Microsoft SC-900 Microsoft Security, Compliance, and Identity Fundamentals Exam Dumps and Practice Test Questions Set 7 Q91-105
Visit here for our full Microsoft SC-900 exam dumps and practice test questions.
Question 91
Which Microsoft service provides a unified framework for classifying, labeling, and protecting sensitive data across Microsoft 365, Windows, and Azure services?
A) Microsoft Information Protection
B) Microsoft Defender for Endpoint
C) Azure Virtual Desktop
D) Microsoft Purview eDiscovery
Correct Answer: A) Microsoft Information Protection
Explanation
Microsoft Information Protection, often referred to as MIP, is the centralized framework within the Microsoft ecosystem that enables organizations to identify, classify, label, and protect sensitive information wherever it resides. Its core purpose is to ensure that data remains secure throughout its lifecycle, whether it is being created, stored, shared, or transmitted. MIP relies on sensitivity labels, which can be applied to emails, documents, and files either manually by users or automatically through predefined rules. These labels determine how the content should be handled and what level of protection should be enforced. Depending on the label assigned, MIP can apply encryption to restrict unauthorized access, add watermarking or visual markings to signal sensitivity, enforce permissions on who can read or modify the content, and track document usage to provide insights into how protected files are accessed.
A major strength of Microsoft Information Protection is its ability to integrate seamlessly across the Microsoft 365 environment, Windows endpoints, and Azure-based services. This consistency ensures that sensitive information is protected no matter where it travels. A file labeled as confidential on a user’s device will retain that label if it is shared through SharePoint, emailed through Outlook, or accessed through Teams. This unified approach makes MIP a powerful tool for maintaining strict data governance and reducing the risk of accidental or intentional data exposure.
While several other Microsoft technologies contribute to security and compliance, they do not serve the same purpose as Microsoft Information Protection. Microsoft Defender for Endpoint, for example, is designed to provide advanced endpoint detection and response capabilities. It focuses on threat protection, malware detection, vulnerability management, and real-time security monitoring. Although it plays a vital role in securing devices, it does not classify, label, or protect content. It cannot apply sensitivity labels because its mission is centered on detecting and responding to endpoint threats rather than managing data protection policies.
Azure Virtual Desktop is another useful service, offering organizations the ability to deliver secure, remote Windows environments to users. It provides flexibility, centralized management, and secure access to applications and desktops, but it does not include built-in capabilities for data classification or labeling. Content created or accessed within an Azure Virtual Desktop session still relies on MIP to enforce labeling and protection.
Microsoft Purview eDiscovery is also important for legal, audit, and regulatory scenarios. It enables organizations to search for relevant content, place legal holds on data, and export materials needed for investigations or court proceedings. However, eDiscovery tools operate primarily in a reactive and investigative capacity. They do not classify data during everyday usage and cannot enforce content protection as part of routine workflows.
MIP differentiates itself by using machine learning models, content inspection methods, and an extensive library of predefined sensitive information types to automate the classification process. It recognizes patterns such as financial data, personally identifiable information, and health records. By preventing unauthorized sharing and reinforcing compliance with regulations, including GDPR, PCI-DSS, and HIPAA, MIP ensures that sensitive data is consistently protected across the organization. This comprehensive and proactive data protection capability makes MIP the correct and most effective solution for managing sensitive information within the Microsoft environment.
Question 92
Which feature in Microsoft Entra ID allows users to authenticate using additional verification methods such as codes, biometrics, or app notifications?
A) Conditional Access
B) Multi-Factor Authentication
C) Privileged Identity Management
D) Identity Protection
Correct Answer: B) Multi-Factor Authentication
Explanation
Multi-Factor Authentication, commonly known as MFA, is a critical security control used to strengthen the login process and protect user accounts from unauthorized access. It works by requiring users to authenticate using at least two different categories of verification: something they know, something they have, or something they are. Something you know typically refers to a password or PIN, something you have includes devices such as a mobile phone or an authentication app, and something you are refers to biometric identifiers like fingerprints or facial recognition. By combining these different types of authentication factors, MFA makes it substantially more difficult for attackers to compromise an account, even if they manage to obtain a user’s password. This layered defense greatly reduces the likelihood of account takeovers and is one of the most effective methods for protecting against credential-based attacks.
Although MFA is often associated with broader access control systems, it is important to understand that it is a standalone authentication mechanism, not a policy engine. Conditional Access, for instance, plays a key role in controlling and regulating how and when users can access certain applications or resources. Conditional Access policies may evaluate signals such as user location, device compliance, risk score, or network conditions before granting access. While Conditional Access can require MFA as a condition for access, it does not perform the authentication itself. Instead, it uses MFA as a tool within its policy enforcement framework, meaning the authentication factor verification still comes directly from the MFA system.
Privileged Identity Management, or PIM, is another important service within identity governance, but it serves a different purpose. PIM is designed to manage privileged roles in an organization, offering features like just-in-time access, approval workflows, role activation, and time-bound permissions. These functions help reduce standing admin rights and limit exposure from overly permissive access. However, PIM does not handle authentication or verify identity using multiple factors. It often works alongside MFA, requiring privileged users to complete an MFA challenge when activating elevated roles, yet it still relies on the MFA mechanism to complete the verification.
Identity Protection adds another layer to identity security by analyzing user behavior, sign-in patterns, and risk indicators. It can detect risky sign-ins, compromised identities, and unusual patterns that suggest malicious activity. When Identity Protection identifies a high-risk event, it can trigger Conditional Access policies to enforce extra requirements, such as completing MFA, resetting passwords, or blocking access entirely. However, Identity Protection itself does not perform secondary authentication. Instead, it provides the risk insights and signals that inform Conditional Access, which then requires MFA to verify user identity.
Despite the roles of these complementary services, MFA remains the only mechanism that actually verifies a user using multiple authentication factors. It completes the identity check by confirming that the user not only knows a secret like a password but also possesses a trusted device or can present biometric proof. This layered verification is why MFA is considered one of the strongest defenses against phishing, credential theft, and brute-force attacks.
By combining MFA with Conditional Access, PIM, and Identity Protection, organizations establish a robust, adaptive security framework. Each component contributes differently, but only MFA performs the actual multi-factor verification that protects user identities from compromise.
Question 93
Which Microsoft Purview solution allows organizations to search, review, and export content for legal investigations?
A) Data Loss Prevention
B) eDiscovery
C) Information Barriers
D) Insider Risk Management
Correct Answer: B) eDiscovery
Explanation
eDiscovery enables legal teams to search, preserve, review, and export organizational data such as emails, Teams messages, SharePoint files, and OneDrive documents. It supports audit trails, legal holds, case management, and defensible data export.
Data Loss Prevention prevents data leakage—not legal review. Information Barriers restrict communication between groups. Insider Risk Management monitors risky employee behavior. Only eDiscovery provides a full legal case workflow, so it is correct.
Question 94
Which SIEM solution from Microsoft aggregates logs from cloud and on-premises systems to detect, investigate, and respond to security threats?
A) Microsoft Defender for Cloud Apps
B) Microsoft Sentinel
C) Azure Monitor
D) Microsoft Secure Score
Correct Answer: B) Microsoft Sentinel
Explanation
Microsoft Sentinel is a cloud-native security information and event management platform that enables organizations to detect, investigate, and respond to threats across their entire environment. Unlike traditional monitoring tools, Sentinel centralizes the collection of logs from a wide variety of sources, including Microsoft 365, Azure services, on-premises infrastructure, firewalls, identity providers, and third-party applications. Aggregating these logs provides a unified view of security events, allowing security teams to correlate data across systems and identify patterns that may indicate malicious activity.
One of Sentinel’s key strengths is its integration of artificial intelligence and machine learning to analyze incoming data. This allows the platform to identify potential threats quickly and accurately, reducing the time security teams spend sifting through alerts manually. When suspicious activity is detected, Sentinel generates incident alerts and provides detailed investigation tools to help analysts understand the scope and impact of a threat. Additionally, it includes automation and orchestration capabilities, enabling organizations to automatically respond to incidents through predefined workflows, such as blocking accounts, isolating compromised systems, or notifying relevant teams.
While other Microsoft security tools offer complementary functions, they do not provide the same comprehensive SIEM capabilities as Sentinel. Microsoft Defender for Cloud Apps primarily focuses on monitoring SaaS application usage and does not offer broad log aggregation or cross-system threat analysis. Azure Monitor collects and tracks performance metrics, but it lacks full security investigation workflows. Secure Score evaluates an organization’s security posture and provides recommendations, yet it does not gather or correlate log data to detect incidents.
Because it combines real-time log collection, intelligent threat detection, incident management, and automated response, Sentinel is uniquely positioned as a SIEM and SOAR solution. Organizations seeking end-to-end visibility into security events, advanced analytics, and automated mitigation will find Sentinel to be the most effective tool in this context, making it the clear choice for centralized threat monitoring and response.
Question 95
Which feature in Microsoft Defender for Cloud helps organizations benchmark their cloud environment against regulatory requirements like CIS and PCI-DSS?
A) Secure Score
B) Adaptive Application Controls
C) Just-in-Time VM Access
D) Microsoft Entra Connect
Correct Answer: A) Secure Score
Explanation
Secure Score is a security assessment tool designed to help organizations measure, understand, and improve their overall security posture across Azure, Microsoft 365, and hybrid environments. It provides a centralized view of how well an organization’s configurations align with recommended security best practices and established compliance standards. By evaluating settings, controls, and security behaviors, Secure Score generates a numerical value that reflects the current level of protection. This score not only highlights strengths and weaknesses but also gives organizations a practical roadmap for strengthening their defenses.
One of the core advantages of Secure Score is its ability to assess configuration gaps and map them to known regulatory frameworks. These frameworks may include industry standards, privacy regulations, or internal governance requirements. By correlating the effectiveness of existing controls with regulatory expectations, Secure Score offers transparency into compliance readiness. Organizations can review risk severity ratings, recommendations for improvement, and detailed explanations of why certain configurations may expose them to vulnerabilities. These insights allow teams to prioritize security tasks based on potential impact, making remediation efforts more targeted and efficient.
Secure Score’s recommendations are actionable and help administrators focus on practical steps that yield meaningful scoring improvements. These steps may include enabling multi-factor authentication, adjusting configuration settings, improving device compliance, strengthening identity protections, or enhancing cloud workload security. Each recommended action includes guidance, anticipated benefits, and the effect it will have on the organization’s score once completed. This structured approach helps security teams track progress over time and demonstrate measurable improvement to leadership and auditors.
Several other Microsoft security tools play important roles in protecting cloud and hybrid environments, but they do not provide posture scoring or compliance-based assessments. Adaptive Application Controls in Defender for Cloud, for example, help organizations restrict which applications can run on virtual machines. By allowing only trusted applications to execute, this feature reduces exposure to malicious software and unauthorized programs. However, it does not evaluate overall security posture or provide scoring metrics tied to compliance requirements.
Just-in-Time VM Access is another powerful security feature aimed at preventing brute-force attacks and unauthorized access to virtual machines. It works by limiting open management ports and allowing temporary access only when needed. Although it is an important defensive control, its purpose is narrowly focused on access protection rather than comprehensive posture evaluation.
Microsoft Entra Connect is designed to synchronize identity data between on-premises directories and Microsoft Entra ID, ensuring seamless identity management for hybrid environments. While it is essential for enabling unified authentication and user identity consistency, it does not assess security configurations or provide posture scoring against compliance baselines.
Because these tools have specialized functions but do not measure an organization’s readiness or configuration strength, Secure Score remains the correct and comprehensive solution for evaluating and improving posture. It brings together insights across Microsoft 365, Azure, and hybrid infrastructures into one actionable dashboard, enabling organizations to strengthen security strategically.
Secure Score provides a holistic, structured, and measurable way to assess security posture, identify gaps, and prioritize improvements. By guiding organizations through best practices and mapping actions to compliance frameworks, it serves as a crucial resource for maintaining a strong and resilient security environment across the cloud and beyond.
Question 96
A company wants to strengthen its identity security. They need a tool that continuously analyzes user behavior, detects risky sign-ins, and automatically triggers remediation actions such as requiring a password reset or MFA. Which Microsoft solution meets this requirement?
A) Microsoft Defender for Cloud
B) Microsoft Entra ID Identity Protection
C) Microsoft Purview DLP
D) Azure Monitor Logs
Correct Answer: B) Microsoft Entra ID Identity Protection
Explanation
Microsoft Entra ID Identity Protection is a specialized solution designed to uncover and address identity-related threats by analyzing patterns and behaviors across an organization’s environment. It leverages machine learning, global threat intelligence, and detailed behavioral analytics to detect unusual or potentially dangerous activities. This includes identifying risky sign-ins that may indicate compromised credentials, spotting users who exhibit suspicious behavior patterns, and determining when passwords or accounts have been exposed. Once these risks are detected, the system can automatically take action to contain potential threats. Depending on the severity or type of risk, it may require a user to complete multi-factor authentication, initiate a forced password reset, or even block access altogether until the issue is resolved. This level of automation ensures that identity risks are mitigated quickly and consistently without waiting for manual intervention.
For organizations seeking ongoing visibility into identity threats and immediate responses to suspicious activity, Identity Protection provides a direct and effective answer. Its continuous monitoring capabilities allow security teams to stay informed about emerging risks while relying on automated policies to neutralize threats in real time.
Other Microsoft security and compliance tools address different areas and therefore do not meet these identity-specific requirements. Microsoft Defender for Cloud focuses on cloud infrastructure, resource configuration, and workload protection. While it enhances overall cloud security, it does not analyze sign-in patterns or detect user-based anomalies. Microsoft Purview Data Loss Prevention is centered on preventing sensitive information from being shared improperly, and does not monitor authentication risks. Azure Monitor Logs can collect and analyze various logs from across the environment, but it does not provide built-in identity risk scoring, nor does it automate remediation steps tied to user behavior.
Because it directly targets identity threats with both detection and automated response, Identity Protection is the most appropriate choice for managing risky sign-ins and safeguarding credentials.
Question 97
An organization needs a tool to enforce policies that prevent employees from copying sensitive information to USB drives, printing restricted documents, or emailing confidential files outside the company. Which solution should they use?
A) Microsoft Purview Data Loss Prevention
B) Microsoft Sentinel
C) Microsoft Defender for Identity
D) Azure Information Protection Scanner
Correct Answer: A) Microsoft Purview Data Loss Prevention
Explanation
Microsoft Purview Data Loss Prevention (DLP) allows organizations to create rules that prevent sensitive information from being misused or leaked. DLP policies can monitor and restrict actions such as copy/paste operations, file uploads, printing, emailing outside the tenant, or saving data to removable media. Since the company wants to prevent USB copying, printing, and external sharing, endpoint and cloud DLP policies directly support this scenario.
Microsoft Sentinel is a SIEM/SOAR platform that monitors alerts and logs, but cannot enforce real-time restrictions like blocking USB copying. Microsoft Defender for Identity monitors on-premises Active Directory attacks but does not manage document restrictions. Azure Information Protection Scanner identifies sensitive data in an on-prem file share, but cannot enforce real-time action restrictions. Thus, Purview DLP is the proper solution.
Question 98
A security team wants to generate detailed reports showing how many sensitive documents were accessed, shared externally, labeled, or modified over time. They also want insights into the organization’s compliance posture. Which Microsoft tool provides this capability?
A) Microsoft Purview Compliance Manager
B) Microsoft Entra PIM
C) Microsoft Defender for Cloud Apps
D) Microsoft Defender for Endpoint
Correct Answer: A) Microsoft Purview Compliance Manager
Explanation
Microsoft Purview Compliance Manager is a comprehensive compliance and governance solution designed to help organizations assess, monitor, and improve their regulatory and internal policy adherence across Microsoft 365 and other integrated environments. It provides automated compliance assessments that evaluate an organization’s current configuration, practices, and controls against multiple regulations, industry standards, and internal policies. These assessments are not limited to a single standard; rather, they cover a wide range of frameworks such as GDPR, HIPAA, ISO, NIST, and other regional or industry-specific compliance requirements. By offering a centralized view of compliance posture, Compliance Manager allows organizations to identify gaps, prioritize remediation actions, and track progress toward achieving compliance objectives.
One of the key strengths of Compliance Manager is its ability to generate actionable improvement recommendations. For each assessment, the system provides detailed guidance on what actions are required to address gaps, including step-by-step instructions and links to relevant Microsoft 365 features or settings. This level of guidance reduces the complexity of compliance management, allowing security and compliance teams to take direct action without needing extensive manual research. Additionally, the platform tracks these actions, enabling administrators to demonstrate accountability, progress, and due diligence during audits or regulatory reviews.
Compliance Manager also includes advanced analytics and reporting capabilities. It provides insights into data protection trends, usage of sensitivity labels, sharing of documents externally, and the organization’s overall security posture. By visualizing these metrics, organizations can identify patterns of potential risk, understand how sensitive data is being handled, and ensure that data governance policies are effectively enforced across users and departments. The system’s reporting features are particularly valuable for auditing purposes, as they offer detailed, traceable documentation of compliance efforts and policy enforcement.
In contrast, other Microsoft security and governance tools serve important roles but do not meet the same reporting and compliance-focused requirements. Entra Privileged Identity Management (PIM) is designed to manage privileged roles, enable just-in-time access, and enforce approval workflows, but it does not provide compliance reporting or track document access and labeling trends. Microsoft Defender for Cloud Apps monitors user activity in SaaS applications, identifies risky behavior, and applies conditional access or session policies; however, its primary focus is on cloud app behavior rather than detailed regulatory compliance assessments. Similarly, Microsoft Defender for Endpoint monitors device security risks, tracks malware detection, and observes endpoint activity, but it does not analyze label usage, external sharing patterns, or compliance posture at the organizational level.
Microsoft Purview Compliance Manager is purpose-built to fill this gap. By providing automated assessments, actionable improvement guidance, detailed reporting, and analytics across multiple regulations and internal policies, it delivers an integrated, centralized approach to governance and compliance. It enables organizations to maintain audit-ready visibility, identify and remediate compliance risks proactively, and improve data protection practices systematically. For organizations seeking a tool to monitor, manage, and report on compliance efforts effectively, Compliance Manager is the most suitable and comprehensive solution within the Microsoft 365 ecosystem.
Question 99
A company has multiple security administrators who need temporary elevated access to critical roles such as Global Administrator or Security Administrator. They want these permissions to expire automatically after a set time. Which tool should they use?
A) Microsoft Entra Privileged Identity Management
B) Microsoft Entra Identity Protection
C) Azure role-based access control
D) Microsoft Purview eDiscovery
Correct Answer: A) Microsoft Entra Privileged Identity Management
Explanation
Microsoft Defender for Cloud Apps, previously known as Microsoft Cloud App Security, is a specialized cloud access security broker (CASB) designed to give organizations comprehensive visibility and control over user interactions with third-party cloud applications. As enterprises increasingly rely on SaaS and other cloud services, managing access and monitoring data activity has become critical for maintaining security and compliance. Defender for Cloud Apps provides the tools to meet these needs by combining real-time monitoring, session controls, app discovery, and policy enforcement within a unified platform.
One of the central features of Defender for Cloud Apps is its ability to monitor user activity in real time. This includes tracking actions such as file uploads and downloads, sharing of sensitive information, and access to unsanctioned applications. By identifying suspicious behaviors or violations of organizational policies, administrators can receive alerts and respond proactively to potential risks. This ensures that sensitive corporate data is protected from accidental exposure or malicious activity while maintaining a seamless user experience.
In addition to monitoring, Defender for Cloud Apps enforces session controls to manage how users interact with cloud applications. For example, it can restrict downloads, prevent the copy-paste of confidential information, or enforce read-only access to critical files. These controls help balance security with productivity, allowing employees to collaborate in cloud environments without jeopardizing sensitive data. Even in cases where users attempt to bypass rules, session controls act as a real-time safeguard to prevent unauthorized activity.
Defender for Cloud Apps also provides application discovery and risk assessment capabilities. By analyzing traffic logs and network activity, it can detect the use of both sanctioned and unsanctioned cloud applications, commonly referred to as shadow IT. Organizations gain a clear understanding of which cloud services are being accessed and can implement policies to sanction, restrict, or block high-risk applications. This visibility is essential for reducing potential attack surfaces, maintaining compliance, and ensuring that all cloud applications are aligned with organizational security standards.
Unlike other Microsoft solutions, such as Purview eDiscovery, Azure Firewall, or Microsoft Sentinel, Defender for Cloud Apps is uniquely focused on controlling and monitoring third-party cloud applications. While eDiscovery supports legal and compliance investigations, Azure Firewall manages network traffic, and Sentinel aggregates logs for threat detection, none of these provides the combination of real-time activity monitoring, session enforcement, and policy-based control over cloud apps.
By integrating monitoring, enforcement, and discovery, Defender for Cloud Apps helps organizations prevent data leaks, mitigate shadow IT risks, and comply with regulatory requirements while enabling secure collaboration in cloud environments. Its comprehensive approach makes it an essential tool for managing the modern cloud landscape.
Question 100
A company wants to detect when users upload sensitive files to unsanctioned cloud storage services such as Dropbox or Google Drive. They want alerts and automatic session controls to block downloads. Which Microsoft solution is best suited?
A) Microsoft Defender for Cloud Apps
B) Microsoft Purview eDiscovery
C) Azure Firewall
D) Microsoft Sentinel
Correct Answer: A) Microsoft Defender for Cloud Apps
Explanation
Microsoft Defender for Cloud Apps, formerly known as Microsoft Cloud App Security (MCAS), is a comprehensive cloud access security broker (CASB) solution that helps organizations monitor, protect, and control their use of cloud applications and services. Its primary function is to provide visibility into cloud activity, enforce security policies, and mitigate risks associated with unsanctioned or risky app usage. As cloud adoption continues to grow across enterprises, the ability to monitor how users interact with SaaS and other cloud services has become critical, and Defender for Cloud Apps delivers this capability effectively.
One of the key features of Defender for Cloud Apps is real-time activity monitoring. The platform tracks user interactions with cloud applications, identifying suspicious behaviors such as large file uploads, sharing sensitive data externally, or accessing apps that are not approved by the organization. Administrators can configure alerts for unusual or risky activity, allowing them to respond quickly to potential security threats. This proactive monitoring ensures that sensitive organizational data is not inadvertently exposed or misused, and that policy violations are detected before they escalate into major incidents.
Another important capability is the creation and enforcement of session controls. Defender for Cloud Apps can implement real-time restrictions, such as blocking downloads, preventing the copy-paste of sensitive data, or enforcing read-only access to files stored in cloud apps. These controls allow organizations to maintain a balance between productivity and security, enabling users to collaborate in the cloud without putting critical data at risk. Session controls also provide an additional layer of protection for sensitive files, ensuring that even if users attempt to share data inappropriately, the system can intervene automatically.
Defender for Cloud Apps also includes application discovery and risk assessment features. Through integration with traffic logs and network analysis, it can identify the cloud services being used across the organization, including those that are unsanctioned or unknown. By mapping cloud usage, security teams gain insights into potential shadow IT risks, which are often difficult to detect without a CASB. Organizations can then create policies to sanction or block high-risk applications, helping to maintain compliance and reduce exposure to data breaches.
It is important to distinguish Defender for Cloud Apps from other Microsoft security solutions, which, while valuable, do not provide the same functionality. Purview eDiscovery, for example, is designed to support legal investigations and compliance-related data searches, but it does not monitor cloud activity in real time or enforce session controls. Azure Firewall protects network traffic by controlling ingress and egress, but it cannot detect sensitive file uploads to external SaaS providers or enforce app-specific policies. Microsoft Sentinel provides log aggregation and correlation for threat detection, but cannot actively enforce access controls or real-time policy enforcement within cloud apps.
Defender for Cloud Apps is the only Microsoft solution specifically engineered to detect, monitor, and control user activity across third-party cloud applications. Its combination of real-time monitoring, session controls, policy enforcement, and app discovery provides organizations with the visibility and control necessary to protect sensitive data in increasingly complex cloud environments. By leveraging these capabilities, organizations can reduce shadow IT risks, prevent data leaks, and maintain regulatory compliance, all while supporting secure cloud collaboration.
Question 101
A company wants to ensure that only devices meeting security requirements—such as encryption, antivirus, OS version compliance, and firewall settings—can access corporate resources. Which Microsoft solution should they implement?
Microsoft Intune Compliance Policies
B) Microsoft Defender for Cloud Apps
C) Microsoft Entra Conditional Access Locations
D) Microsoft Sentinel
Correct Answer: A) Microsoft Intune Compliance Policies
Explanation
Microsoft Intune Compliance Policies provide organizations with the ability to define and enforce security standards for devices before they are allowed to access corporate resources. These policies evaluate multiple aspects of device health, including operating system versions, disk encryption status, antivirus presence and status, firewall activation, and patch compliance. When a device fails to meet the defined compliance requirements, Conditional Access policies can block or restrict its access to organizational applications and data, ensuring that only secure devices are used within the environment. This approach provides a proactive security layer that prevents potential vulnerabilities from exposing sensitive resources.
Microsoft Defender for Cloud Apps primarily focuses on monitoring and securing cloud applications, providing risk assessment, threat detection, and access control. While it integrates with Conditional Access, it does not directly enforce device-level health checks or configurations such as antivirus status or firewall settings. Microsoft Entra Conditional Access Locations allows organizations to define trusted network locations and apply access policies based on location, but it does not evaluate the security posture of the devices themselves. Microsoft Sentinel is a Security Information and Event Management (SIEM) platform that collects and analyzes logs for threat detection, investigation, and response. Although Sentinel is valuable for monitoring security incidents and alerts, it does not enforce device compliance or prevent noncompliant devices from accessing resources.
Intune Compliance Policies uniquely combine device health assessment with automated enforcement mechanisms through Conditional Access. This ensures that only devices that meet the organization’s security standards—covering encryption, antivirus, OS updates, and firewall configuration—can access corporate applications, thereby reducing risk and maintaining organizational security posture. For organizations that require strong endpoint security controls before resource access, Intune Compliance Policies are the most comprehensive and appropriate solution.
Question 102
An organization wants to evaluate its compliance posture against global regulations such as GDPR, ISO 27001, and HIPAA, while providing actionable improvement recommendations. Which Microsoft service should they use?
A) Microsoft Purview Compliance Manager
B) Microsoft Sentinel
C) Microsoft Entra ID Governance
D) Microsoft Defender for Cloud Apps
Correct Answer: A) Microsoft Purview Compliance Manager
Explanation
Microsoft Purview Compliance Manager provides organizations with a centralized dashboard to assess their compliance against regulatory frameworks such as GDPR, ISO 27001, HIPAA, and more. It calculates a compliance score based on the organization’s current implementation of controls and policies and offers actionable recommendations for improving compliance. It tracks progress over time, identifies areas that require attention, and allows organizations to maintain audit-ready documentation.
Microsoft Sentinel is a SIEM solution designed for threat detection and investigation. It does not provide regulatory compliance scoring or improvement recommendations, making it unsuitable for compliance posture management. Microsoft Entra ID Governance focuses on identity lifecycle, role assignments, and entitlement management, but does not provide regulatory compliance evaluation or reporting for entire organizations. Microsoft Defender for Cloud Apps monitors cloud application usage, detects threats, and enforces session and access controls, but it does not provide a compliance score or guidance for global regulations.
Purview Compliance Manager is specifically designed for compliance management. It integrates with Microsoft 365, Azure, and other Microsoft services, providing automated control assessments, actionable insights, and risk prioritization. Organizations can use it to demonstrate compliance with auditors and regulators, track improvement over time, and ensure that policies align with business objectives. Its detailed assessment reports, regulatory templates, and improvement recommendations make it the ideal solution for maintaining compliance in a complex regulatory environment. By using Compliance Manager, companies can systematically measure, monitor, and improve their compliance posture while reducing the risk of regulatory penalties or security gaps.
Question 103
A company wants to implement conditional access policies to allow only compliant and trusted devices to access corporate applications. Which service enables enforcement based on device health and compliance?
A) Microsoft Entra Conditional Access
B) Microsoft Purview Compliance Manager
C) Microsoft Sentinel
D) Microsoft Defender for Cloud Apps
Correct Answer: A) Microsoft Entra Conditional Access
Explanation
Microsoft Entra Conditional Access provides organizations with the ability to enforce access policies based on various conditions, such as user risk, device compliance, location, and application sensitivity. It integrates directly with Intune Compliance Policies to determine whether a device meets security requirements, including encryption, antivirus, and OS updates. When a device fails to meet compliance, Conditional Access can block access or require additional verification, such as multi-factor authentication.
Microsoft Purview Compliance Manager evaluates regulatory compliance posture and provides recommendations, but does not enforce access policies. Microsoft Sentinel monitors logs for threats and anomalies, but does not control access based on device compliance. Microsoft Defender for Cloud Apps provides cloud application visibility and risk monitoring, but does not enforce conditional access policies directly on devices.
Conditional Access is specifically designed to enforce security requirements in real time. Evaluating user and device signals ensures that only trusted and compliant devices can access sensitive resources. This integration with Intune compliance checks provides organizations with a robust security framework that balances usability with protection. Conditional Access helps prevent unauthorized access, reduce the risk of data breaches, and maintain organizational security standards.
Question 104
An organization wants to monitor sign-in activities, detect risky users, and enforce automated protection for compromised accounts. Which Microsoft solution is most appropriate?
A) Microsoft Entra Identity Protection
B) Microsoft Intune Compliance Policies
C) Microsoft Purview Compliance Manager
D) Microsoft Sentinel
Correct Answer: A) Microsoft Entra Identity Protection
Explanation
Microsoft Entra Identity Protection identifies and responds to risky sign-ins, compromised accounts, and unusual user behaviors. It uses machine learning to detect potential threats such as impossible travel, unfamiliar sign-in locations, or leaked credentials. It assigns risk levels to users and sessions, allowing organizations to enforce automated actions like password reset, multi-factor authentication, or temporary blocking.
Intune Compliance Policies focus on device health, not user sign-in risks. Purview Compliance Manager evaluates regulatory compliance but does not detect or mitigate identity threats. Sentinel provides threat monitoring and investigation, but does not automatically enforce protection for compromised accounts.
Entra Identity Protection integrates seamlessly with Conditional Access, allowing automated mitigation of risky users and sessions. It reduces the likelihood of account compromise, improves incident response, and enhances overall identity security. By combining risk detection, user-level assessment, and automated protective actions, Entra Identity Protection ensures that user accounts remain secure while minimizing disruption to legitimate access.
Question 105
A company wants to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. Which Microsoft solution allows policy-based enforcement of MFA?
A) Microsoft Entra Conditional Access
B) Microsoft Sentinel
C) Microsoft Intune Compliance Policies
D) Microsoft Purview Compliance Manager
Correct Answer: A) Microsoft Entra Conditional Access
Explanation
Microsoft Entra Conditional Access provides a powerful framework for organizations that want to strengthen authentication requirements without disrupting legitimate user activity. It allows administrators to create adaptive, rule-based access controls that determine when additional authentication—such as multi-factor authentication (MFA)—is needed. These policies operate by evaluating signals such as user identity, device status, geographic location, application sensitivity, and detected risk levels. When a sign-in attempt meets specific criteria, Conditional Access automatically triggers an MFA challenge, ensuring that only verified and trustworthy users can proceed.
Because these policies function in real time, they offer a responsive approach to security rather than relying on static rules. For instance, if a user typically logs in from one country but suddenly attempts access from another region, a Conditional Access policy can require MFA or even block the request. Similarly, if an identity is flagged for unusual behavior—such as anomalous sign-in patterns or risky activities detected by Microsoft’s identity protection systems—the user may be prompted for stronger authentication. This dynamic decision-making helps organizations protect sensitive resources without overwhelming users with unnecessary authentication prompts.
Administrators have considerable flexibility when configuring Conditional Access. Policies can be applied at scale to all users or tailored to specific departments, roles, or security groups. Organizations may choose to enforce MFA consistently for high-privilege accounts, such as administrators, while applying conditional rules for standard users based on context. These options make it possible to establish a balanced security posture that addresses real threats while still supporting productivity and ease of access.
Although Microsoft Sentinel, Intune, and Purview each contribute to an organization’s security posture, they serve different purposes and do not replace Conditional Access for authentication enforcement. Microsoft Sentinel specializes in collecting and analyzing security logs to identify threats, but it cannot require MFA or control user access directly. Intune Compliance Policies evaluate the health and security posture of devices, ensuring that endpoints meet organizational standards before they can access resources, yet they do not enforce MFA during sign-in. Purview Compliance Manager focuses on regulatory and data compliance, offering assessments and recommendations rather than authentication controls.
What sets Conditional Access apart is its deep integration with Azure Active Directory, which acts as the backbone for authentication across Microsoft cloud services. When Conditional Access evaluates a sign-in, it leverages identity signals from Azure AD to determine whether MFA is necessary. This integration allows the system to enforce strong authentication methods automatically and consistently, without requiring administrators to manually intervene. Users receive prompts only when needed, minimizing friction while maintaining security.
By implementing Conditional Access, organizations significantly reduce the likelihood of account compromise, particularly from credential theft and unauthorized access attempts. The platform’s adaptability ensures that high-value applications and protected resources remain secure even when threat conditions escalate. Ultimately, Conditional Access supports a strategic approach to identity security—one that preserves smooth user experiences while enforcing robust authentication standards across the environment.