SC-900 Practice Test 7 — 10 Questions

Question 1

Match each Microsoft Defender product to its focus area.

Question 2

Match each Microsoft security feature to its primary purpose.

Question 3

Match each authentication method to its description.

Question 4

Match each Azure security service to its purpose.

Question 5

A security operations team uses multiple Microsoft security products, including Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Entra ID Protection. They want to aggregate alerts from these sources into a single dashboard, correlate them to create incidents, and use automated playbooks to respond to threats. The team also wants to query historical security data for threat hunting. Which Microsoft solution should they deploy?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that ingests alerts from multiple sources, including Microsoft Defender for Endpoint, Defender for Office 365, and Entra ID Protection, into a single dashboard. It correlates these alerts into incidents using analytics rules and supports automated playbooks via Azure Logic Apps. Additionally, Sentinel provides a Kusto Query Language (KQL)-based workspace for querying historical security data, enabling threat hunting.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 6

Arrange the steps to investigate a user compromise using Azure AD Identity Protection.

Question 7

Arrange the steps to conduct a data classification scan using Microsoft Purview Information Protection.

Question 8

Order the steps to deploy Microsoft Intune for mobile device management.

Question 9

Sequence the steps to enable Microsoft Defender for Cloud Apps for an organization.

Question 10

Order the steps to respond to a data breach using Microsoft 365 Defender incident response.