Room for pencil and paper.
Print a worksheet, or choose “Save as PDF” in your browser’s print dialog.
Mixed skills
10 original practice questions · Untimed · Follow each question’s response instructions
1. A fictional workshop moves its application from Azure VMs to a PaaS service that manages the operating system. Its review separates operating-system maintenance from decisions about who may read workshop data. Which ownership statement fits the move?
sc900-q-0012. A fictional compliance coordinator needs to assign recommended improvement actions to colleagues, keep implementation/testing evidence with those actions, and track their status. Which Purview capability directly supports that workflow?
sc900-q-0453. A fictional design cooperative wants one service to maintain identity information and supply authentication services to several applications. Which component is the direct fit?
sc900-q-0074. A fictional Sentinel analyst wants to proactively search the organization’s connected security data for a suspected pattern before an alert for that pattern exists. Which capability is the closest fit?
sc900-q-0355. A fictional planning team replaces a rule that trusted requests solely because they originated inside its network. It wants to follow Zero Trust principles while limiting damage if a breach occurs. Which TWO design choices align with that goal? Select exactly TWO.
Select all that apply.
sc900-q-0046. A fictional investigator needs to find which recorded user or administrator performed a supported activity during a specified date range. Which Purview capability is the direct fit for that evidence request?
sc900-q-0537. A fictional publisher runs a scheduled software service that acts under its own identity to retrieve approved publishing jobs. No employee signs in for each run. Which identity category represents the service itself?
sc900-q-0098. A fictional team already assigns the required Azure resource-action permissions to its users. It now needs a separate rule that evaluates sign-in and device signals and requires MFA when the rule’s conditions apply. Which capability directly addresses the newly stated requirement?
sc900-q-0179. A fictional platform team already has the required sign-in conditions and Azure-resource permissions. Its new job is administering directory user records in Microsoft Entra ID. Which permission category should be evaluated for that new job?
sc900-q-01910. A fictional product team wants security findings associated with its development pipelines and application code before deployment. Which Defender for Cloud capability area is the direct fit?
sc900-q-031Answers & reasoning
1. Microsoft takes over operating-system maintenance; the workshop retains responsibility for its data-access decisions · Choice A
Separate the two responsibilities instead of treating a service-model change as transfer of the whole security program. The retained model distinguishes provider-managed operating systems in PaaS from customer responsibility for data, identities and access controls. The first proposal makes that split. Recheck the data-access row: choosing a managed platform has not transferred the workshop’s decision about its readers.
sc900-q-0012. Compliance Manager improvement actions · Choice D
The work item is managed improvement-action ownership, evidence and status, not document classification, user-activity history or lifecycle. Compliance Manager improvement actions can be assigned to users and store evidence, notes and status updates supporting implementation/testing. Choose that workflow. An audit search can help gather evidence, but its event records do not replace the requested assignment-and-status workflow.
sc900-q-0453. A central identity provider · Choice B
The requested component maintains identity information and supplies authentication across applications. An identity provider creates/manages identity information and provides identity services. Synchronization keeps information aligned; an application permission catalog governs application actions. Select the identity provider. Its central role does not mean that every business-action permission has been established; those remain a separate authorization question.
sc900-q-0074. Threat hunting search-and-query tools · Choice A
The requested activity is proactive examination of data already connected, before an alert exists for the pattern. Sentinel hunting supports proactive query-based threat investigation before alerts are triggered. Connectors collect data; workbooks visualize it; automation handles workflow tasks. Choose hunting. Bringing in a new source could matter in another case, but the stem already gives connected data and asks for its proactive examination.
sc900-q-0355. Verify relevant identity and device evidence for access decisions; Limit granted privileges to the task and scope that need them
The changed premise rejects implicit trust based on network origin and calls for limiting impact after a breach. Zero Trust principles include explicit verification, least-privilege access and assuming breach. Evidence-based verification and task-scoped permissions align with those principles. Select verification and limited privilege. A network-origin or earlier-authentication shortcut substitutes a standing trust assumption; broad administrator-like grants conflict with the task-limited approach.
sc900-q-0046. Microsoft Purview Audit search · Choice C
The requested evidence is a recorded operation with actor and time, not document content. Purview Audit captures user/admin operations and supports searches for activities, users and date ranges. Choose Audit search. An eDiscovery case may be needed for related content later, but searching content is a different evidence request from this activity record.
sc900-q-0537. A workload identity · Choice D
The subject needing an identity is the software service, not its owner or host. Workload identities represent software such as applications, services and scripts. Device identities represent devices; human identities represent people. Choose workload identity. A host may separately have a device identity, but the stem asks for the independently acting software service.
sc900-q-0098. Microsoft Entra Conditional Access policy evaluation · Choice C
Resource-action permissions are already supplied; the new task is conditional evaluation of sign-in/device information with an MFA requirement. Conditional Access uses signals to enforce if-then access policy. Roles govern permissions in their relevant scope, and a method choice alone does not define when it is required. Choose Conditional Access for the new policy task. Check the boundary: it supplements the permission arrangement rather than creating the Azure resource-action grant described as already present.
sc900-q-0179. A Microsoft Entra directory role covering the user-administration task · Choice B
The new target is directory user records; the stem already supplies the other two access arrangements. Microsoft Entra roles govern directory resources, while Azure RBAC roles govern Azure resources. Authentication methods and access conditions answer other questions. Evaluate the relevant directory role. A VM-group role can legitimately allow VM management while still not establishing the new directory-administration permission.
sc900-q-01910. DevSecOps security · Choice A
The required evidence concerns code and development pipelines before deployment. Defender for Cloud describes DevSecOps security for code-level security across development environments/pipelines, alongside posture and workload-protection capabilities. Choose DevSecOps. CSPM is the strongest adjacent alternative for configuration posture, but the stem names development/code evidence rather than deployed-cloud configuration weaknesses.
sc900-q-031Original source-grounded practice. Content and reasoning checks are separate from professional educator review, which remains pending. Not an official exam paper.