SC-900 Describe the capabilities of Microsoft security solutions Practice Test 16 — 15 Questions

Question 1

An organization uses Microsoft Purview Data Loss Prevention (DLP) to prevent sensitive data from being shared externally. They need to block sharing of credit card numbers in emails and Teams messages. What should they create?

Accepted Answer

A DLP policy with a rule that detects credit card numbers and blocks sharing. Option A is correct because DLP policies can detect and block sensitive data like credit card numbers in email and Teams. Option B is wrong because sensitivity labels apply metadata but don't block sharing. Option C is wrong because retention labels manage retention. Option D is wrong because audit policies log activity but don't block.

Answer

A retention label to retain credit card data

Answer

An audit policy to log credit card sharing

Answer

A sensitivity label that marks credit card data

Question 2

Which TWO capabilities are provided by Microsoft Defender for Cloud? (Choose two.)

Accepted Answer

Secure score and security recommendations. Options A and D are correct. Defender for Cloud provides vulnerability assessment and security posture management. Option B is wrong because CASB is Defender for Cloud Apps. Option C is wrong because SIEM is Sentinel. Option E is wrong because endpoint protection is Defender for Endpoint.

Answer

Endpoint detection and response (EDR)

Answer

Cloud Access Security Broker (CASB)

Answer

Security Information and Event Management (SIEM)

Question 3

Which THREE components are part of Microsoft Defender XDR? (Choose three.)

Accepted Answer

Microsoft Defender for Office 365. Options A, B, and C are correct. Defender XDR includes Defender for Office 365, Defender for Endpoint, and Defender for Identity. Option D is wrong because Sentinel is a separate product. Option E is wrong because Purview is for data governance.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Question 4

Which TWO features are available in Microsoft Entra ID P2 licenses? (Choose two.)

Accepted Answer

Privileged Identity Management (PIM). Options B and D are correct. P2 includes Identity Protection and Privileged Identity Management. Option A is wrong because MFA is in P1 and also included in P2 but it's not exclusively P2; however, typically MFA is in P1 and free? Actually MFA is available in all tiers but P2 adds risk-based MFA. The question asks for features available in P2, and Identity Protection and PIM are key P2 features. Option C is wrong because password hash sync is free. Option E is wrong because self-service password reset is free or P1.

Answer

Self-service password reset (SSPR)

Answer

Multifactor authentication (MFA)

Answer

Password hash synchronization

Question 5

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to investigate ransomware alerts. The query returns: AlertSeverity High: 5, Medium: 3, Low: 2. The security team wants to automate a response for all high-severity ransomware alerts. What should you configure?

Accepted Answer

Create an automation rule that triggers a playbook for high-severity ransomware incidents. Option D is correct because an automation rule can trigger a playbook for high-severity incidents. Option A is wrong because analytics rules generate alerts, not automate responses. Option B is wrong because hunting queries are proactive. Option C is wrong because workbooks visualize data.

Answer

Create an analytics rule for ransomware

Answer

Create a hunting query for ransomware

Answer

Create a workbook to display ransomware alerts

Question 6

A company uses Microsoft Purview to map their data estate. They need to classify data stored in Azure SQL Database and Amazon S3. What should they use?

Accepted Answer

Microsoft Purview Data Map. Option B is correct because Purview can scan and classify data across on-premises and multi-cloud sources. Option A is wrong because Defender for Cloud focuses on security posture. Option C is wrong because Sentinel is for SIEM. Option D is wrong because Intune is for device management.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 7

An organization wants to provide a secure way for external partners to access specific SharePoint sites without creating new user accounts. What Microsoft Entra B2B feature should they use?

Accepted Answer

B2B collaboration. B2B collaboration is the correct Microsoft Entra B2B feature because it allows external partners to access specific SharePoint sites using their own identities (e.g., work or social accounts) without requiring new user accounts or passwords to be created in the organization's tenant. This is achieved through invitation-based redemption, where the partner user is represented as a guest user object in the directory, enabling fine-grained access control via SharePoint site sharing policies.

Answer

Azure AD B2C

Answer

Direct federation

Answer

Azure AD Domain Services

Question 8

Your organization uses Microsoft Defender for Cloud to protect hybrid workloads. A security administrator needs to ensure that all Azure subscriptions are automatically covered by Defender for Cloud's security policies. What should the administrator configure?

Accepted Answer

Assign the Azure Security Benchmark initiative to the root management group.. Defender for Cloud's default policy initiative is automatically assigned to all subscriptions in a management group, ensuring consistent coverage. Option A is incorrect because assigning at the resource group level does not apply to other groups. Option B is incorrect because Azure Policy must be assigned, not just enabled. Option D is incorrect because manual onboarding is not automatic.

Answer

Assign the Azure Security Benchmark initiative to each resource group.

Answer

Enable Defender for Cloud on each subscription individually.

Answer

Install the Log Analytics agent on all VMs.

Question 9

Refer to the exhibit. You are evaluating a custom Azure Policy definition. The policy is intended to audit whether users assigned to a management role have MFA enabled. However, the policy is not triggering alerts for non-compliant users. What is the most likely cause?

Accepted Answer

The 'mfaEnabledPrincipals' parameter is not populated with the list of MFA-enabled users.. The policy uses 'auditIfNotExists' but the existenceCondition checks if the principal ID is in the 'mfaEnabledPrincipals' parameter. This parameter must be populated with the list of principals that have MFA enabled, but the policy does not automatically detect MFA status. Option A is incorrect because the mode is 'All', which includes role assignments. Option C is incorrect because the policy does check for role assignments. Option D is incorrect because the audit effect does not require remediation.

Answer

The policy mode is set to 'All' instead of 'Indexed'.

Answer

The policy only evaluates role assignments of type 'Microsoft.Authorization/roleAssignments' but not users.

Answer

The effect 'auditIfNotExists' should be 'deny' to trigger alerts.

Question 10

Your company is deploying Microsoft Defender for Office 365. The security team wants to automatically remove malicious attachments from emails before they reach user inboxes. Which protection feature should be configured?

Accepted Answer

Safe Attachments policies. Safe Attachments in Defender for Office 365 detonates attachments in a sandbox and removes malicious ones before delivery. Option A is incorrect because Safe Links protects URLs, not attachments. Option B is incorrect because anti-phishing policies target phishing attempts. Option D is incorrect because anti-spam policies handle spam, not malware.

Answer

Anti-spam policies

Answer

Anti-phishing policies

Answer

Safe Links policies

Question 11

An organization uses Microsoft Sentinel for SIEM. The security operations center (SOC) wants to automatically create an incident when a user account is compromised and suspicious activity is detected. Which Microsoft Sentinel feature should be used?

Accepted Answer

Analytics rules. Analytics rules in Microsoft Sentinel can be configured to create incidents based on detection logic. Option A is incorrect because playbooks are for automated responses, not incident creation. Option B is incorrect because workbooks are for visualization. Option D is incorrect because watchlists are for threat intelligence.

Answer

Watchlists

Answer

Automation playbooks

Answer

Workbooks

Question 12

Refer to the exhibit. A security analyst in your SOC runs the provided KQL query in Microsoft Sentinel to identify users with repeated MFA or suspicious sign-in alerts. The query returns no results even though alerts exist. What is the most likely issue?

Accepted Answer

The alert names do not contain the strings 'MFA' or 'Suspicious sign-in'.. The query uses the 'has' operator which is case-insensitive, but the alert names in the environment might use different wording (e.g., 'Azure AD MFA' instead of 'MFA'). Option A is incorrect because the query uses 'has' which is case-insensitive. Option C is incorrect because the time range is 7 days. Option D is incorrect because the query correctly uses 'extend'.

Answer

The 'extend' operator fails because 'Entities' array is empty.

Answer

The TimeGenerated filter is too restrictive; alerts older than 7 days are excluded.

Answer

The 'has' operator is case-sensitive and the alert names are in uppercase.

Question 13

Your company wants to use Microsoft Purview to classify and protect sensitive data in Microsoft 365. The compliance team needs to automatically detect credit card numbers in emails and apply a label that encrypts the email. What should they configure?

Accepted Answer

A sensitivity label with auto-labeling for sensitive information types. Sensitivity labels with auto-labeling can detect sensitive data and apply encryption automatically. Option B is incorrect because retention labels are for retention, not protection. Option C is incorrect because DLP policies block or warn, not label. Option D is incorrect because trainable classifiers are for data classification, not automatic labeling.

Answer

A trainable classifier for credit card numbers

Answer

A retention label for credit card information

Answer

A data loss prevention (DLP) policy

Question 14

An organization uses Microsoft Intune to manage devices. The security team wants to ensure that only devices with a minimum OS version and antivirus enabled can access corporate email. What should they configure?

Accepted Answer

Conditional Access policy referencing device compliance. Conditional Access with device compliance policies evaluates device health and enforces access controls. Option A is incorrect because compliance policies alone do not enforce access. Option C is incorrect because app protection policies manage data within apps, not device-level access. Option D is incorrect because device enrollment is a prerequisite, not enforcement.

Answer

Device enrollment restrictions

Answer

App protection policies in Microsoft Defender for Cloud Apps

Answer

A device compliance policy

Question 15

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. The security team wants to automatically block the use of a newly discovered high-risk cloud app across all users. What is the most efficient approach?

Accepted Answer

Create an app discovery policy with governance action to unsanction the app.. Defender for Cloud Apps can generate a governance action to block the app via the API. Option A is incorrect because manual blocking is not automatic. Option C is incorrect because Conditional Access policies block at the identity level, not app level. Option D is incorrect because session controls are for monitoring, not blocking.

Answer

Create a Conditional Access policy to block the app for all users.

Answer

Manually add the app to the blocked list in the cloud discovery settings.

Answer

Configure session controls to monitor app usage.