SC-900 Describe the capabilities of Microsoft security solutions Practice Test 10 — 15 Questions

Question 1

Refer to the exhibit. You run a Kusto query in Microsoft Defender XDR Advanced Hunting. What does this query return?

Accepted Answer

Top 10 high-severity alert titles by number of distinct affected devices. The query filters for high-severity alerts, then summarizes by AlertTitle and counts distinct DeviceName values. It orders by that count descending and takes the top 10, so it returns the top 10 high-severity alert titles ranked by the number of distinct affected devices.

Answer

Top 10 alert titles by number of distinct devices, including all severities

Answer

Top 10 devices with the most high-severity alerts

Answer

Top 10 high-severity alert titles by total number of alerts

Question 2

Which TWO Microsoft Purview features can be used to classify and label sensitive data in Microsoft 365?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (A) are correct because they allow organizations to automatically apply sensitivity labels to data based on conditions such as sensitive information types or pattern matching, enabling classification and labeling without manual user intervention. Sensitivity labels (D) are correct because they are the core mechanism in Microsoft Purview for classifying and protecting sensitive data by applying persistent labels that can enforce encryption, access restrictions, and visual markings across Microsoft 365 services.

Answer

Data Loss Prevention policies

Answer

Retention policies

Answer

Audit policies

Question 3

Which THREE are capabilities of Microsoft Defender for Cloud?

Accepted Answer

Just-in-time (JIT) VM access. Just-in-time (JIT) VM access is a capability of Microsoft Defender for Cloud that reduces the attack surface by locking down inbound traffic to Azure VMs. It uses Network Security Group (NSG) rules to allow access only when requested by an authorized user, for a specified time window, and from a specific IP address. This prevents persistent open management ports like RDP (TCP 3389) or SSH (TCP 22) from being exposed to the internet.

Answer

DDoS protection

Answer

SIEM and security orchestration

Question 4

Which TWO Microsoft Security Copilot capabilities can help security analysts during incident response?

Accepted Answer

Provide guided response steps. Microsoft Security Copilot is an AI-powered security analysis tool that integrates with Microsoft 365 Defender and Sentinel. It can provide guided response steps (option A) by suggesting playbook actions and remediation workflows based on the incident context, and it can generate incident summary reports (option B) by synthesizing data from alerts, entities, and investigations into a concise narrative. These capabilities directly assist analysts in understanding and responding to incidents more efficiently.

Answer

Provision user accounts

Answer

Configure firewall rules

Answer

Automatically block malicious emails

Question 5

A company wants to use Microsoft Intune to enforce that mobile devices have a PIN of at least 6 characters to access corporate resources. What should they configure?

Accepted Answer

Device compliance policy. A device compliance policy in Microsoft Intune defines the rules that devices must meet to be considered compliant, such as requiring a PIN of at least 6 characters. When a device is marked non-compliant, Conditional Access can block access to corporate resources. This is the correct mechanism to enforce the PIN requirement at the device level before granting access.

Answer

Conditional access policy

Answer

App protection policy

Answer

Device configuration profile

Question 6

Refer to the exhibit. You are reviewing a Conditional Access policy JSON in Microsoft Entra ID. What will this policy do?

Accepted Answer

Block access when user risk is high. The policy JSON specifies `"userRiskLevels": ["high"]` and `"builtInControls": ["block"]`, meaning it blocks access when the user risk level is high. User risk reflects the likelihood that the user's identity is compromised, based on Microsoft's risk detection signals. Option D correctly identifies this behavior.

Answer

Block access when user risk is medium or high

Answer

Block sign-ins when sign-in risk is high

Answer

Require MFA when user risk is high

Question 7

Refer to the exhibit. You are creating a custom analytics rule in Microsoft Sentinel. What does this rule detect?

Accepted Answer

Sign-ins with medium or high risk from outside the US. The rule is configured with 'Risk level: Medium, High' and 'Location: Outside US'. This means it triggers only when both conditions are met: the sign-in risk is medium or high, and the location is outside the US. Option D correctly matches this combination, detecting sign-ins with medium or high risk from outside the US.

Answer

Sign-ins with high sign-in risk from any location

Answer

Sign-ins with medium or high risk from the US

Answer

Sign-ins from users with high user risk outside the US

Question 8

Your organization is deploying Microsoft Defender XDR to detect and respond to advanced threats. You need to ensure that security alerts from Microsoft Defender for Endpoint are automatically correlated with alerts from Microsoft Defender for Office 365. What should you configure?

Accepted Answer

Ensure that all Microsoft Defender services are onboarded to the same tenant and that the incidents feature is enabled. Microsoft Defender XDR automatically correlates alerts from different Microsoft Defender services (e.g., Defender for Endpoint and Defender for Office 365) when they are onboarded to the same tenant and the incidents feature is enabled. This built-in correlation uses the Microsoft 365 Defender backend to fuse related alerts into a single incident, providing a unified view of the attack chain without additional configuration.

Answer

Configure a custom detection rule in Microsoft 365 Defender

Answer

Create an advanced hunting query to join alerts from different data sources

Answer

Enable Microsoft Sentinel and configure incident creation rules

Question 9

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email, but allow sharing via Microsoft Teams messages. What should they configure?

Accepted Answer

Create a DLP policy scoped to Exchange Online with a block action, and a separate DLP policy scoped to Teams with an audit-only action. Option A is correct because Microsoft Purview DLP allows you to create separate policies scoped to different workloads. By creating a DLP policy for Exchange Online with a block action, you prevent credit card numbers from being shared via email. A separate DLP policy scoped to Microsoft Teams with an audit-only action allows sharing in Teams while still logging the activity for monitoring.

Answer

Create a single DLP policy that blocks credit card numbers in both Exchange and Teams

Answer

Configure an exception in the DLP policy for Teams using a rule exception

Answer

Use Microsoft Purview Insider Risk Management to block sharing in Teams

Question 10

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which policy should you configure?

Accepted Answer

Conditional Access policy in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID evaluate signals such as device compliance status from Intune before granting access to cloud apps like Exchange Online. By configuring a Conditional Access policy that requires device compliance, only devices marked as compliant by Intune can access corporate email. This is the correct mechanism because Conditional Access acts as the gatekeeper that enforces the compliance requirement at the authentication and authorization layer.

Answer

Device compliance policy in Microsoft Intune

Answer

Enrollment restrictions in Microsoft Intune

Answer

App protection policy in Microsoft Intune

Question 11

You are reviewing a Microsoft Sentinel KQL query. What is the primary purpose of this query?

Accepted Answer

Identify users with high logon attempts to Teams and high failed sign-ins, possibly indicating a brute-force attack. Option C is correct because the query joins IdentityLogonEvents (Teams logon attempts) with AADNonInteractiveUserSignInLogs (failed non-interactive sign-ins) and sorts by high failed sign-ins. This identifies users with many Teams logon attempts and many failed sign-ins, which could indicate brute-force attacks. Option A is incorrect because it does not filter for admin roles. Option B is incorrect because the focus is on failed sign-ins, not successful ones. Option D is incorrect because it does not include any information about conditional access policies.

Answer

Identify all users who have attempted to log on to Microsoft Teams more than 10 times in the last 7 days and who are global administrators

Answer

Identify users with high failed sign-ins and check if they have conditional access policies applied

Answer

Identify users with high successful logon attempts to Teams and correlate with failed sign-ins to detect account compromise

Question 12

Your organization uses Microsoft Purview eDiscovery to manage legal cases. You need to place a hold on a user's mailbox to preserve data for an ongoing litigation. Which role do you need to assign to the eDiscovery manager?

Accepted Answer

eDiscovery Manager (with the Legal Hold role enabled). Option D is correct because the eDiscovery Manager role group includes the ability to manage holds (the Legal Hold role). Option A is incorrect because Records Management is for retention labels. Option B is incorrect because Compliance Administrator has broad permissions but is not the recommended role for eDiscovery. Option C is incorrect because Information Protection is for sensitivity labels.

Answer

Records Management

Answer

Information Protection

Answer

Compliance Administrator

Question 13

Your organization wants to use Microsoft Defender for Cloud Apps to detect anomalous user behavior across cloud applications. Which feature should you enable?

Accepted Answer

Anomaly detection policies. Option A is correct because Cloud App Security (now part of Defender for Cloud Apps) provides UEBA and anomaly detection. Options B, C, and D are incorrect: Secure Score is for security posture, Cloud Discovery is for discovering shadow IT, and app connectors are for API integration.

Answer

App connectors

Answer

Secure Score

Answer

Cloud Discovery

Question 14

You are reviewing a Microsoft Purview DLP policy rule represented in JSON. What is the effect of this rule?

Accepted Answer

It blocks the sending of an email if it contains 10 or more credit card numbers with high confidence. Option A is correct because the JSON rule defines a condition where the DLP policy blocks email transmission when the count of credit card numbers detected with high confidence meets or exceeds 10. The 'BlockAccess' action in the rule enforces this by preventing the email from being sent, and the 'NotifyUser' action with 'NotifyOnly' set to false ensures the user is notified of the block. This matches the behavior of a Microsoft Purview DLP policy that uses a threshold-based condition with high confidence to block sensitive data sharing.

Answer

It notifies the user when a single credit card number is detected in email

Answer

It triggers a policy tip when a single credit card number is detected

Answer

It blocks access to a SharePoint site containing credit card numbers

Question 15

Your organization uses Microsoft Entra ID for identity management. You need to implement a solution that allows users to sign in using their social media accounts, such as Google or Facebook. What should you configure?

Accepted Answer

External identities (B2B) with social identity providers. Option C is correct because external identities (B2B) allow social identity providers as external identity sources. Option A is incorrect because self-service password reset does not provide sign-in. Option B is incorrect because Privileged Identity Management is for managing privileged roles. Option D is incorrect because Microsoft Authenticator is for MFA, not social identity.

Answer

Microsoft Authenticator app for passwordless sign-in

Answer

Privileged Identity Management

Answer

Self-service password reset

SC-900 Describe the capabilities of Microsoft security solutions Practice Test 10 — 15 Questions

Exhibit

SC-900 Describe the capabilities of Microsoft security solutions Practice Test 10 — 15 Questions

Exhibit