SC-900 Describe the capabilities of Microsoft security solutions Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on several endpoints. Which feature allows you to search for indicators of compromise (IOCs) across all endpoints?

Accepted Answer

Advanced hunting. Option C is correct because Advanced hunting in Microsoft Defender for Endpoint enables KQL queries to search for IOCs across endpoints. Option A is wrong because the Device page shows details, not search. Option B is wrong because the Threat analytics dashboard provides threat intelligence, not interactive search. Option D is wrong because alerts are for incidents, not for searching IOCs.

Answer

Incidents and alerts

Answer

Threat analytics

Answer

Device inventory

Question 2

You are reviewing a Microsoft Purview sensitivity label configuration. Based on the exhibit, what will happen when this label is applied to a document?

Accepted Answer

The document will be encrypted with AES256, watermarked with 'CONFIDENTIAL', and sharing will be blocked.. Option A is correct because the label includes three actions: encrypt with AES256, apply a watermark, and block sharing. Option B is wrong because there is no expiration. Option C is wrong because it blocks sharing, not just warning. Option D is wrong because it includes encryption and watermark, not just marking.

Answer

The document will be watermarked only.

Answer

The document will be encrypted and will expire after a set period.

Answer

The document will display a warning before sharing.

Question 3

You are analyzing sign-in logs in Microsoft Sentinel. Based on the KQL query in the exhibit, what is the purpose of this query?

Accepted Answer

Identify users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.. Option B is correct because the query filters for result type 50057 (user account disabled) and counts attempts per user, then filters for more than 10 attempts. This could indicate a user trying to sign in with a disabled account. Option A is wrong because it filters for a specific error, not all attempts. Option C is wrong because it counts by user, not IP. Option D is wrong because it does not analyze impossible travel.

Answer

Identify all sign-in attempts from a specific IP address.

Answer

Identify impossible travel activity across different locations.

Answer

Identify locations with the highest number of failed sign-ins.

Question 4

You run the Microsoft Graph PowerShell command in the exhibit. What information does this command retrieve about the user?

Accepted Answer

The user's last sign-in dates. Option C is correct because the command uses Get-MgUser with the SignInActivity property to retrieve last sign-in times. Option A is wrong because it does not show group memberships. Option B is wrong because it shows sign-in times, not licenses. Option D is wrong because it shows the user's details, not license assignments.

Answer

The user's license assignments

Answer

The user's assigned roles

Answer

The user's group memberships

Question 5

Which TWO of the following are capabilities of Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Cloud Workload Protection (CWP). Options A and D are correct. Defender for Cloud provides cloud security posture management (CSPM) and cloud workload protection (CWP). Option B is wrong because endpoint detection is covered by Defender for Endpoint, not Defender for Cloud. Option C is wrong because email security is covered by Defender for Office 365. Option E is wrong because identity protection is covered by Microsoft Entra ID Protection.

Answer

Email security

Answer

Identity protection

Answer

Endpoint detection and response (EDR)

Question 6

Which THREE of the following are features of Microsoft Purview Data Loss Prevention (DLP)? (Choose three.)

Accepted Answer

Provide policy tips to users. Options A, C, and D are correct. DLP can detect sensitive data in emails, monitor endpoints, and be customized with policy tips. Option B is wrong because sensitivity labels are part of Information Protection, not DLP directly. Option E is wrong because retention policies are part of Records Management.

Answer

Apply sensitivity labels automatically

Answer

Retain data for a specified period

Question 7

Which TWO of the following are capabilities of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security information and event management (SIEM). Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that aggregates log data from across an organization to detect, investigate, and respond to threats. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response workflows.

Answer

Endpoint detection and response (EDR)

Answer

Vulnerability scanning

Answer

Data classification and labeling

Question 8

A company uses Microsoft Defender for Cloud Apps to monitor SaaS app usage. The security team wants to receive an alert when a user downloads more than 10 files from SharePoint Online within 5 minutes. Which type of policy should they create?

Accepted Answer

Anomaly detection policy. Anomaly detection policies use machine learning to detect unusual user behavior based on historical baselines, such as mass file downloads. Activity policies are rule-based but require explicit thresholds; however, the scenario describes behavior that is best detected by an anomaly detection policy because it adapts to typical usage patterns. Option A is wrong because session policies control real-time access. Option C is wrong because OAuth app policies govern app permissions. Option D is wrong because file policies apply to specific files or metadata.

Answer

Session policy

Answer

OAuth app policy

Answer

File policy

Question 9

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email outside the company. Which type of DLP rule action should they configure?

Accepted Answer

Block. The 'Block' action prevents the email from being sent and can optionally notify the user and admin. Option A is wrong because 'Audit only' logs the event but does not block. Option C is wrong because 'Encrypt' is a separate action but not the primary block mechanism. Option D is wrong because 'Notify' only sends an alert without blocking.

Answer

Notify

Answer

Audit only

Answer

Encrypt

Question 10

A company is designing a Microsoft 365 Defender incident response workflow. They want to automatically isolate a compromised device when a ransomware alert is triggered. Which Microsoft 365 component should be used to execute the automated response action?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint includes automated investigation and remediation (AIR) capabilities that can isolate a device from the network when a ransomware alert is triggered. This is the correct component because it provides endpoint detection and response (EDR) with built-in playbooks for automatic containment actions like device isolation.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Answer

Microsoft Purview

Question 11

A security analyst needs to investigate a phishing campaign that targeted multiple users. They want to correlate email threat data with user actions and device signals. Which Microsoft security solution should they use as the primary investigation console?

Accepted Answer

Microsoft 365 Defender. Microsoft 365 Defender provides a unified investigation experience across email, endpoints, identities, and cloud apps. Option A is wrong because Microsoft Defender for Endpoint is for endpoint threats only. Option B is wrong because Microsoft Defender for Office 365 is for email only. Option C is wrong because Microsoft Sentinel is a SIEM that can ingest data but is not the primary console for Defender incident investigation.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Question 12

A company wants to enforce conditional access policies that require multifactor authentication (MFA) for all users accessing financial apps from outside the corporate network. Which Microsoft Entra ID license is minimally required to create conditional access policies?

Accepted Answer

Microsoft Entra ID P1. Microsoft Entra ID P1 includes Conditional Access. Option A is wrong because Free does not include Conditional Access. Option C is wrong because P2 includes Identity Protection but Conditional Access is in P1. Option D is wrong because Microsoft 365 Business Basic includes Entra ID P1 but the question asks for the minimal license, which is Entra ID P1 standalone.

Answer

Microsoft 365 Business Basic

Answer

Microsoft Entra ID P2

Answer

Microsoft Entra ID Free

Question 13

Refer to the exhibit. A security analyst is reviewing an alert from Microsoft 365 Defender. The alert is associated with an incident. What is the best first step to investigate this alert?

Accepted Answer

Open the associated incident to view all related alerts and entities.. The alert is tagged as 'Malware' and has an incident ID, indicating it is part of a larger incident. The best practice is to open the incident to see correlated alerts and entities. Option A is wrong because ignoring the incident loses context. Option B is wrong because the alert is already high severity; mark as resolved later. Option D is wrong because running a simulation on a live alert is not appropriate.

Answer

Isolate the affected user's device immediately.

Answer

Mark the alert as resolved.

Answer

Run an automated simulation to test the alert.

Question 14

Refer to the exhibit. A Microsoft Purview DLP policy is configured. When a user attempts to share a document containing a credit card number externally, what will happen?

Accepted Answer

The sharing attempt is blocked and the user receives a notification.. The rule has both 'BlockAccess' and 'NotifyUser' actions, so the sharing will be blocked and the user will be notified. Option A is wrong because only notifying without blocking is not configured. Option B is wrong because the policy does not include encryption. Option D is wrong because the policy is active and will block.

Answer

The document is shared but the user is notified.

Answer

The document is encrypted before sharing.

Answer

The policy has no effect because no severity level is set.

Question 15

A company wants to use Microsoft Sentinel to collect security logs from on-premises servers and send them to Azure. Which data connector should they use?

Accepted Answer

Azure Monitor Agent (AMA). Azure Monitor Agent (AMA) is the recommended agent for collecting logs from Windows and Linux machines and sending to Log Analytics workspaces for Sentinel. Option A is wrong because MMA is legacy. Option C is wrong because the Syslog connector is for Linux but AMA also supports Syslog. Option D is wrong because the Office 365 connector is for cloud services.

Answer

Syslog connector

Answer

Microsoft Monitoring Agent (MMA)

Answer

Office 365 connector