SC-900 Practice Exam 67 — 20 Questions

Question 1

A security operations team uses Microsoft Sentinel to centralize security log analysis. They need to ingest logs from a third-party firewall that does not have a native connector. What should the team use to bring the firewall logs into Microsoft Sentinel?

Accepted Answer

Data connectors. Microsoft Sentinel uses data connectors to ingest logs from various sources, including third-party devices that lack native connectors. For a firewall without a built-in connector, the team can use the Common Event Format (CEF) connector or Syslog connector, which are both categorized as data connectors. These connectors allow the firewall to forward logs via Syslog or CEF over UDP/TCP, which Sentinel then parses and ingests into the Log Analytics workspace.

Answer

Playbooks

Answer

Workbooks

Answer

Analytics rules

Question 2

A security team needs to detect and investigate suspicious activities in their on-premises Active Directory environment, such as pass-the-hash attacks, Kerberoasting, and unusual service account behavior. They also want to integrate these alerts with Microsoft Defender for Cloud for a unified view across hybrid workloads. Which Microsoft security solution should they deploy on-premises?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to detect and investigate advanced threats in on-premises Active Directory environments, including pass-the-hash attacks, Kerberoasting, and anomalous service account behavior. It uses behavioral analytics and integrates directly with Microsoft Defender for Cloud to provide a unified view across hybrid workloads, enabling security teams to correlate on-premises AD signals with cloud alerts.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Question 3

Your organization needs to control which users can access Microsoft Purview compliance portal. Which method should you use to grant access?

Accepted Answer

Assign users to the Compliance Administrator role group in Microsoft Purview. Option A is correct because you assign the appropriate role group in Microsoft Purview compliance portal. Option B is incorrect because licenses are needed but do not alone grant access. Option C is incorrect because Azure RBAC manages Azure resources, not Purview. Option D is incorrect because Intune manages devices, not access to Purview.

Answer

Add users to an Azure RBAC role

Answer

Configure Intune policy to allow access

Answer

Assign Microsoft 365 E5 licenses to users

Question 4

An organization wants to protect its fleet of Windows 10 laptops from advanced malware and ransomware. The solution must detect suspicious behavior (e.g., a process encrypting files) and provide security teams with the ability to isolate an infected device from the network for investigation. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities, including behavioral-based detection of advanced malware and ransomware (e.g., detecting a process encrypting files via machine learning and behavioral analytics). It also includes automated investigation and remediation features, such as the ability to isolate an infected device from the network (device isolation) to prevent lateral movement while allowing security teams to investigate.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Question 5

A company uses Microsoft Defender for Endpoint to secure its devices, Microsoft Defender for Office 365 for email security, and Microsoft Defender for Identity for on-premises Active Directory. The security team wants a single console to view correlated incidents across these domains, where an incident might combine a suspicious email, a malicious file download, and a compromised account. Which Microsoft solution provides this unified incident view and automatic correlation?

Accepted Answer

Microsoft 365 Defender (now Microsoft Defender XDR). Microsoft 365 Defender (now Microsoft Defender XDR) is the correct answer because it provides a unified incident view across Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity. It automatically correlates alerts from these domains—such as a suspicious email, a malicious file download, and a compromised account—into a single incident, enabling security teams to investigate and respond from one console.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Answer

Microsoft Purview Compliance Portal

Question 6

A company uses Microsoft Defender for Cloud Apps. The security team discovers that a user has granted a third-party OAuth app with 'read all mail' and 'send mail as user' permissions. They want to automatically revoke the authorization for this risky app and block similar apps in the future. Which Defender for Cloud Apps feature should they use?

Accepted Answer

OAuth app policies. OAuth app policies in Microsoft Defender for Cloud Apps allow security teams to automatically revoke permissions for risky third-party OAuth apps and block future similar apps. This feature specifically governs OAuth consent grants, such as 'read all mail' and 'send mail as user', by enabling automated governance actions like revoking permissions and blocking the app based on risk level.

Answer

App Discovery

Answer

Conditional Access App Control

Answer

Cloud Discovery

Question 7

A company wants to collect security logs from on-premises servers, cloud applications, and network devices into a central repository, and then use advanced analytics detect threats and automate incident response. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution. It collects security logs from diverse sources like on-premises servers, cloud apps, and network devices into a central Log Analytics workspace, then uses built-in analytics and machine learning to detect threats and automate incident response via playbooks.

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 Defender

Answer

Azure Firewall

Question 8

A company deploys Microsoft Defender for Cloud Apps. They want to detect when a user downloads more than 100 files from SharePoint in 10 minutes. Which policy type should they create?

Accepted Answer

Anomaly detection policy. Option C is correct because an anomaly detection policy in Defender for Cloud Apps can identify unusual file download activities based on predefined thresholds. Option A is wrong because an app permission policy governs permissions granted to third-party apps. Option B is wrong because a session policy enforces real-time controls on user sessions. Option D is wrong because a file policy monitors files based on metadata or content, not behavioral patterns.

Answer

File policy

Answer

App permission policy

Answer

Session policy

Question 9

A company runs virtual machines in Azure and also maintains on-premises servers connected via Azure Arc. The security team needs a single dashboard to view security recommendations, detect misconfigurations, and track a secure score across both environments. They also want to enable advanced threat protection features such as just-in-time (JIT) VM access and file integrity monitoring for these workloads. Which Microsoft security solution should they implement?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a unified dashboard that displays security recommendations, misconfigurations, and a secure score across both Azure and on-premises workloads connected via Azure Arc. It also includes advanced threat protection features like just-in-time (JIT) VM access and file integrity monitoring, making it the correct choice for this scenario.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 10

A multinational company uses a hybrid infrastructure with on-premises Active Directory and Azure resources. They have deployed Microsoft Defender for Cloud to protect their Azure workloads. They now want to extend threat detection to their on-premises Active Directory by collecting security events from domain controllers to detect attacks like Golden Ticket, DCSync, and malicious Kerberos activity. The solution should integrate with Microsoft Sentinel for automated response. Which security solution should they deploy on the on-premises domain controllers?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory signals, including security events from domain controllers, to detect advanced identity-based attacks such as Golden Ticket, DCSync, and malicious Kerberos activity. MDI integrates natively with Microsoft Sentinel to enable automated response workflows, fulfilling the requirement for extending threat detection to on-premises AD.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Question 11

A company uses Microsoft 365 and wants to protect users from malicious attachments in email. The security team wants a solution that detonates attachments in a sandbox environment before delivery, and only allows the email through if the attachment is deemed safe. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Attachments, a feature that detonates email attachments in a virtual sandbox environment before delivery. It analyzes the attachment's behavior for malicious activity and only releases the email to the recipient's mailbox if the attachment is deemed safe, directly meeting the requirement for pre-delivery sandboxing.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Azure Firewall

Question 12

A company uses Microsoft 365. The security team wants to protect users from clicking malicious URLs in email messages. The solution should rewrite all links in incoming emails so that when a user clicks them, the URL is checked in real time against a dynamic list of known malicious sites. Which Microsoft Defender for Office 365 feature should they enable?

Accepted Answer

Safe Links. Safe Links is the correct feature because it is specifically designed to protect users from malicious URLs in email messages and Office documents. It rewrites all links in incoming emails so that when a user clicks them, the URL is checked in real time against a dynamic list of known malicious sites, providing time-of-click protection.

Answer

Anti-phishing policies

Answer

Safe Attachments

Answer

Anti-spam policies

Question 13

Arrange the steps to configure multi-factor authentication (MFA) for a user in Azure AD.

Question 14

A company uses Exchange Online. The security team wants to protect users from malicious email attachments. They need a solution that detonates attachments in a sandbox environment to check for malware behavior before the email is delivered to the recipient. Which Microsoft Defender for Office 365 feature should they enable?

Accepted Answer

Safe Attachments. Safe Attachments is the correct feature because it specifically detonates email attachments in a virtual sandbox environment before delivery, analyzing behavior for malicious activity. This matches the requirement to check attachments for malware behavior prior to inbox arrival, a capability unique to Safe Attachments within Defender for Office 365.

Answer

Safe Links

Answer

Anti-phishing

Answer

Anti-spam

Question 15

A company runs a production Kubernetes cluster in Azure. The security team needs to continuously monitor the cluster for misconfigurations, such as containers running with privileged access or secrets exposed in environment variables. They also want to detect runtime threats like crypto-mining containers. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities. It continuously assesses Kubernetes clusters against the CIS Kubernetes Benchmark, detecting misconfigurations like privileged containers and exposed secrets in environment variables, and uses behavioral analytics to detect runtime threats such as crypto-mining containers.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 16

A company runs critical applications on Azure virtual machines and on-premises SQL servers. The security team wants to reduce VM attack surface by allowing just-in-time (JIT) access to RDP and SSH ports only when needed. Additionally, they need to monitor changes to important registry keys and system files on the SQL servers. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides just-in-time (JIT) VM access to reduce the attack surface by locking down inbound traffic to RDP (port 3389) and SSH (port 22) until a user requests access. It also includes adaptive application controls and file integrity monitoring (FIM) to track changes to registry keys and system files on both Azure VMs and on-premises SQL servers. This makes it the single solution that addresses both requirements.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 17

A company runs critical Windows virtual machines on Azure. To reduce the attack surface, the security team wants to block all inbound RDP (port 3389) traffic from the internet by default. When a security engineer needs to connect via RDP for troubleshooting, they must request access through a portal, and the RDP port will be opened for a limited time (e.g., 4 hours) only to their source IP address. Which Microsoft security solution should they use to implement this control?

Accepted Answer

Microsoft Defender for Cloud's Just-in-time (JIT) VM access. Microsoft Defender for Cloud's Just-in-time (JIT) VM access is the correct solution because it specifically provides time-limited, request-based opening of inbound ports (such as RDP port 3389) to approved source IP addresses, reducing the attack surface by keeping ports closed by default. This aligns directly with the requirement to block all inbound RDP from the internet by default and allow temporary access only through a portal request.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Azure Network Security Groups (NSGs) with application security groups

Question 18

A company's security operations center wants to detect advanced attacks targeting their on-premises Active Directory, such as Kerberos Golden Ticket attacks, pass-the-hash, and skeleton key malware. They need a solution that monitors domain controller traffic, correlates with entity behavior, and integrates with Microsoft Sentinel for incident response. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory traffic, including domain controller network traffic, and uses entity behavior analytics to detect advanced attacks like Kerberos Golden Ticket, pass-the-hash, and skeleton key malware. It integrates natively with Microsoft Sentinel to enable automated incident response and investigation.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 19

A company runs workloads in Microsoft Azure and in Google Cloud Platform (GCP). The security team needs a single dashboard to view the security posture of both cloud environments, get recommendations for misconfigurations based on best practices, and track compliance with industry standards such as ISO 27001 and PCI DSS. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct solution because it provides a unified dashboard for assessing and improving the security posture of multicloud environments, including Azure and GCP. It offers continuous assessment against best practices (e.g., the Microsoft cloud security benchmark), generates actionable recommendations for misconfigurations, and tracks compliance with industry standards like ISO 27001 and PCI DSS through built-in regulatory compliance dashboards.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Question 20

A company uses Microsoft 365 and allows employees to access corporate email and documents from their personal devices. The security team wants to protect against malicious links in emails and Microsoft Teams messages. When a user clicks a link, it should be checked in real-time to see if it leads to a known malicious site. If it does, access should be blocked. Which Microsoft security solution provides this capability?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Links, which provides real-time URL scanning at the time of click. When a user clicks a link in an email or Teams message, the URL is rewritten and checked against a dynamic list of known malicious sites. If the link is determined to be malicious, access is blocked, and the user is redirected to a warning page.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity