SC-900 Describe the capabilities of Microsoft security solutions — 15 Questions

Question 1

A security administrator wants to use Microsoft Defender for Cloud to protect Azure VMs. Which two of the following should be enabled to meet the requirements? (Choose two.)

Accepted Answer

Just-in-Time (JIT) VM access. Just-in-Time (JIT) VM access reduces the attack surface by locking down inbound traffic to Azure VMs, only opening ports (e.g., RDP 3389, SSH 22) when requested and for a limited time after approval via Microsoft Defender for Cloud. This directly protects Azure VMs by preventing persistent exposure of management ports. Adaptive network hardening, also a feature of Microsoft Defender for Cloud, analyzes actual traffic patterns and provides recommendations for Network Security Group (NSG) rules to further restrict network access to VMs, thereby enhancing their protection against network-based threats.

Answer

Azure Bastion

Answer

Vulnerability assessment

Question 2

Sequence the steps to enable Microsoft Defender for Cloud Apps for an organization.

Accepted Answer

Sign in to the Defender for Cloud Apps portal, then connect an app, then grant permissions, then configure settings, then verify connectivity.. Enabling Defender for Cloud Apps involves signing in to the portal, then connecting an app (which includes initiating the connection process), then granting the necessary permissions for the app (e.g., API consent), then configuring settings and policies based on the connected apps and granted permissions, and finally verifying connectivity to ensure everything is working as expected.

Answer

Sign in to the Defender for Cloud Apps portal, then connect an app, then configure settings, then grant permissions, then verify connectivity.

Answer

Sign in to the Defender for Cloud Apps portal, then configure settings, then connect an app, then grant permissions, then verify connectivity.

Answer

Connect an app, then sign in to the Defender for Cloud Apps portal, then configure settings, then grant permissions, then verify connectivity.

Question 3

Arrange the steps to configure multi-factor authentication (MFA) for a user in Azure AD.

Accepted Answer

1. Navigate to Azure AD user settings, 2. Enforce MFA via Conditional Access policy, 3. Require re-registration for MFA, 4. User registers their MFA method.. To configure multi-factor authentication (MFA) for a specific user in Azure AD, the most logical sequence of administrative and user actions is as follows: First, an administrator would navigate to the specific user's settings in Azure AD. Next, MFA needs to be enforced for that user, which is typically done by configuring or applying a Conditional Access policy that targets the user or a group they belong to. If the goal is to ensure a fresh MFA setup or reset existing methods, the administrator would then 'require re-registration for MFA' for that user. Finally, the user would be prompted to register their MFA method(s) during their next sign-in attempt, completing the configuration.

Answer

1. Navigate to Azure AD user settings, 2. Require re-registration for MFA, 3. User registers their MFA method, 4. Enforce MFA via Conditional Access policy.

Answer

1. User registers their MFA method, 2. Navigate to Azure AD user settings, 3. Require re-registration for MFA, 4. Enforce MFA via Conditional Access policy.

Answer

1. Enforce MFA via Conditional Access policy, 2. Navigate to Azure AD user settings, 3. Require re-registration for MFA, 4. User registers their MFA method.

Question 4

Match each authentication method to its description. Select all that apply.

Accepted Answer

Single Sign-On (SSO): Allows users to sign in once and access multiple applications without re-entering credentials.. The correct matches are: SSO enables access to multiple apps with one sign-in; MFA requires multiple verification methods; Passwordless uses no passwords. Common confusions involve swapping SSO and MFA definitions.

Answer

Single Sign-On (SSO): Requires two or more verification methods.

Answer

Multi-Factor Authentication (MFA): Allows users to sign in once and access multiple applications.

Question 5

A company must ensure that sensitive data in SharePoint Online is automatically classified and protected. They want to use built-in Microsoft Purview capabilities. Which feature should they implement?

Accepted Answer

Sensitivity labels. Sensitivity labels in Microsoft Purview can be configured with auto-labeling policies to automatically detect sensitive information (e.g., credit card numbers, PII) in SharePoint Online content. Once detected, the policy automatically applies the appropriate sensitivity label, which then enforces predefined protection actions such as encryption, access restrictions, and visual markings. This directly fulfills the requirement for automatic classification and protection of sensitive data.

Answer

Audit logs

Answer

Data Loss Prevention policies

Answer

Retention policies

Question 6

You are reviewing a Microsoft Sentinel KQL query. What is the primary purpose of this query?

```kql
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName == "Microsoft Teams"
| summarize TotalAttempts = count(), FailedAttempts = countif(ResultType != 0) by UserPrincipalName
| where TotalAttempts > 10 and FailedAttempts > 5
| project UserPrincipalName, TotalAttempts, FailedAttempts
```

Accepted Answer

Identify users with high logon attempts to Teams and high failed sign-ins, possibly indicating a brute-force attack. The query filters Microsoft Teams sign-ins from the last 7 days, aggregates total and failed sign-in attempts per user, and returns users with more than 10 total attempts and more than 5 failed attempts. This pattern of high volume and repeated failure is indicative of a brute-force attack, making option B correct. The query does not filter for global administrator role or conditional access policies.

Answer

Identify all users who have attempted to log on to Microsoft Teams more than 10 times in the last 7 days and who are global administrators

Answer

Identify users with high failed sign-ins and check if they have conditional access policies applied

Answer

Identify users with high successful logon attempts to Teams and correlate with failed sign-ins to detect account compromise

Question 7

Which THREE of the following are capabilities of Microsoft Purview eDiscovery? (Choose three.)

Accepted Answer

Export search results to a PST file. Microsoft Purview eDiscovery allows organizations to search for content across various Microsoft 365 services like Exchange Online, SharePoint Online, and OneDrive for Business (E). It enables placing legal holds on mailboxes and sites to preserve data for legal purposes (C), and allows exporting search results, including mailbox content, to PST files for offline review (B).

Answer

Block sharing of sensitive data via email

Answer

Automatically delete emails older than 7 years

Question 8

Which THREE of the following are features of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Provide policy tips to users. Microsoft Purview Data Loss Prevention (DLP) is designed to prevent sensitive information from being shared inappropriately. Key features include:
*   **Policy tips (Option A)**: DLP policies can be configured to provide real-time pop-up notifications to users in Microsoft 365 apps (like Outlook, Word, Excel) when they attempt to share or save sensitive data, guiding them on policy compliance.
*   **Sensitive data detection (Option B)**: DLP policies can detect sensitive information types (SITs) and sensitivity labels across various locations, including email messages (Exchange Online), SharePoint Online, OneDrive for Business, and Microsoft Teams.
*   **Endpoint monitoring (Option E)**: Endpoint DLP extends protection to devices, allowing organizations to monitor and enforce policies on sensitive data being used, copied, or transferred on Windows and macOS endpoints.

Answer

Apply sensitivity labels automatically

Answer

Retain data for a specified period

Question 9

Which THREE of the following are features of Microsoft Purview Insider Risk Management?

Accepted Answer

Detection of repeated security policy violations by a user. Microsoft Purview Insider Risk Management is designed to detect, investigate, and act on malicious and inadvertent insider activities. It uses predefined or custom policies to identify patterns of risky user behavior, such as repeated security policy violations (C), unauthorized data exfiltration attempts through various channels like email (D), and provides detailed activity logs and content context to capture forensic evidence of user actions on devices (E) for investigation.

Answer

Phishing simulation campaigns

Answer

Vulnerability scanning of network endpoints

Question 10

Which TWO of the following are included in Microsoft Entra ID Protection?

Accepted Answer

Risk-based Conditional Access policies. Microsoft Entra ID Protection is designed to detect, investigate, and remediate identity-based risks. Sign-in risk detections (e.g., anonymous IP address, impossible travel, unfamiliar sign-in properties) are fundamental capabilities of Entra ID Protection, identifying suspicious activities. These risk detections then feed into Risk-based Conditional Access policies, allowing organizations to automatically enforce access controls (like requiring MFA or blocking access) based on the real-time risk levels identified by Entra ID Protection. Options A, B, and E are features of other Microsoft security services or broader Entra ID capabilities, not specifically Entra ID Protection.

Answer

Data loss prevention (DLP)

Answer

Privileged Identity Management (PIM)

Answer

Passwordless authentication support

Question 11

Which TWO of the following are examples of Microsoft Copilot for Security use cases?

Accepted Answer

Answering a natural language question about a KQL query. Microsoft Copilot for Security is designed to process natural language queries and provide insights into security data, including KQL queries and incident investigations. It allows security analysts to ask questions in plain English, receive explanations or summaries of KQL queries, and generate summaries of complex security incidents, which enhances productivity and understanding without requiring deep KQL expertise.

Answer

Configuring firewall rules in Azure

Answer

Resetting a user's password in Entra ID

Answer

Creating a new DLP policy in Microsoft Purview

Question 12

Your organization uses Microsoft Defender for Cloud to assess the security posture of its Azure resources. Which two actions can be taken to improve the Secure Score? (Choose two.)

Accepted Answer

Implement security recommendations by remediating unhealthy resources. Microsoft Defender for Cloud's Secure Score is directly calculated based on the implementation of security recommendations. Remediating unhealthy resources by applying these recommendations reduces the risk level and increases the Secure Score, reflecting an improved security posture. Furthermore, enabling Microsoft Defender for Cloud plans for all supported resource types often fulfills specific security recommendations (e.g., 'Enable advanced threat protection') or unlocks additional high-value recommendations and controls, which, when addressed, directly contribute to improving the Secure Score.

Answer

Delete unused Azure resources to simplify management

Answer

Disable diagnostic logging for storage accounts

Answer

Disable non-critical virtual machines to reduce attack surface

Question 13

Which TWO are features of Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Cloud Discovery to identify shadow IT. Microsoft Defender for Cloud Apps (MDCA) offers Cloud Discovery, which analyzes network traffic to identify and assess cloud applications, including 'shadow IT,' providing visibility and control over unsanctioned app usage. Additionally, MDCA includes app governance capabilities to monitor and manage OAuth-enabled applications that access data, ensuring compliance and security for third-party app integrations.

Answer

Apply sensitivity labels to files

Answer

Investigate email-borne attacks

Answer

Vulnerability management for endpoints

Question 14

Your organization uses Microsoft Intune to manage mobile devices. You need to ensure that devices with a jailbroken or rooted OS cannot access corporate resources. What should you configure?

Accepted Answer

A device compliance policy in Microsoft Intune. A compliance policy in Intune can detect jailbroken devices and mark them as noncompliant. Option B is wrong because an app protection policy manages organizational data within apps and can block apps from running on rooted devices, but a device compliance policy is designed to assess the overall device state and mark the device itself as non-compliant for access to all corporate resources. Option C is wrong because a device configuration policy applies settings to devices (e.g., password requirements, Wi-Fi profiles) but does not detect the jailbroken/rooted state or mark the device as non-compliant for access control purposes. Option D is wrong because a conditional access policy in Entra ID uses compliance results but does not detect jailbreak itself; it enforces access based on the compliance status determined by Intune.

Answer

An app protection policy in Microsoft Intune

Answer

A device configuration policy in Microsoft Intune

Answer

A conditional access policy in Microsoft Entra ID

Question 15

Refer to the exhibit. You run the PowerShell command to retrieve a conditional access policy's conditions. The output shows Applications: All, Users: All, and Locations: All trusted. You need to ensure that only trusted locations are used when accessing Microsoft 365. What change should you make?

Accepted Answer

Modify the Locations condition to include all trusted locations and exclude untrusted locations. The current policy condition 'Locations: All trusted' means the policy applies only when users sign in from trusted locations. It does not inherently block access from untrusted locations. To ensure that *only* trusted locations are used when accessing Microsoft 365, access from untrusted locations must be explicitly blocked. This is typically achieved by configuring a Conditional Access policy with the Locations condition set to 'Include: Any location' and 'Exclude: All trusted locations', and then setting the Grant control to 'Block access'. The original explanation incorrectly suggested 'including all trusted locations and excluding untrusted locations' within the same condition set to achieve this.

Answer

Add a condition to block legacy authentication

Answer

Under Grant, require multi-factor authentication

Answer

Set sign-in frequency to 4 hours