SC-900 Describe the capabilities of Microsoft security solutions Practice Test 14 — 15 Questions

Question 1

Your organization uses Microsoft Purview to govern data in Azure Data Lake Storage. You need to create a data classification policy that automatically tags files containing personally identifiable information (PII) such as social security numbers. Which scanning solution should you use?

Accepted Answer

Microsoft Purview Data Map scanning. Option B is correct because Microsoft Purview Data Map scans and classifies data sources. Option A is wrong because Data Loss Prevention (DLP) is for data protection, not classification. Option C is wrong because Information Protection focuses on labels and encryption. Option D is wrong because Audit logs record activities, not scan data.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Question 2

Your organization uses Microsoft Defender for Cloud to assess the security posture of its Azure resources. Which two actions can be taken to improve the Secure Score? (Choose two.)

Accepted Answer

Implement security recommendations by remediating unhealthy resources. Options A and C are correct because enabling Defender plans and implementing recommendations improve Secure Score. Option B is wrong because disabling VMs reduces attack surface but does not improve score. Option D is wrong because removing resources may reduce score. Option E is wrong because disabling logging reduces visibility.

Answer

Delete unused Azure resources to simplify management

Answer

Disable diagnostic logging for storage accounts

Answer

Disable non-critical virtual machines to reduce attack surface

Question 3

A SOC analyst is investigating a potential security incident in Microsoft Sentinel. Which three are valid methods to gather additional context about a user entity? (Choose three.)

Accepted Answer

Run an advanced hunting query in Microsoft 365 Defender. Options A, C, and D are correct because entity pages, advanced hunting, and playbooks provide context. Option B is wrong because watchlists are static and not for investigation. Option E is wrong because automation rules are for incident handling, not investigation.

Answer

Create an automation rule to assign the incident

Answer

Add the user to a watchlist

Question 4

Your company wants to protect sensitive data in Microsoft Teams. Which two Microsoft Purview features can help prevent accidental sharing of confidential information? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policies for Teams. Options A and D are correct because DLP policies and sensitivity labels protect data. Option B is wrong because retention policies manage lifecycle, not sharing. Option C is wrong because audit logs only record events. Option E is wrong because eDiscovery is for legal discovery.

Answer

Audit log search for Teams

Answer

eDiscovery for Teams

Answer

Retention policies for Teams messages

Question 5

Refer to the exhibit. The exhibit shows an Azure Policy definition. A storage account named 'storagedev' is created with network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules. What will happen when this policy is assigned?

Accepted Answer

The storage account creation will be denied. Option D is correct because the condition matches (defaultAction Allow and no IP rules) and the effect is deny, so the storage account creation will be denied. Option A is wrong because deny effect blocks creation. Option B is wrong because audit would log but not block. Option C is wrong because the condition is met.

Answer

The storage account will be created successfully

Answer

The policy will audit the storage account and mark it as non-compliant

Answer

The storage account will be created, but the policy will modify the ACLs

Question 6

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender for Endpoint. The SOC team needs to decode the PowerShell command to understand the malicious intent. Which tool or method should they use?

Accepted Answer

Decode the Base64 string using a built-in decoder or online tool. Option A is correct because the command is Base64 encoded (the string after -EncodedCommand). Decoding it reveals a download cradle. Option B is wrong because the command is not encrypted. Option C is wrong because there is no script block to log. Option D is wrong because the hash is for identification, not decoding.

Answer

Search for the SHA256 hash in threat intelligence feeds

Answer

Decrypt the command using the device's decryption keys

Answer

Use PowerShell script block logging to capture the decoded command

Question 7

Your organization uses Microsoft Purview Compliance Manager to track compliance with regulatory standards. You need to create a custom assessment for a new internal policy. What should you do first?

Accepted Answer

Create a custom template with your internal controls. In Microsoft Purview Compliance Manager, assessments are built from templates that define the controls, improvement actions, and scoring parameters. To create a custom assessment for a new internal policy, you must first create a custom template that includes your own controls, because assessments cannot be created from scratch without a template. This template serves as the foundation for the assessment, allowing you to define the specific controls and actions that map to your internal policy.

Answer

Define the score calculation method for the assessment

Answer

Create control actions and assign them to the assessment

Answer

Use an existing Microsoft template and modify the improvement actions

Question 8

You are the security administrator for a company using Microsoft Defender XDR. A user reports receiving a suspicious email with a link. What Microsoft Defender XDR feature should you use to investigate the email's threat level?

Accepted Answer

Email & collaboration in Microsoft Defender XDR. Option C is correct because Email & collaboration in Microsoft Defender XDR provides detailed analysis of email threats. Option A is wrong because Microsoft Defender for Cloud Apps focuses on cloud app security, not email. Option B is wrong because Microsoft Defender for Identity focuses on identity threats. Option D is wrong because Microsoft Defender for Endpoint focuses on endpoint threats.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 9

Your organization is adopting Microsoft 365 Copilot for enterprise users. Which Microsoft Purview capability should you configure to prevent sensitive data from being inadvertently shared during Copilot interactions?

Accepted Answer

Data Loss Prevention (DLP) policies. Option B is correct because Microsoft Purview Data Loss Prevention (DLP) policies can be extended to cover Copilot interactions. Option A is wrong because Sensitivity labels are for classification, but DLP is the enforcement mechanism. Option C is wrong because eDiscovery is for search and export, not prevention. Option D is wrong because Customer Lockbox is for access control, not data loss prevention.

Answer

Customer Lockbox

Answer

Sensitivity labels

Answer

eDiscovery

Question 10

You are investigating an alert in Microsoft Defender XDR. Based on the exhibit, what is the primary detection source for this alert?

Accepted Answer

Microsoft Defender for Identity. The exhibit shows an alert from Microsoft Defender XDR with a detection source of 'Microsoft Defender for Identity'. Defender for Identity uses on-premises Active Directory signals and network traffic to detect identity-based threats like lateral movement, privilege escalation, and compromised credentials. The alert details indicate suspicious activity tied to an on-premises domain controller, which is the core focus of Defender for Identity.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 11

Your company uses Microsoft Purview to protect sensitive data in SharePoint Online. You need to automatically apply a 'Confidential' sensitivity label to documents containing credit card numbers. What should you create?

Accepted Answer

An auto-labeling policy. Option B is correct because auto-labeling policies in Microsoft Purview can automatically apply labels based on sensitive info types. Option A is wrong because a retention policy is for retention, not labeling. Option C is wrong because a DLP policy can block or warn but not auto-label. Option D is wrong because an eDiscovery case is for search and legal hold.

Answer

A Data Loss Prevention (DLP) policy

Answer

A retention policy

Answer

An eDiscovery case

Question 12

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access. Option A is correct because Conditional Access in Microsoft Entra ID can enforce device compliance for access. Option B is wrong because Identity Protection handles risk, not compliance. Option C is wrong because Privileged Identity Management manages privileged roles. Option D is wrong because Self-Service Password Reset is for password reset.

Answer

Privileged Identity Management

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 13

You are investigating an alert in Microsoft 365 Defender. The KQL query in the exhibit retrieves evidence for alert-5678. What type of entities does this query filter for?

Accepted Answer

File entities. Option D is correct because the query filters where EntityType == 'File'. Option A is wrong because it filters for File, not Process. Option B is wrong because it filters for File, not Network. Option C is wrong because it filters for File, not Registry.

Answer

Registry entities

Answer

Process entities

Answer

Network entities

Question 14

Your organization is using Microsoft Sentinel as a SIEM. You want to automatically respond to a high-severity incident by opening a ticket in ServiceNow and notifying the security team via email. What should you create?

Accepted Answer

An automation rule. Option C is correct because automation rules in Microsoft Sentinel can trigger playbooks (Logic Apps) for incident response. Option A is wrong because analytics rules create incidents, not automated responses. Option B is wrong because workbooks are for visualization. Option D is wrong because watchlists are for threat intelligence.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 15

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to assess compliance with the CIS benchmark. What should you enable?

Accepted Answer

Regulatory compliance standards in Microsoft Defender for Cloud. Option A is correct because regulatory compliance standards in Defender for Cloud include CIS benchmarks. Option B is wrong because Azure Firewall is a network security service, not compliance assessment. Option C is wrong because Microsoft Sentinel is a SIEM. Option D is wrong because Azure Policy is used for compliance but within Defender for Cloud you enable regulatory compliance standards.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Firewall