SC-900 Describe the capabilities of Microsoft security solutions Practice Test 15 — 15 Questions

Question 1

Your organization has Microsoft Sentinel deployed. The security operations team needs to automatically respond to a security incident by opening an incident in ServiceNow and sending a notification to a Teams channel. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An automation rule with a playbook. Automation rules in Microsoft Sentinel can trigger playbooks (based on Azure Logic Apps) that integrate with external systems like ServiceNow and Teams. Option B is wrong because workbooks provide visualizations, not automation. Option C is wrong because analytics rules create alerts, not automated responses. Option D is wrong because watchlists are for correlation, not response.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 2

Your company uses Microsoft Entra ID and is implementing a zero-trust security model. You need to ensure that all access requests to sensitive applications are verified continuously, not just at the initial sign-in. Which Microsoft Entra ID capability should you use?

Accepted Answer

Conditional Access with session controls. Conditional Access with session controls enforces continuous access evaluation (CAE) by intercepting real-time signals—such as user risk, device compliance, or location changes—after the initial authentication. This ensures that access to sensitive applications is verified throughout the session, not just at sign-in, aligning with the zero-trust principle of 'verify explicitly and continuously.'

Answer

Access reviews

Answer

Microsoft Entra Identity Protection

Answer

Privileged Identity Management

Question 3

Your organization has deployed Microsoft Intune for mobile device management. You need to ensure that users can only access corporate resources from devices that are compliant with your security policies. Which policy type should you configure?

Accepted Answer

A Conditional Access policy. A Conditional Access policy is the correct choice because it enforces access controls at the identity level, evaluating device compliance status before granting access to corporate resources. When combined with Intune compliance policies, Conditional Access can block or allow access based on real-time device health checks, ensuring only compliant devices can connect.

Answer

An app protection policy

Answer

A compliance policy

Answer

A configuration policy

Question 4

Your organization is using Microsoft Defender for Cloud to secure a multi-cloud environment including Azure and AWS. You need to identify misconfigurations that could lead to security breaches. Which feature should you use?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is the correct feature because it continuously assesses your multi-cloud environment (Azure and AWS) against security best practices and compliance frameworks, identifying misconfigurations that could lead to security breaches. In Microsoft Defender for Cloud, CSPM provides a unified view of security posture across clouds, detecting issues like open ports, weak encryption, or excessive permissions without requiring agents. This directly addresses the need to find misconfigurations that attackers could exploit.

Answer

Cloud Workload Protection (CWP)

Answer

Regulatory compliance dashboard

Answer

Security score

Question 5

Your company uses Microsoft Purview to manage data across Azure, on-premises SQL Server, and Amazon S3. You need to create a unified map of all data sources and their sensitivity labels. Which Microsoft Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct feature because it provides a unified, automated map of data assets across hybrid and multi-cloud environments (Azure, on-premises SQL Server, and Amazon S3). It automatically scans and classifies data sources, applies sensitivity labels, and maintains a centralized metadata repository, enabling a holistic view of the data landscape and its sensitivity.

Answer

Microsoft Purview Data Sharing

Answer

Microsoft Purview Data Estate Insights

Answer

Microsoft Purview Data Catalog

Question 6

Your organization uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on several endpoints. Which feature allows you to search for indicators of compromise (IOCs) across all endpoints?

Accepted Answer

Advanced hunting. Advanced hunting in Microsoft Defender for Endpoint is a query-based threat hunting tool that allows security analysts to search for indicators of compromise (IOCs) across all endpoints using the Kusto Query Language (KQL). It provides access to raw, schema-based tables (e.g., DeviceEvents, DeviceFileEvents, DeviceNetworkEvents) for up to 30 days of historical data, enabling proactive detection of malware outbreak patterns across the entire fleet.

Answer

Incidents and alerts

Answer

Threat analytics

Answer

Device inventory

Question 7

You are reviewing a Microsoft Purview sensitivity label configuration. Based on the exhibit, what will happen when this label is applied to a document?

Accepted Answer

The document will be encrypted with AES256, watermarked with 'CONFIDENTIAL', and sharing will be blocked.. The exhibit shows a Microsoft Purview sensitivity label configured with both encryption (AES256) and content marking (a 'CONFIDENTIAL' watermark), and the sharing permissions are explicitly set to 'Block sharing'. This combination of settings ensures that when the label is applied, the document is encrypted, watermarked, and sharing is prevented.

Answer

The document will be watermarked only.

Answer

The document will be encrypted and will expire after a set period.

Answer

The document will display a warning before sharing.

Question 8

You are analyzing sign-in logs in Microsoft Sentinel. Based on the KQL query in the exhibit, what is the purpose of this query?

Accepted Answer

Identify users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.. The KQL query filters sign-in logs for events where the 'ResultType' is '50057', which specifically indicates a sign-in attempt from a disabled account. It then groups by user and counts occurrences, using a 'where' clause to filter for users with more than 10 such attempts. Finally, it limits the results to the last 7 days via the time range filter in the query or the workspace time filter. This directly identifies users who have attempted to sign in with a disabled account more than 10 times in the last 7 days.

Answer

Identify all sign-in attempts from a specific IP address.

Answer

Identify impossible travel activity across different locations.

Answer

Identify locations with the highest number of failed sign-ins.

Question 9

You run the Microsoft Graph PowerShell command in the exhibit. What information does this command retrieve about the user?

Accepted Answer

The user's last sign-in dates. The command `Get-MgUser -UserId user@contoso.com -Property SignInActivity | Select-Object -Property SignInActivity` retrieves the `SignInActivity` property of the specified user, which contains the `lastSignInDateTime` and `lastNonInteractiveSignInDateTime` fields. This data directly provides the user's last sign-in dates, making option B correct.

Answer

The user's license assignments

Answer

The user's assigned roles

Answer

The user's group memberships

Question 10

Which TWO of the following are capabilities of Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Cloud Workload Protection (CWP). Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) to continuously assess your cloud resources against security baselines and regulatory standards, and Cloud Workload Protection (CWP) to deliver integrated threat detection and advanced defenses for workloads across Azure, on-premises, and other clouds. These two capabilities are core pillars of Defender for Cloud, enabling both proactive posture improvement and runtime workload protection.

Answer

Email security

Answer

Identity protection

Answer

Endpoint detection and response (EDR)

Question 11

Which TWO of the following are capabilities of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security information and event management (SIEM). Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that aggregates log data from across an organization to detect, investigate, and respond to threats. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response workflows.

Answer

Endpoint detection and response (EDR)

Answer

Vulnerability scanning

Answer

Data classification and labeling

Question 12

A company uses Microsoft Defender for Cloud Apps to monitor SaaS app usage. The security team wants to receive an alert when a user downloads more than 10 files from SharePoint Online within 5 minutes. Which type of policy should they create?

Accepted Answer

Anomaly detection policy. An anomaly detection policy in Microsoft Defender for Cloud Apps is designed to identify unusual user behaviors, such as a spike in file downloads within a short time window. This policy uses machine learning to establish a baseline of normal activity and triggers alerts when deviations like downloading more than 10 files from SharePoint Online in 5 minutes occur, making it the correct choice for this use case.

Answer

Session policy

Answer

OAuth app policy

Answer

File policy

Question 13

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to prevent users from sharing credit card numbers via email outside the company. Which type of DLP rule action should they configure?

Accepted Answer

Block. To prevent users from sharing credit card numbers via email outside the company, a DLP rule action of 'Block' is required. This action stops the email from being sent when sensitive content (e.g., credit card numbers) is detected, ensuring data exfiltration is prevented. The Block action can also be configured to show a policy tip to the user, but the core enforcement is the blocking of the message.

Answer

Notify

Answer

Audit only

Answer

Encrypt

Question 14

A company is designing a Microsoft 365 Defender incident response workflow. They want to automatically isolate a compromised device when a ransomware alert is triggered. Which Microsoft 365 component should be used to execute the automated response action?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint includes automated investigation and remediation (AIR) capabilities that can isolate a device from the network when a ransomware alert is triggered. This is the correct component because it provides endpoint detection and response (EDR) with built-in playbooks for automatic containment actions like device isolation.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel

Answer

Microsoft Purview

Question 15

A security analyst needs to investigate a phishing campaign that targeted multiple users. They want to correlate email threat data with user actions and device signals. Which Microsoft security solution should they use as the primary investigation console?

Accepted Answer

Microsoft 365 Defender. Microsoft 365 Defender (now Microsoft Defender XDR) is the correct choice because it provides a unified incident investigation and response experience that correlates signals across email, endpoints, identities, and cloud apps. For a phishing campaign targeting multiple users, the analyst needs to correlate email threat data (from Defender for Office 365) with user actions (from Azure AD/Identity) and device signals (from Defender for Endpoint) — this cross-domain correlation is the primary function of Microsoft 365 Defender's incident queue and advanced hunting.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Office 365

Answer

Microsoft Sentinel