SC-900 Practice Exam 69 — 20 Questions

Question 1

A company uses Microsoft Defender for Cloud Apps to secure its cloud applications. The security team wants to monitor and control data activities in a third-party cloud app (e.g., Box) in real time. Specifically, they need to block downloads of files that have a 'Confidential' sensitivity label when users access the app from unmanaged devices. Which capability of Microsoft Defender for Cloud Apps should they configure?

Accepted Answer

Conditional Access App Control. Conditional Access App Control (CAAC) is the correct capability because it enforces real-time session policies that can block downloads based on sensitivity labels and device compliance. By integrating with Microsoft Defender for Cloud Apps, CAAC intercepts user sessions to third-party apps like Box and applies granular controls, such as blocking file downloads when the device is unmanaged and the file carries a 'Confidential' label.

Answer

Cloud Discovery

Answer

App connector

Answer

Information protection

Question 2

A company uses Microsoft Defender for Cloud to improve their cloud security posture. They want to see an aggregated score that reflects how well their resources are protected against threats. Which feature in Defender for Cloud provides this?

Accepted Answer

Security Score. The Security Score in Microsoft Defender for Cloud aggregates findings from security assessments and controls into a single percentage score, reflecting how well resources are protected against threats. It is based on the Secure Score algorithm, which calculates the ratio of passed controls to total controls, weighted by the potential impact of each control. This provides a unified, quantitative measure of cloud security posture.

Answer

Compliance dashboard

Answer

Cloud Security Posture Management (CSPM)

Answer

Workload protections

Question 3

A company wants to discover which cloud applications are being used by employees, assess the risk of those apps, and control data sharing in sanctioned apps like Box or Dropbox. Which Microsoft security solution should they implement?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility into shadow IT by discovering cloud app usage, assessing risk based on over 80 risk factors, and enforcing data loss prevention (DLP) policies to control data sharing in sanctioned apps like Box or Dropbox. It integrates with cloud providers via API connectors to monitor and govern data in real time.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Question 4

A company wants to protect its employees from phishing attacks delivered via email. The solution must analyze all URLs embedded in incoming emails in real-time. If a URL points to a known malicious site, the link should be blocked at the time of click. Additionally, the solution should sandbox URLs in attachments and provide time-of-click verification. Which Microsoft security solution should they implement?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) is the correct solution because it provides Safe Links, which performs real-time URL scanning and time-of-click verification for URLs embedded in email messages and attachments. It also includes Safe Attachments, which detonates attachments in a sandbox environment to analyze embedded URLs. These capabilities directly address the requirement to block malicious links at click time and sandbox URLs in attachments.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Cloud App Security

Question 5

Which Microsoft Entra ID feature allows an organization to provide external partners with access to its applications while maintaining control over authentication and governance?

Accepted Answer

Microsoft Entra External ID. Microsoft Entra External ID (including B2B collaboration) enables secure sharing of apps with external users. It allows the organization to manage identities and enforce policies like MFA for guests.

Answer

Microsoft Entra ID Governance

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra Permissions Management

Question 6

A security team wants to monitor and proactively defend against cyber threats across their entire infrastructure, including Azure virtual machines, on-premises servers, and AWS workloads. They need a unified solution that provides endpoint detection and response (EDR), vulnerability management, and threat hunting capabilities. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (B) is the correct answer because it provides unified endpoint detection and response (EDR), vulnerability management, and threat hunting across heterogeneous environments, including Azure VMs, on-premises servers, and AWS workloads. It extends beyond Windows to support Linux and macOS endpoints, and can be onboarded via Microsoft Defender for Cloud for multi-cloud visibility, making it the single solution that meets all the stated requirements.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 7

A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team needs to discover which unsanctioned cloud apps employees are using (Shadow IT). They also want to get a risk score for each app and receive alerts when a high-risk app is used. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it is specifically designed for Cloud Access Security Broker (CASB) functions, including Shadow IT discovery, risk scoring of cloud apps, and policy-based alerts. It integrates with Microsoft 365 and third-party SaaS apps via API connectors and log collectors to identify unsanctioned app usage and assign a risk score based on factors like compliance, security controls, and industry standards.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Purview Compliance Manager

Question 8

A security operations center (SOC) team needs to collect security logs from Azure services, on-premises servers, and third-party firewalls. They want a cloud-native solution that provides advanced threat detection through analytics, machine learning, and the ability to hunt for threats across all data sources. Which Microsoft solution should they deploy?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution that ingests logs from Azure services, on-premises servers, and third-party firewalls. It provides advanced threat detection via built-in analytics, machine learning models, and a powerful query language (Kusto Query Language) for threat hunting across all data sources.

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Identity

Question 9

Which THREE of the following are capabilities of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Detect credit card numbers in Exchange Online emails. Options A, C, and D are correct. DLP can detect sensitive data in Exchange emails, SharePoint documents, and Teams messages. Option B is wrong because DLP does not block network traffic; that is a network security function. Option E is wrong because DLP does not detect malware; that is Microsoft Defender for Endpoint.

Answer

Block network traffic from suspicious IP addresses

Answer

Detect malware in email attachments

Question 10

A security analyst is using Microsoft 365 Defender to investigate a sophisticated multi-stage attack. The analyst needs to query data across endpoints, email, and identity logs to identify the attacker's behavior patterns and correlate events. Which Microsoft 365 Defender capability should the analyst use?

Accepted Answer

Advanced hunting. Advanced hunting is the correct capability because it provides a Kusto Query Language (KQL)-based query interface that allows the security analyst to perform custom, cross-domain searches across data from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), and identity logs (Microsoft Defender for Identity). This enables the correlation of events and identification of attacker behavior patterns across a multi-stage attack, which is not possible with the other options.

Answer

Automated investigation and response

Answer

Threat analytics

Answer

Action center

Question 11

A security administrator is using Microsoft Defender for Cloud to improve the security posture of Azure resources. The administrator wants to view a consolidated assessment of compliance with industry standards such as CIS and NIST. Which feature should be used?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a consolidated view of compliance with industry standards like CIS and NIST. It continuously assesses Azure resources against built-in compliance frameworks and displays the results in a dashboard, showing which controls are passing or failing. This directly meets the administrator's need to view a consolidated assessment of compliance with those specific standards.

Answer

Secure Score

Answer

Azure Policy

Answer

Microsoft Sentinel

Question 12

A security operations center (SOC) wants to enrich their detection capabilities by automatically correlating internal network logs with external threat intelligence feeds containing known malicious IP addresses and domains. They need to ingest, normalize, and prioritize these indicators and generate alerts when matches are found. Which Microsoft security solution provides built-in capabilities for this purpose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides built-in capabilities to ingest logs from internal network sources, normalize them using common data models, and automatically correlate them with external threat intelligence feeds (e.g., STIX/TAXII). It can prioritize indicators based on severity and generate real-time alerts when matches are found, making it the correct choice for this SOC requirement.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft 365 Defender

Question 13

An organization wants to protect its Azure PaaS services, such as Azure SQL Database and Azure Key Vault, by detecting and alerting on suspicious activities like SQL injection attempts or unusual access patterns. They also need to integrate these alerts into a central security information and event management (SIEM) system for further analysis. Which Microsoft security solution provides the threat detection capability described?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides unified security management and advanced threat protection across hybrid cloud workloads, including Azure PaaS services like Azure SQL Database and Azure Key Vault. It detects suspicious activities such as SQL injection attempts and unusual access patterns using built-in behavioral analytics and integrates alerts into a central SIEM system via Azure Monitor or directly to Microsoft Sentinel.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Question 14

A company uses Azure virtual machines and on-premises Windows servers. The security team wants a single solution that provides vulnerability assessment, a regulatory compliance dashboard (e.g., for ISO 27001), and integrated threat detection such as fileless malware and anomalous logins. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center and Azure Defender) is the correct choice because it provides unified security management across Azure VMs and on-premises servers. It includes built-in vulnerability assessment (via Qualys or Microsoft Defender Vulnerability Management), a regulatory compliance dashboard with built-in standards like ISO 27001, and integrated threat detection for fileless malware, anomalous logins, and other advanced attacks. This single solution meets all the requirements listed in the question.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Question 15

A company has multiple Azure virtual machines running various workloads. They want a central solution that continuously assesses their security posture, identifies vulnerabilities, and provides recommendations to harden the environment. Which Azure service should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct service because it provides continuous security posture assessment, vulnerability identification, and actionable hardening recommendations across Azure, on-premises, and multi-cloud environments. It integrates with Azure Policy and uses the Secure Score to quantify security posture, making it the central solution described in the scenario.

Answer

Azure Firewall

Answer

Azure DDoS Protection

Answer

Microsoft Sentinel

Question 16

A company runs a web application in Azure that is publicly accessible. They want to protect it against large-scale distributed denial-of-service (DDoS) attacks from multiple sources. Which Azure service is specifically designed for this purpose?

Accepted Answer

Azure DDoS Protection. Azure DDoS Protection is specifically designed to safeguard Azure resources against large-scale distributed denial-of-service (DDoS) attacks. It leverages the global scale of Microsoft's network to absorb and mitigate multi-gigabit attacks, providing always-on traffic monitoring and adaptive tuning. This service is the only option among the choices that is purpose-built for DDoS mitigation at the network and transport layers (L3/L4), and it also offers application-layer (L7) protection when combined with Application Gateway WAF.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Question 17

A company's security operations team needs to centralize security log collection from multiple sources including on-premises firewalls, AWS CloudTrail, and Azure Active Directory sign-in logs. They want to use built-in analytics to detect threats across all data sources and create automated response playbooks, such as isolating a compromised user account when a specific attack pattern is detected. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) solution that ingests logs from diverse sources (on-premises firewalls via Syslog, AWS CloudTrail via REST API, and Azure AD via diagnostic settings) and provides built-in analytics rules to detect threats across all data. It also integrates with Azure Logic Apps to create automated playbooks (e.g., isolating a compromised user account) triggered by detected attack patterns, fulfilling the requirement for centralized log collection and automated response.

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 Defender

Answer

Microsoft Defender for Cloud Apps

Question 18

Your organization is implementing a Zero Trust security model. Which Microsoft Entra ID feature should you use to verify that users and devices meet specific health requirements before granting access to corporate resources?

Accepted Answer

Conditional Access. Option B is correct because Conditional Access policies can enforce device compliance, MFA, and other health checks. Option A is wrong because Privileged Identity Management manages just-in-time admin roles. Option C is wrong because Identity Protection detects risks but doesn't enforce device health. Option D is wrong because Identity Governance manages access reviews and lifecycle.

Answer

Privileged Identity Management (PIM)

Answer

Identity Governance

Answer

Identity Protection

Question 19

A company runs workloads in Azure and Amazon Web Services (AWS). The security team wants a single, unified dashboard to assess the security posture of all cloud resources, get prioritized recommendations for misconfigurations, and enable just-in-time (JIT) virtual machine access across both cloud environments. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is the correct solution because it provides a unified dashboard for assessing security posture across multi-cloud environments, including Azure and AWS. It delivers prioritized recommendations for misconfigurations using the Microsoft cloud security benchmark and supports just-in-time (JIT) VM access to reduce attack surfaces by controlling inbound traffic on demand.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Azure Policy

Question 20

A company runs Windows Server virtual machines (VMs) on-premises and in Azure. The security team wants a unified view of missing security updates and known vulnerabilities (CVEs) across all VMs. They want to enable agentless scanning for Azure VMs and deploy a lightweight agent for on-premises machines. The results should be consolidated in a single dashboard with prioritized remediation recommendations. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides unified visibility into security vulnerabilities and missing updates across hybrid workloads, including on-premises and Azure VMs. It supports agentless scanning for Azure VMs (using the cloud-based scanner) and allows deployment of the Azure Monitor Agent (or legacy Log Analytics agent) for on-premises machines, consolidating findings in a single dashboard with prioritized remediation recommendations based on the Secure Score and integrated vulnerability assessment (e.g., Qualys or Microsoft Defender Vulnerability Management).

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity