SC-900 Describe the capabilities of Microsoft security solutions Practice Test 13 — 15 Questions

Question 1

A security operations center (SOC) team uses Microsoft Sentinel with User and Entity Behavior Analytics (UEBA) enabled. They notice an alert about a user accessing a sensitive HR application from an unusual IP address at 3 AM. What does UEBA primarily use to detect this anomaly?

Accepted Answer

Historical behavior baselines and machine learning. UEBA builds a baseline of normal user behavior over time and uses machine learning to detect deviations. Option A is wrong because static rules do not adapt to user patterns. Option B is wrong because threat intelligence feeds are external. Option C is wrong because manual analyst input is not the primary mechanism.

Answer

Static rule-based thresholds defined by the SOC

Answer

Manual input from the SOC team

Answer

Threat intelligence feeds from Microsoft

Question 2

Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps?

Accepted Answer

Session controls to monitor and control app access in real time. Microsoft Defender for Cloud Apps provides session controls that leverage reverse proxy architecture to monitor and control user app access in real time, enabling conditional access policies for cloud apps. Cloud discovery uses traffic logs from network appliances or Windows endpoints to identify shadow IT by analyzing app usage and risk scores.

Answer

Information protection for files in Microsoft 365

Answer

Identity governance and access reviews

Answer

Vulnerability assessment for Azure virtual machines

Question 3

Which THREE of the following are features of Microsoft Purview Insider Risk Management?

Accepted Answer

Detection of repeated security policy violations by a user. Insider Risk Management includes detecting data leaks, detecting security policy violations, and providing forensic evidence. Vulnerability scanning (D) is not part of Insider Risk Management; it's part of Defender for Cloud. Phishing simulation (E) is part of Attack Simulation Training.

Answer

Phishing simulation campaigns

Answer

Vulnerability scanning of network endpoints

Question 4

Which TWO of the following are included in Microsoft Entra ID Protection?

Accepted Answer

Risk-based Conditional Access policies. Entra ID Protection includes risk-based conditional access and risk detections like sign-in risk. Privileged Identity Management (B) is a separate feature but related, and is included in Entra ID P2. Passwordless authentication (C) is a feature of Entra ID, not specifically Protection. DLP (D) is Purview. Identity Governance (E) is Entra ID Governance.

Answer

Data loss prevention (DLP)

Answer

Privileged Identity Management (PIM)

Answer

Passwordless authentication support

Question 5

Which THREE of the following are capabilities of Microsoft Defender for Office 365?

Accepted Answer

Safe Links protection in email and Office documents. Safe Links is a core capability of Microsoft Defender for Office 365 that proactively scans URLs in email messages and Office documents (like Word, Excel, and PowerPoint) at the time of click. It rewrites links to route through Microsoft's protection infrastructure, blocking access to malicious or phishing websites in real time. This protects users from zero-hour threats that may not yet be detected by traditional signature-based filters.

Answer

Cloud discovery of unsanctioned SaaS apps

Answer

Device compliance policies for mobile devices

Question 6

Which TWO of the following are examples of Microsoft Copilot for Security use cases?

Accepted Answer

Answering a natural language question about a KQL query. Copilot for Security can generate incident summaries and suggest remediation steps (A) and provide natural language queries for KQL (C). Creating DLP policies (B) is a Purview task. Resetting passwords (D) is an IT admin task. Configuring network firewalls (E) is infrastructure.

Answer

Configuring firewall rules in Azure

Answer

Resetting a user's password in Entra ID

Answer

Creating a new DLP policy in Microsoft Purview

Question 7

Refer to the exhibit. An analyst runs a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

To retrieve the most recent 10 malware alerts.. The query filters alerts with AlertName 'Malware detected', projects relevant columns, orders by time descending, and takes the top 10. This retrieves the 10 most recent malware alerts. Option A is wrong because it does not count. Option B is wrong because it retrieves multiple alerts, not just one. Option D is wrong because it does not aggregate by computer.

Answer

To find the single highest severity alert.

Answer

To count the total number of malware alerts in the last 24 hours.

Answer

To list all computers with malware alerts.

Question 8

Your organization uses Microsoft Sentinel to detect threats. A security analyst needs to create a custom analytics rule that triggers an incident when a user accesses more than 1000 files from an external IP address within 5 minutes. Which rule type should the analyst configure?

Accepted Answer

Scheduled query rule. Option B is correct because Scheduled query rules allow aggregation over time windows. Option A is wrong because NRT rules run every minute and cannot aggregate over 5 minutes. Option C is wrong because Fusion uses ML to correlate alerts. Option D is wrong because ML Behavior Analytics is for UEBA anomalies.

Answer

Fusion rule

Answer

ML Behavior Analytics rule

Answer

Near-real-time (NRT) query rule

Question 9

Your company uses Microsoft Purview Information Protection to classify and protect sensitive data. You need to ensure that when a user sends an email containing a credit card number, the email is automatically encrypted and a custom footer is added. Which two components should you configure?

Accepted Answer

Sensitivity label with auto-classification for credit card numbers. Option A is correct because a sensitive info type label can auto-classify credit card numbers. Option B is correct because an auto-labeling policy applies the protection and footer. Option C is wrong because DLP policies block or warn but do not encrypt. Option D is wrong because retention policies manage lifecycle, not encryption.

Answer

Data Loss Prevention (DLP) policy for credit card numbers

Answer

Retention label and policy for credit card data

Question 10

Your organization wants to protect against phishing attacks by verifying the sender's identity for incoming emails. Which Microsoft Defender for Office 365 feature should you configure?

Accepted Answer

Anti-phishing policy with SPF/DKIM/DMARC settings. Option C is correct because SPF, DKIM, and DMARC are email authentication protocols in Defender for Office 365. Option A is wrong because Safe Attachments checks attachments. Option B is wrong because Safe Links checks URLs. Option D is wrong because Anti-malware policies scan for malware.

Answer

Anti-malware policy

Answer

Safe Links policy

Answer

Safe Attachments policy

Question 11

A company uses Microsoft Defender for Cloud to secure its hybrid cloud workload. The security team needs to ensure that all virtual machines (VMs) have Just-In-Time (JIT) VM access enabled. What should they use to enforce this across subscriptions?

Accepted Answer

Assign an Azure Policy initiative that requires JIT VM access. Option B is correct because Azure Policy can enforce JIT VM access via a built-in initiative. Option A is wrong because Secure Score recommendations are advisory, not enforcement. Option C is wrong because Defender for Cloud plans enable features but don't enforce configuration. Option D is wrong because Azure Blueprints are deprecated.

Answer

Use Azure Blueprints to deploy JIT access configuration

Answer

Enable the Defender for Cloud servers plan

Answer

Implement a Secure Score recommendation for JIT access

Question 12

Your company uses Microsoft Intune to manage mobile devices. You need to ensure that company data on personal devices is protected if the device is lost or stolen. What should you configure?

Accepted Answer

Selective wipe action. Selective wipe (Option D) is the correct configuration because it removes only corporate data from a personal device while preserving the user's personal apps, photos, and settings. In Microsoft Intune, a selective wipe targets managed app data and company email profiles via Exchange ActiveSync, leaving the device usable for personal purposes. This is the appropriate action for protecting company data on a lost or stolen BYOD device without overstepping into the user's private information.

Answer

Compliance policy with device health requirements

Answer

Conditional Access policy requiring compliant devices

Answer

Full wipe action

Question 13

Your organization uses Microsoft Entra ID and wants to provide a single sign-on (SSO) experience for a third-party SaaS application that supports SAML 2.0. The app must also enforce multifactor authentication (MFA) for external users. What should you configure?

Accepted Answer

Set up SAML-based federation in Microsoft Entra ID and assign a Conditional Access policy requiring MFA. Option B is correct because SAML-based federation provides SSO and can be combined with Conditional Access for MFA. Option A is wrong because OAuth 2.0 is for delegated access, not SAML SSO. Option C is wrong because password-based SSO does not support SAML. Option D is wrong because Linked Sign-On uses existing IdP, not federation.

Answer

Add the app as a Linked Sign-On application

Answer

Use password-based SSO in Microsoft Entra ID

Answer

Configure OAuth 2.0 authorization in Microsoft Entra ID

Question 14

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender XDR. The security team needs to determine if the file 'invoice.docm' is known malware and if other devices in the organization have this file. What should they do next?

Accepted Answer

Search in Advanced Hunting for the file's SHA256 hash across all devices. Option D is correct because the file SHA256 allows querying threat intelligence and hunting for the file across devices. Option A is wrong because the alert is already triggered. Option B is wrong because the device is already identified. Option C is wrong because the user action is already captured.

Answer

Isolate the device DESKTOP-01 immediately

Answer

Trigger the automated investigation for this alert

Answer

Review the user jdoe's recent activities

Question 15

Your company uses Microsoft Sentinel to manage security incidents. You need to automatically assign incidents to a specific analyst team based on the incident category (e.g., phishing incidents to the SOC team). What should you configure?

Accepted Answer

Automation rule with a condition on incident category and an action to assign to the SOC team. Automation rules in Microsoft Sentinel allow you to define conditions based on incident properties (like category) and automatically take actions such as assigning the incident to a specific team. This is the correct and most efficient method for routing incidents by category without requiring custom code or external playbooks.

Answer

Create a watchlist mapping categories to teams and use it in analytics rules

Answer

Configure the analytics rule to set the incident owner in the rule query

Answer

Playbook triggered by incident creation that assigns the incident