SC-900 Describe the capabilities of Microsoft security solutions Practice Test 12 — 15 Questions

Question 1

A company runs Azure VMs and on-premises Windows servers. They need a solution that provides vulnerability assessment, regulatory compliance dashboard, and threat detection for their hybrid workloads. Which Microsoft security solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (formerly Azure Security Center and Azure Defender) provides unified security management across hybrid cloud workloads. It includes vulnerability assessment for VMs, a regulatory compliance dashboard with built-in standards like SOC 2 and PCI DSS, and integrated threat detection using behavioral analytics and machine learning. This makes it the correct choice for the described requirements.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 2

A company uses Microsoft 365 and many third-party SaaS apps like Salesforce and Box. The security team needs to discover which unsanctioned cloud apps employees are using (Shadow IT). They also want to get a risk score for each app and receive alerts when a high-risk app is used. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) is the correct solution because it is specifically designed for Cloud Access Security Broker (CASB) functions, including Shadow IT discovery, risk scoring of cloud apps, and policy-based alerts. It integrates with Microsoft 365 and third-party SaaS apps via API connectors and log collectors to identify unsanctioned app usage and assign a risk score based on factors like compliance, security controls, and industry standards.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Purview Compliance Manager

Question 3

A company uses Microsoft 365 and wants to protect its users from clicking malicious links in phishing emails. The security team needs a solution that rewrites URLs in email messages to check the link at the time of click, and blocks access if the link is malicious. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Links, a feature specifically designed to protect users from malicious URLs in email messages. Safe Links rewrites URLs at the time of delivery, and when a user clicks a link, it checks the destination in real time against threat intelligence; if the link is malicious, access is blocked. This directly matches the requirement to rewrite URLs and perform click-time verification.

Answer

Azure Firewall

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Question 4

A company runs a mix of on-premises servers and Azure virtual machines. They deploy Microsoft Defender for Endpoint on all servers. The security team wants to create custom queries to hunt for a specific attack pattern that involves a sequence of events across multiple machines, such as a PowerShell script being downloaded and then executed on several servers. They need to write their own detection rules based on advanced hunting data. Which Microsoft 365 Defender capability should they use?

Accepted Answer

Advanced hunting in Microsoft 365 Defender. Advanced hunting in Microsoft 365 Defender provides a Kusto Query Language (KQL)-based query interface that allows security teams to create custom detection rules by searching raw data across endpoints, email, and identities. This capability directly supports the scenario of writing custom queries to hunt for multi-machine attack patterns, such as a PowerShell script download followed by execution, by correlating events like DeviceProcessEvents and DeviceFileEvents across multiple devices.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 5

A company uses Microsoft 365 and several third-party SaaS apps. The security team wants to detect when a user signs in from a remote location that is significantly far from their typical sign-in location within a very short time, indicating possible account compromise. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps (MDCA) provides the 'impossible travel' detection capability, which analyzes sign-in events across both Microsoft 365 and third-party SaaS apps. It uses machine learning to establish a baseline of a user's typical sign-in locations and then alerts when two sign-ins occur from geographically distant locations within a time frame that makes physical travel impossible, indicating a potential account compromise.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint

Question 6

An organization wants to protect against business email compromise (BEC) attacks where attackers impersonate the CEO to trick employees into transferring funds. Which Microsoft Defender for Office 365 capability should they configure to detect such impersonation?

Accepted Answer

Impersonation protection. Impersonation protection in Defender for Office 365 is specifically designed to detect and block business email compromise (BEC) attacks where an attacker spoofs a trusted sender, such as a CEO or CFO. It uses machine learning and sender intelligence to analyze email patterns and flag messages that impersonate internal or external high-value targets, making it the correct capability for this scenario.

Answer

Safe Attachments

Answer

Safe Links

Answer

Spoof intelligence

Question 7

A company uses Microsoft 365 and wants to deploy a security solution that can automatically detect and remediate advanced attacks on endpoints (workstations and servers), such as ransomware and fileless attacks. They also want to provide incident response teams with detailed forensic data and the ability to isolate an infected machine from the network. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) is the correct solution because it provides endpoint detection and response (EDR) capabilities, including automatic detection and remediation of advanced attacks like ransomware and fileless attacks. It also offers detailed forensic data for incident response and the ability to isolate an infected machine from the network, meeting all the specified requirements.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 8

A multinational company uses a hybrid infrastructure with on-premises Active Directory and Azure resources. They have deployed Microsoft Defender for Cloud to protect their Azure workloads. They now want to extend threat detection to their on-premises Active Directory by collecting security events from domain controllers to detect attacks like Golden Ticket, DCSync, and malicious Kerberos activity. The solution should integrate with Microsoft Sentinel for automated response. Which security solution should they deploy on the on-premises domain controllers?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it is specifically designed to monitor on-premises Active Directory signals, including security events from domain controllers, to detect advanced identity-based attacks such as Golden Ticket, DCSync, and malicious Kerberos activity. MDI integrates natively with Microsoft Sentinel to enable automated response workflows, fulfilling the requirement for extending threat detection to on-premises AD.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Question 9

A company wants to deploy a single security operations portal that provides a unified view of alerts and incidents from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Which Microsoft portal should the security team use?

Accepted Answer

Microsoft 365 Defender portal. The Microsoft 365 Defender portal (https://security.microsoft.com) is the correct answer because it provides a unified security operations center (SOC) experience, aggregating alerts and incidents from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This portal enables security teams to triage, investigate, and respond to cross-domain threats in a single pane of glass, leveraging automated incident correlation and advanced hunting capabilities.

Answer

Azure Portal

Answer

Microsoft 365 admin center

Answer

Azure Active Directory admin center

Question 10

A company wants to collect security logs from on-premises servers, cloud applications, and network devices into a central repository, and then use advanced analytics detect threats and automate incident response. Which Microsoft security solution should they deploy?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution. It collects security logs from diverse sources like on-premises servers, cloud apps, and network devices into a central Log Analytics workspace, then uses built-in analytics and machine learning to detect threats and automate incident response via playbooks.

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 Defender

Answer

Azure Firewall

Question 11

A company has on-premises Active Directory. They want to detect advanced attacks like Pass-the-Hash, DCSync, and malicious Kerberos activity using behavioral analytics. Which Microsoft security solution should they deploy on their domain controllers?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is the correct solution because it uses behavioral analytics and machine learning to detect advanced attacks specifically targeting on-premises Active Directory, such as Pass-the-Hash, DCSync, and malicious Kerberos activity. MDI monitors domain controller traffic, including Kerberos authentication and NTLM relay, to identify anomalous patterns indicative of these attacks.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Question 12

A security analyst wants to create a custom detection rule that tracks a specific multi-stage attack pattern: a user receives a phishing email, clicks a link, and then a script is executed on their device. The analyst needs to write a Kusto Query Language (KQL) query to detect this pattern and schedule it to run automatically, generating alerts. Which Microsoft 365 Defender capability should they use?

Accepted Answer

Custom detection rules. Custom detection rules in Microsoft 365 Defender allow security analysts to write KQL queries that run on a schedule and automatically generate alerts when the query returns results. This capability is specifically designed to detect multi-stage attack patterns, such as the phishing email → link click → script execution chain described, by querying advanced hunting data and triggering incident creation.

Answer

Advanced hunting

Answer

Automation

Answer

Threat analytics

Question 13

An organization wants to protect against spear-phishing attacks where attackers impersonate the company's CEO or other trusted domains to trick employees into transferring funds. They need a security solution that uses machine learning to detect and prevent such impersonation attempts in incoming emails. Which Microsoft 365 protection feature should they enable?

Accepted Answer

Anti-phishing policy (impersonation protection). Anti-phishing policy with impersonation protection uses machine learning models to detect and block attempts to impersonate specific users (like the CEO) or trusted domains in incoming emails. This directly addresses the scenario of spear-phishing attacks that trick employees into transferring funds by mimicking trusted senders.

Answer

Anti-spam policy

Answer

Safe Links

Answer

Safe Attachments

Question 14

A company uses Microsoft 365 and Microsoft Azure. The security team wants a single portal that provides a unified view of alerts and incidents from their endpoints, email, and cloud applications to accelerate threat investigation and response. Which Microsoft security solution should they use?

Accepted Answer

Microsoft 365 Defender portal. Microsoft 365 Defender portal (now part of the Microsoft 365 Defender unified security operations platform) is designed to aggregate alerts and incidents from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), and cloud applications (Microsoft Defender for Cloud Apps) into a single queue. This unified view enables security teams to triage and investigate threats across these domains without switching between separate consoles, directly accelerating response times.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Purview Compliance Manager

Question 15

Match each Microsoft identity service to its description.

Accepted Answer

Azure AD: Cloud-based identity and access management service. Microsoft identity services include Azure AD (cloud IAM), Azure AD DS (managed domain services), and Azure AD B2C (customer IAM). Common confusions involve swapping descriptions of Azure AD with on-premises AD and Azure AD DS with Azure AD B2B.

Answer

Azure AD B2B: Managed domain services such as domain join and LDAP

Answer

Active Directory (on-premises): Cloud-based identity and access management

Answer

Azure AD: On-premises directory service for Windows networks