1
SC-900 ACTUAL STUDY GUIDE EXAM
QUESTIONS AND ANSWERS 2026 VERSION
NOTE: Questions not numbered in order
Question: 309
An organization uses Microsoft Entra ID to manage user identities. A security administrator configures a
custom role with the following JSON definition to restrict access to specific Azure resources:
{
"Name": "CustomReader",
"Actions": [
"Microsoft.Resources/subscriptions/resourceGroups/read"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes":
[
"/subscriptions/12345678-1234-1234-1234-1234567890ab"
]
}
Which identity concept is this configuration addressing?
A. Authentication
B. Authorization
C. Directory Services
D. Identity Providers
Answer: B
Explanation: The custom role defines permissions for accessing specific Azure resources, which is an
aspect of authorization, determining what actions a user can perform after authentication.
,2
Question: 310
An organization uses Microsoft Purview to improve its compliance score. The compliance manager
recommends implementing Microsoft 365 Insider Risk Management. How does this action impact the
compliance score?
A. It has no impact unless sensitivity labels are applied to user activities
B. It increases the score by addressing improvement actions related to user behavior monitoring
C. It decreases the score due to increased configuration complexity
D. It only affects the score if DLP policies are disabled
Answer: B
,3
Explanation: Implementing Microsoft 365 Insider Risk Management in Microsoft Purview addresses
improvement actions related to monitoring user behavior for potential data risks, improving the
compliance score. Sensitivity labels, DLP policies, and configuration complexity do not negate the
positive impact of enabling Insider Risk Management.
Question: 311
An organization uses Microsoft Sentinel as a SIEM solution. They configure an analytic rule to detect
suspicious PowerShell activity using the KQL query below. The rule generates false positives for
legitimate administrative tasks. What modification should the team make to reduce false positives?
Exhibit:
SecurityEvent
| where EventID == 4688
| where CommandLine contains "powershell"
| summarize ProcessCount = count() by Account, Computer, bin(TimeGenerated, 1h)
| where ProcessCount > 10
A. Increase the ProcessCount threshold to 20
B. Add a filter to exclude known administrative accounts
C. Reduce the time window to 30 minutes
D. Replace EventID 4688 with EventID 4104
Answer: B
Explanation: Filtering out known administrative accounts reduces false positives by excluding
legitimate PowerShell usage. EventID 4688 tracks process creation, which is appropriate for
detecting PowerShell execution. Increasing the threshold or reducing the time window may miss
suspicious activity, and EventID 4104 (script block logging) requires additional configuration and may
not cover all PowerShell activity.
Question: 312
An organization implements a security strategy requiring continuous validation of user identities
SC-900 ACTUAL STUDY GUIDE EXAM
QUESTIONS AND ANSWERS 2026 VERSION
NOTE: Questions not numbered in order
Question: 309
An organization uses Microsoft Entra ID to manage user identities. A security administrator configures a
custom role with the following JSON definition to restrict access to specific Azure resources:
{
"Name": "CustomReader",
"Actions": [
"Microsoft.Resources/subscriptions/resourceGroups/read"
],
"NotActions": [],
"DataActions": [],
"NotDataActions": [],
"AssignableScopes":
[
"/subscriptions/12345678-1234-1234-1234-1234567890ab"
]
}
Which identity concept is this configuration addressing?
A. Authentication
B. Authorization
C. Directory Services
D. Identity Providers
Answer: B
Explanation: The custom role defines permissions for accessing specific Azure resources, which is an
aspect of authorization, determining what actions a user can perform after authentication.
,2
Question: 310
An organization uses Microsoft Purview to improve its compliance score. The compliance manager
recommends implementing Microsoft 365 Insider Risk Management. How does this action impact the
compliance score?
A. It has no impact unless sensitivity labels are applied to user activities
B. It increases the score by addressing improvement actions related to user behavior monitoring
C. It decreases the score due to increased configuration complexity
D. It only affects the score if DLP policies are disabled
Answer: B
,3
Explanation: Implementing Microsoft 365 Insider Risk Management in Microsoft Purview addresses
improvement actions related to monitoring user behavior for potential data risks, improving the
compliance score. Sensitivity labels, DLP policies, and configuration complexity do not negate the
positive impact of enabling Insider Risk Management.
Question: 311
An organization uses Microsoft Sentinel as a SIEM solution. They configure an analytic rule to detect
suspicious PowerShell activity using the KQL query below. The rule generates false positives for
legitimate administrative tasks. What modification should the team make to reduce false positives?
Exhibit:
SecurityEvent
| where EventID == 4688
| where CommandLine contains "powershell"
| summarize ProcessCount = count() by Account, Computer, bin(TimeGenerated, 1h)
| where ProcessCount > 10
A. Increase the ProcessCount threshold to 20
B. Add a filter to exclude known administrative accounts
C. Reduce the time window to 30 minutes
D. Replace EventID 4688 with EventID 4104
Answer: B
Explanation: Filtering out known administrative accounts reduces false positives by excluding
legitimate PowerShell usage. EventID 4688 tracks process creation, which is appropriate for
detecting PowerShell execution. Increasing the threshold or reducing the time window may miss
suspicious activity, and EventID 4104 (script block logging) requires additional configuration and may
not cover all PowerShell activity.
Question: 312
An organization implements a security strategy requiring continuous validation of user identities
