SC-900 Free Practice Questions — Page 4 (2026)

Question 32

What can you use to protect against malicious links sent in email messages, chat messages, and channels?

A. Microsoft Defender for Cloud Apps

B. Microsoft Defender for Office 365

C. Microsoft Defender for Endpoint

D. Microsoft Defender for Identity

Show Answer

Correct Answer: B

Explanation:
Microsoft Defender for Office 365 includes Safe Links, which protects users from malicious URLs in email, Microsoft Teams chat messages, and channels by rewriting and checking links at the time they are clicked. The other Defender products focus on cloud apps, endpoints, or identities rather than email and collaboration link protection.

Question 33

HOTSPOT - Select the answer that correctly completes the sentence.

Show Answer

Correct Answer: access

Explanation:
Azure AD dynamic groups automatically manage group membership based on user or device attributes, which helps automate the access lifecycle by assigning and removing access as membership changes.

Question 34

HOTSPOT - For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Show Answer

Correct Answer: Yes Yes Yes

Explanation:
Microsoft Defender for Cloud combines DevSecOps capabilities, Cloud Security Posture Management (CSPM), and Cloud Workload Protection Platform (CWPP) capabilities according to Microsoft documentation.

Question 35

What is Azure Key Vault used for?

A. to deploy a cloud-based network security service that protects Azure virtual network resources

B. to protect cloud-based applications from cyber threats and vulnerabilities

C. to safeguard cryptographic keys and other secrets used by cloud apps and services

D. to provide secure and seamless RDP/SSH connectivity to Azure virtual machines via TLS from the Azure portal

Show Answer

Correct Answer: C

Explanation:
Azure Key Vault is a managed Azure service for securely storing and controlling access to secrets, cryptographic keys, and certificates used by applications and services. The other options describe Azure Firewall/Application Gateway WAF, Microsoft Defender services, or Azure Bastion.

Question 36

You have an Azure subscription that contains a Log Analytics workspace. You need to onboard Microsoft Sentinel. What should you do first?

A. Create a hunting query.

B. Correlate alerts into incidents.

C. Connect to your data sources.

D. Create a custom detection rule.

Show Answer

Correct Answer: C

Explanation:
The first step in onboarding Microsoft Sentinel to an existing Log Analytics workspace is to connect data sources using built-in data connectors. Sentinel requires ingested security data before you can create analytics rules, correlate alerts into incidents, or perform hunting.

Question 37

HOTSPOT - Select the answer that correctly completes the sentence.

Show Answer

Correct Answer: override

Explanation:
Azure NSG default security rules cannot be deleted or modified directly, but you can override their effect by creating custom rules with a higher priority (lower priority number).

Question 38

Which Microsoft portal provides information about how Microsoft cloud services comply with regulatory standard, such as International Organization for Standardization (ISO)?

A. the Microsoft 365 admin center

B. Azure Cost Management + Billing

C. Microsoft Service Trust Portal

D. the Microsoft Purview compliance portal

Show Answer

Correct Answer: C

Explanation:
The Microsoft Service Trust Portal provides information about Microsoft cloud services' compliance with regulatory standards and certifications, including ISO, SOC, GDPR, and other compliance documentation, audit reports, and trust resources. The Microsoft Purview compliance portal is used to manage an organization's compliance features rather than to access Microsoft's own compliance attestations.

Question 39

HOTSPOT - Select the answer that correctly completes the sentence.

Show Answer

Correct Answer: a cloud infrastructure entitlement management (CIEM) solution.

Explanation:
Microsoft Entra Permissions Management is Microsoft's CIEM offering, providing visibility and governance of permissions across multi-cloud environments.

Question 40

Which solution performs security assessments and automatically generates alerts when a vulnerability is found?

A. cloud security posture management (CSPM)

B. DevSecOps

C. cloud workload protection platform (CWPP)

D. security information and event management (SIEM)

Show Answer

Correct Answer: A

Explanation:
Cloud Security Posture Management (CSPM) continuously assesses cloud resources for security misconfigurations and vulnerabilities, producing recommendations and alerts when issues are identified. DevSecOps is a development practice, CWPP focuses on protecting workloads rather than performing posture assessments, and SIEM aggregates and analyzes security events but does not itself perform vulnerability assessments.

Question 41

Which Microsoft Purview solution can be used to identify data leakage?

A. insider risk management

B. Compliance Manager

C. communication compliance

D. eDiscovery

Show Answer

Correct Answer: A

Explanation:
Microsoft Purview Insider Risk Management is designed to detect, investigate, and respond to risky insider activities, including potential data leakage and data exfiltration. Compliance Manager assesses compliance posture, Communication Compliance monitors communications for policy violations, and eDiscovery is used to identify and collect content for legal or investigative purposes rather than proactively identifying data leakage.