SC-900 Practice Test 38 — 15 Questions

Question 1

Your company uses Microsoft 365 E5 licenses and wants to prevent sensitive data from being shared externally via email. You need to configure a solution that automatically scans outgoing emails for credit card numbers and blocks them if detected. What should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Option B is correct because Microsoft Purview Data Loss Prevention (DLP) policies can scan emails for sensitive data like credit card numbers and block them. Option A is wrong because Microsoft Defender for Office 365 focuses on threat protection, not DLP. Option C is wrong because Microsoft Entra ID is for identity and access management. Option D is wrong because Microsoft Intune is for device management.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Microsoft Intune App Protection policy

Answer

Microsoft Entra ID Conditional Access policy

Question 2

Which THREE capabilities are provided by Microsoft Defender XDR (formerly Microsoft 365 Defender)? (Choose three.)

Accepted Answer

Identity threat detection. Options A, B, and D are correct. Microsoft Defender XDR includes Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Option C is wrong because Microsoft Purview is a separate compliance solution. Option E is wrong because Microsoft Intune is for device management, not part of XDR.

Answer

Data classification and labeling

Answer

Mobile device management (MDM)

Question 3

A security analyst needs to investigate a potential data exfiltration incident involving sensitive files being sent via email. Which Microsoft Purview solution provides the necessary monitoring?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) policies monitor and control sensitive data in email and other locations.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Audit

Question 4

Your organization uses Microsoft Defender for Cloud Apps. A security analyst notices anomalous file downloads from a SharePoint site by a user flagged as high risk. What should the analyst configure to automatically block such activity?

Accepted Answer

Configure a session policy. Session policies in Microsoft Defender for Cloud Apps provide real-time control over user activities, including blocking downloads based on risk level. Option A is incorrect because app permissions manage consent, not real-time monitoring. Option B is incorrect because file policies are for static file classification. Option D is incorrect because access policies control initial access, not ongoing session activities.

Answer

Configure a file policy

Answer

Configure an access policy

Answer

Configure an app permission policy

Question 5

Which THREE Microsoft Purview solutions help protect sensitive data in Microsoft 365? (Choose three.)

Accepted Answer

Data Loss Prevention. Microsoft Purview Data Loss Prevention, Information Protection (sensitivity labels), and Insider Risk Management all help protect sensitive data. Option B is incorrect because Audit is for logging, not protection. Option D is incorrect because eDiscovery is for discovery, not protection.

Answer

Audit

Answer

eDiscovery

Question 6

Refer to the exhibit. You run an Advanced Hunting query in Microsoft Defender XDR. What is the primary purpose of this query?

Accepted Answer

Identify accounts with high number of interactive logons, potentially indicating brute-force activity.. The query filters for interactive logon events to Office 365 over the past 7 days, groups by user and IP, and counts occurrences. It then filters for accounts with more than 10 logon events, which helps identify accounts with unusually high logon activity, potentially indicating brute-force attacks or compromised accounts. Option A is correct.

Answer

Find IP addresses with failed logon attempts.

Answer

List all interactive logons from Office 365 applications.

Answer

Detect non-interactive logons to Office 365.

Question 7

A company uses Microsoft Defender for Cloud Apps to protect its SaaS apps. The security team needs to detect when a user downloads more than 100 files from SharePoint Online within 10 minutes. Which policy type should they create?

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Defender for Cloud Apps use behavioral analytics to detect unusual patterns like mass file download. Activity policy is for specific activities, but anomaly detection is better for this scenario. Option A is wrong because it's a generic term; Option B is wrong because it's for threat detection; Option D is wrong because it's for compliance.

Answer

Activity policy

Answer

Threat detection policy

Answer

Compliance policy

Question 8

Your company uses Microsoft Defender for Cloud to secure multicloud workloads. You need to ensure that regulatory compliance frameworks (e.g., SOC 2, ISO 27001) are continuously assessed and any drift is reported. What should you implement?

Accepted Answer

Regulatory compliance standards in Microsoft Defender for Cloud. Option A is correct because regulatory compliance standards in Defender for Cloud provide continuous assessment against frameworks. Option B is wrong because Azure Policy is used for policy enforcement, not assessment of compliance frameworks. Option C is wrong because Microsoft Sentinel is for SIEM/SOAR, not compliance assessment. Option D is wrong because Defender for Cloud Apps focuses on cloud app security.

Answer

Microsoft Sentinel analytics rules

Answer

Azure Policy initiatives

Answer

Microsoft Defender for Cloud Apps session policies

Question 9

Your company uses Microsoft Defender for Endpoint. You need to configure attack surface reduction (ASR) rules. Which TWO of the following are ASR rules?

Accepted Answer

Block executable content from email client and webmail. Options A and C are correct. Blocking Office applications from creating child processes (A) and blocking executable content from email client (C) are ASR rules. Option B is a Windows Defender Firewall rule, not ASR. Option D is an application control rule, not ASR. Option E is a network protection rule, not ASR.

Answer

Allow only signed executables

Answer

Block inbound connections from the internet

Answer

Block untrusted fonts

Question 10

A company uses Microsoft Sentinel to centralize security logs. They want to correlate AWS CloudTrail logs with Azure AD sign-in logs. Which Microsoft Sentinel feature should they use?

Accepted Answer

Analytics rules. Analytics rules in Sentinel can correlate data from multiple sources. Option A is correct. Option B (Workbooks) visualize data. Option C (Playbooks) automate responses. Option D (Hunting) is proactive threat search.

Answer

Workbooks

Answer

Playbooks

Answer

Hunting

Question 11

A manufacturing company experiences repeated ransomware attacks targeting their on-premises file servers. They have Microsoft 365 E5 and want to implement a solution to detect and automatically respond to such threats across hybrid environments. What should they deploy?

Accepted Answer

Microsoft Defender for Identity. Option C is correct because Microsoft Defender for Identity is designed to protect on-premises Active Directory and detect attacks like ransomware. Option A is wrong because Microsoft Defender for Cloud Apps focuses on SaaS applications. Option B is wrong because Microsoft Defender for Office 365 protects cloud email and collaboration. Option D is wrong because Microsoft Purview is for data governance and compliance.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Question 12

Which TWO features are included in Microsoft Entra ID Identity Protection? (Choose two.)

Accepted Answer

Sign-in risk detection. Options A and B are correct. Identity Protection includes sign-in risk and user risk detection. Option C is wrong because it's a Conditional Access feature. Option D is wrong because it's Privileged Identity Management. Option E is wrong because it's Microsoft Defender for Cloud Apps.

Answer

Just-in-time privileged access

Answer

Cloud app discovery

Answer

Multi-factor authentication registration campaign

Question 13

An organization uses Microsoft Defender for Cloud to secure its Azure workloads. They want to receive recommendations for improving the security posture of their virtual machines. What should they enable?

Accepted Answer

Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM). Microsoft Defender for Cloud provides security recommendations based on assessments. Enabling Defender for Cloud (with the foundational CSPM or enhanced security features) will generate recommendations.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Answer

Azure Policy

Question 14

A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Highly Confidential' sensitivity label to emails containing a specific credit card pattern. Which solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention policies include rules that can automatically apply sensitivity labels based on sensitive info types like credit card numbers. Option A is incorrect because Microsoft Purview Audit only logs activities. Option B is incorrect because Microsoft Defender for Cloud Apps focuses on app access control. Option D is incorrect because Microsoft Sentinel is for SIEM/SOAR.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Audit

Question 15

Which TWO Microsoft security solutions can be used to detect and respond to threats across email, endpoints, and identities? (Choose two.)

Accepted Answer

Microsoft Sentinel. Microsoft Defender XDR (extended detection and response) and Microsoft Sentinel (SIEM/SOAR) can integrate signals across email, endpoints, and identities. Option A is incorrect because Defender for Cloud Apps focuses on cloud apps. Option C is incorrect because Intune is for management. Option E is incorrect because Purview is for data protection, not threat detection.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview