor, and automatically protect sensitive items in Exchange Online, SharePoint Online, OneDrive for Business, and Microsoft Teams.'' This directly supports option C, because DLP can detect sensitive info in OneDrive documents and automatically apply protective actions such as blocking external sharing, restricting access, or auditing the event.

DLP also provides end-user coaching through policy tips: ''Policy tips are informative notices that appear when users are working with content that contains sensitive info ... to help prevent data loss.'' When a user is about to send or share sensitive data in violation of policy, these tips surface in Outlook and Office apps (including when files are stored in SharePoint/OneDrive), aligning with option A.

By contrast, enabling disk encryption (e.g., BitLocker) and applying device security baselines are endpoint/device management tasks handled through Microsoft Intune or Group Policy---not by DLP. Therefore, A and C are the correct tasks you can implement with Microsoft 365 DLP policies.

Answer : D, E

Microsoft's official description of Azure Key Vault in the Security, Compliance, and Identity learning materials states that Key Vault is ''a cloud service for securely storing and accessing secrets.'' The same guidance clarifies that ''a secret is anything you want to tightly control, such as API keys, passwords, or connection strings.'' In addition to secrets, Key Vault provides key management: ''Azure Key Vault helps safeguard cryptographic keys and secrets used by cloud applications and services.'' It further explains that organizations can ''generate, import, rotate, disable, and delete keys'' and use them for operations such as ''encrypt and decrypt, sign and verify, wrap and unwrap.'' These excerpts confirm that Key Vault's core capabilities include the secure storage and lifecycle management of secrets and cryptographic keys.

By contrast, the SCI content makes clear that infrastructure features like Azure DDoS Protection and Network Security Groups (NSGs) are networking/security controls delivered by Azure networking services, not Key Vault. Likewise, ARM templates are deployment artifacts stored in repositories such as Azure Repos or GitHub; Key Vault does not store or manage template files. Therefore, the two correct actions you can perform with Azure Key Vault---aligned with Microsoft's documentation---are to store (and manage) keys and store (and manage) secrets.