SC-900 Mock Exam 77 — 25 Questions

Question 1

A company uses Microsoft Defender for Cloud to protect its Azure and on-premises workloads. The security team wants to receive alerts when suspicious activities occur, such as a possible brute-force attack on a virtual machine. Which component of Defender for Cloud generates these security alerts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers is the correct answer because it is the Defender for Cloud plan that delivers threat detection for servers, including behavioral analytics that identify brute-force attacks and generate alerts. Secure score and regulatory compliance are posture management features, while Defender for Cloud Apps is a separate CASB product, so they do not produce the required security alerts.

Answer

Microsoft Defender for Cloud Apps

Answer

Regulatory compliance dashboard

Answer

Secure score

Question 2

A security operations team is using Microsoft Sentinel and needs to automate responses to incidents, such as blocking an IP address when a specific alert is triggered. They want to create a playbook that runs automatically. Which component should they use to build the playbook?

Accepted Answer

Azure Logic Apps. Microsoft Sentinel playbooks are automated workflows built on Azure Logic Apps. They allow you to orchestrate responses to incidents using a visual designer and connectors to various services. While other automation tools exist, Logic Apps is the designated platform for Sentinel playbooks, making it the correct choice for this scenario.

Answer

Azure Functions

Answer

Azure Automation runbooks

Answer

Microsoft Power Automate

Question 3

A security operations center uses Microsoft Sentinel to detect and respond to threats across a hybrid environment. They need to understand the core capabilities of Sentinel. Which two capabilities are provided by Microsoft Sentinel? (Choose two.)

Accepted Answer

Use built-in machine learning analytics to detect previously unseen threats.. Microsoft Sentinel is a cloud-native SIEM and SOAR solution. Its core capabilities include ingesting security data from diverse sources across cloud and on-premises, and applying advanced analytics and machine learning to detect threats. Automated email attachment remediation is specific to Defender for Office 365, conditional access is an Entra ID feature, and baseline deployment is an Intune function, so they are not Sentinel capabilities.

Answer

Provide automated investigation and remediation of email attachments.

Answer

Manage and deploy security baselines to Windows devices.

Answer

Enforce conditional access policies for user sign-ins.

Question 4

You are a security administrator for Adventure Works, which uses Microsoft Defender for Cloud to protect its Azure and on-premises resources. The company has a hybrid environment with Windows Server virtual machines in Azure and on-premises. You need to ensure that Microsoft Defender for Cloud can assess vulnerabilities on these servers. What should you do?

Accepted Answer

Enable the Microsoft Defender for Servers plan and deploy the integrated vulnerability assessment solution.. To assess vulnerabilities on Azure and on-premises servers, you must enable the Microsoft Defender for Servers plan and deploy the integrated vulnerability assessment solution. This solution, powered by Qualys, scans servers for vulnerabilities and provides findings in Microsoft Defender for Cloud. Other options do not provide vulnerability assessment capabilities.

Answer

Enable the Microsoft Defender for Storage plan for all storage accounts.

Answer

Install the Microsoft Monitoring Agent on each server and configure a Log Analytics workspace.

Answer

Configure Azure Policy to enforce vulnerability assessment on all virtual machines.

Question 5

A company uses Microsoft Entra ID. They have a requirement that all administrative role activations must be approved by a designated approver and must be time-bound. Which Microsoft Entra feature should they implement?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) enables just-in-time role activation with approval workflows and time-bound assignments. This ensures that administrative roles are only activated when needed, after approval, and for a limited duration. It is the correct feature to enforce approval and time-bound requirements for privileged roles.

Answer

Microsoft Entra ID Governance

Answer

Microsoft Entra Identity Protection

Answer

Microsoft Entra Conditional Access

Question 6

A company uses Microsoft 365 and wants to protect against phishing attacks that impersonate their executives. They need a solution that uses machine learning to analyze email patterns and provide real-time protection. Which Microsoft 365 service should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes anti-phishing policies that use machine learning to detect impersonation attempts, including executive impersonation. It provides real-time protection for email. The other options serve different purposes: DLP for data protection, Defender for Identity for on-premises identity threats, and Defender for Cloud Apps for cloud app security.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Identity

Question 7

A company is deploying Microsoft 365 and wants to ensure that sensitive information in emails and documents is protected from unauthorized access and sharing. The compliance team requires a solution that can automatically classify and label content based on its sensitivity. Which Microsoft Purview feature should they use?

Accepted Answer

Sensitivity labels. Sensitivity labels in Microsoft Purview are designed to classify and protect content by applying encryption, visual markings, and sharing restrictions. They can be applied automatically based on sensitive information types, ensuring that sensitive data is consistently protected. Other features like DLP, retention labels, and Defender for Cloud Apps policies serve different purposes and do not provide the same classification and labeling capabilities.

Answer

Data Loss Prevention (DLP) policies

Answer

Microsoft Defender for Cloud Apps policies

Answer

Retention labels

Question 8

A compliance officer at Contoso needs to ensure that all email messages containing the phrase 'Project Falcon' are retained for seven years and then permanently deleted, without relying on end users to apply labels. The organization uses Microsoft 365 E5 and Exchange Online. Which Microsoft Purview feature should the officer configure?

Accepted Answer

A retention policy with a keyword query condition. A retention policy in Microsoft Purview can be scoped to Exchange Online and use a keyword query condition to find messages containing 'Project Falcon'. It then retains those items for the specified duration and deletes them afterward. This meets the need for automatic, service-level retention and deletion without user-applied labels or manual holds.

Answer

A data loss prevention (DLP) policy for Exchange Online

Answer

A sensitivity label with encryption settings

Answer

An eDiscovery hold on all Exchange Online mailboxes

Question 9

A security administrator needs to ensure that only compliant and trusted devices can access Microsoft 365 resources. They want to evaluate device compliance status and apply access controls based on conditions like device state and user location. Which Microsoft Entra capability should they use?

Accepted Answer

Conditional Access. Conditional Access is the Microsoft Entra feature that enforces access policies based on conditions like device compliance and user location. It integrates with Intune to identify compliant devices and can block or grant access accordingly. PIM, Identity Protection, and access reviews serve different identity governance and risk detection purposes, so they do not provide the dynamic access control described.

Answer

Access reviews

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Question 10

A healthcare organization must comply with HIPAA regulations to protect patient data. The compliance team needs to implement a solution that helps them assess their compliance posture, provides a compliance score, and offers actionable improvement actions. Which Microsoft service should they use?

Accepted Answer

Microsoft Purview Compliance Manager. Microsoft Purview Compliance Manager is the appropriate tool because it specifically provides compliance assessments, a compliance score, and improvement actions for regulatory standards such as HIPAA. Other services like Defender for Cloud Apps, Entra ID Protection, and Intune focus on security controls and device management but do not offer compliance posture assessment against frameworks.

Answer

Microsoft Entra ID Protection

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Question 11

You are a security operations manager for Northwind Traders. The company uses Microsoft Sentinel as its SIEM. You need to create a detection rule that triggers an incident when a user account is added to the Domain Admins group. The rule should only trigger for changes made outside of approved maintenance windows. Which Sentinel feature should you use to implement this logic?

Accepted Answer

Scheduled analytics rule with a KQL query that filters out events during maintenance windows.. A scheduled analytics rule in Microsoft Sentinel allows you to run a KQL query on a schedule. By incorporating logic to exclude events during maintenance windows, you can ensure the rule only triggers for unauthorized changes. This provides the flexibility to customize detection criteria and reduce false positives from known maintenance activities.

Answer

Microsoft Defender for Identity sensor that automatically detects privileged group modifications.

Answer

Workbook that visualizes group membership changes over time.

Answer

Fusion rule that uses machine learning to correlate alerts.

Question 12

A company uses Microsoft Entra ID. The security team wants to automatically block sign-ins from IP addresses that are known to be associated with malicious activity. They also want to receive alerts when users with leaked credentials attempt to sign in. Which Microsoft Entra feature should they use?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection detects risk events, including sign-ins from malicious IP addresses and users with leaked credentials. It can be configured with risk policies to automatically block sign-ins or require password changes, and it provides alerts and reports. This makes it the correct feature to both block malicious IP sign-ins and alert on leaked credentials.

Answer

Microsoft Entra Conditional Access

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra Password Protection

Question 13

You are a security administrator for Contoso, which uses Microsoft Defender for Endpoint. You need to reduce the attack surface on Windows 10 devices by blocking certain applications and scripts. Which Defender for Endpoint capability should you use?

Accepted Answer

Attack surface reduction (ASR) rules. Attack surface reduction (ASR) rules in Microsoft Defender for Endpoint are specifically designed to block behaviors that malware often uses, such as running scripts or launching certain applications. They provide a proactive way to reduce the attack surface on Windows 10 devices, making them the correct choice for blocking applications and scripts.

Answer

Automated investigation and remediation (AIR)

Answer

Endpoint detection and response (EDR) in block mode

Answer

Microsoft Defender SmartScreen

Question 14

A company uses Microsoft Defender for Cloud to protect its Azure and on-premises workloads. The security team wants to receive alerts when suspicious activities occur, such as a possible brute-force attack on a virtual machine. Which component of Defender for Cloud generates these security alerts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Microsoft Defender for Cloud Apps leverage machine learning to identify deviations from normal user behavior, such as mass downloads. They are designed to detect threats like data exfiltration. Other policy types are rule-based or content-focused and do not provide behavioral anomaly detection, making them unsuitable for this scenario.

Answer

File policy

Answer

Session policy

Answer

Activity policy

Question 15

A multinational corporation uses Microsoft Purview to manage data compliance. The legal team needs to preserve all email and Teams messages related to a pending lawsuit for an indefinite period, even if users delete them. The messages must be held in place and not modifiable by users. Which Microsoft Purview feature should the legal team use?

Accepted Answer

Microsoft Purview eDiscovery hold (case hold). An eDiscovery hold (case hold) is specifically designed to preserve content for legal cases. It can be applied to mailboxes, sites, and Teams messages, and it prevents users from deleting or altering the data. The other options do not provide the legal hold functionality required to preserve data indefinitely for a lawsuit.

Answer

Microsoft Purview retention policy

Answer

Microsoft Purview Insider Risk Management policy

Answer

Microsoft Purview Data Loss Prevention (DLP) policy

Question 16

You are a security administrator for a company that uses Microsoft 365 E5. The security team wants to automatically investigate and remediate phishing and malware threats in email without manual intervention, and they need a solution that correlates signals across email, endpoints, and identities. Which Microsoft Defender XDR capability should they configure?

Accepted Answer

Automated investigation and response in Microsoft Defender for Office 365. Automated investigation and response in Defender for Office 365 is designed to automatically investigate and remediate email threats, and within Microsoft Defender XDR it correlates those investigations with endpoint and identity signals. Attack simulation training, Safe Attachments, and eDiscovery provide education, prevention, or legal hold but not automated cross-domain threat investigation and remediation.

Answer

Safe Attachments policy in Microsoft Defender for Office 365

Answer

Attack simulation training in Microsoft Defender for Office 365

Answer

Microsoft Purview eDiscovery in Microsoft 365

Question 17

A financial institution uses Microsoft Purview to manage compliance. They need to ensure that all documents containing the sensitive information type 'SWIFT Code' are retained for seven years and then deleted. The documents are stored in SharePoint Online and OneDrive for Business. The compliance team wants to automate the application of a retention label based on the presence of SWIFT codes. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview auto-apply retention label policy based on sensitive information type. An auto-apply retention label policy can automatically apply a retention label to documents containing SWIFT codes, ensuring they are retained for seven years and then deleted. This is the only option that combines automatic detection of sensitive information types with retention and deletion actions. The other options either do not support retention or cannot automatically apply based on sensitive information types.

Answer

Microsoft Purview Data Loss Prevention (DLP) policy with a retention action

Answer

Microsoft Purview retention policy applied to SharePoint Online and OneDrive for Business

Answer

Microsoft Purview eDiscovery hold with a retention period

Question 18

A company uses Microsoft Entra ID for authentication. The security team wants to enforce that users can only access Microsoft 365 applications from compliant devices and trusted locations. They also want to require multi-factor authentication when users access from untrusted networks. Which feature should they configure?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the policy engine that evaluates signals like device compliance, location, and user risk to make access decisions. It can require compliant devices, trusted locations, and MFA based on conditions. Intune compliance policies and ID Protection provide input signals, but Conditional Access is the feature that enforces the access requirements.

Answer

Microsoft Entra Authentication Methods policies

Answer

Microsoft Intune compliance policies

Answer

Microsoft Entra ID Protection

Question 19

A company uses Microsoft Entra ID. The security team wants to implement a solution that provides real-time risk detection during sign-ins and can automatically enforce access policies based on user risk and sign-in risk. Which TWO Microsoft Entra features should they use together to achieve this? (Choose two.)

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection detects user and sign-in risks in real time, while Conditional Access enforces policies based on those risks. Together, they enable automated responses such as requiring MFA or blocking access when risk is elevated. This combination directly addresses the need for real-time risk detection and dynamic policy enforcement.

Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra self-service password reset (SSPR)

Answer

Microsoft Entra ID Governance

Question 20

A compliance team at Litware needs to respond to a regulatory request for all documents related to a specific project. The documents are stored in SharePoint Online, OneDrive for Business, and Exchange Online. The team must preserve the content in place and be able to search and export it. Which Microsoft Purview solution should they use?

Accepted Answer

eDiscovery (Standard) case with holds and searches. eDiscovery (Standard) is the appropriate solution because it supports creating a case, placing holds on Exchange Online, SharePoint Online, and OneDrive for Business to preserve content in place, and running searches to identify and export relevant items. It provides the case management and legal hold features needed for regulatory requests.

Answer

Content search in the Microsoft Purview compliance portal

Answer

Data Loss Prevention (DLP) policies

Answer

Audit log search in Microsoft Purview