SC-900 Describe the capabilities of Microsoft security solutions Practice Test 17 — 15 Questions

Question 1

A company wants to use Microsoft Entra ID (Azure AD) to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. Which security feature should they implement?

Accepted Answer

Conditional Access policies. Conditional Access policies allow administrators to require MFA based on conditions like application sensitivity. Option B is incorrect because Identity Protection detects risk, not enforces MFA. Option C is incorrect because Privileged Identity Management (PIM) manages access for privileged roles. Option D is incorrect because password protection prevents weak passwords.

Answer

Privileged Identity Management (PIM)

Answer

Password Protection

Answer

Identity Protection policies

Question 2

Which TWO of the following are capabilities of Microsoft Defender XDR? (Choose two.)

Accepted Answer

Correlate alerts from multiple domains into a single incident. Microsoft Defender XDR correlates alerts from multiple domains—such as endpoint, email, identity, and cloud apps—into a single incident. This cross-domain correlation is a core capability of the XDR (Extended Detection and Response) solution, enabling security teams to see the full attack story in one place.

Answer

Data loss prevention for sensitive information

Answer

Centralized log analytics for custom queries

Answer

Identity governance and access reviews

Question 3

Which THREE capabilities are provided by Microsoft Purview? (Choose three.)

Accepted Answer

Data classification and labeling. Microsoft Purview offers data classification, data loss prevention, and data lifecycle management. Option D is a Microsoft Entra feature; Option E is a Microsoft Defender feature.

Answer

Identity protection and risk detection

Answer

Threat and vulnerability management

Question 4

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security information and event management (SIEM). Microsoft Sentinel provides SIEM and SOAR capabilities. Option A is a capability; Option B is a capability; Option C is a Microsoft Entra feature; Option D is a Microsoft Defender feature; Option E is a Microsoft Purview feature.

Answer

Identity governance and administration

Answer

Endpoint detection and response (EDR)

Answer

Data classification and labeling

Question 5

Your organization uses Microsoft Purview to label and protect sensitive data. The compliance team wants to automatically apply a 'Confidential' label to documents containing personally identifiable information (PII) stored in SharePoint Online. What should they create?

Accepted Answer

An auto-labeling policy for sensitivity labels. Auto-labeling policies can automatically apply sensitivity labels to documents based on sensitive information types. Option B is incorrect because retention labels are for retention. Option C is incorrect because trainable classifiers are for pattern detection but do not apply labels automatically. Option D is incorrect because DLP policies block actions.

Answer

A DLP policy to detect PII

Answer

A trainable classifier for PII

Answer

A retention label policy for PII

Question 6

An organization is deploying Microsoft Intune for mobile device management. They need to ensure that all iOS devices must have a passcode of at least 6 characters and the device must be encrypted. What should they configure?

Accepted Answer

A device compliance policy. Device compliance policies in Intune can require specific settings like passcode length and encryption. Option A is incorrect because Conditional Access uses compliance status. Option C is incorrect because configuration profiles push settings but do not enforce compliance. Option D is incorrect because app protection policies manage apps, not devices.

Answer

A Conditional Access policy

Answer

A device configuration profile

Answer

An app protection policy

Question 7

Your company uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to identify resources that are missing system updates. Which feature should they use?

Accepted Answer

Secure Score recommendations. Defender for Cloud's Secure Score includes recommendations for missing system updates. Option B is incorrect because vulnerability assessment is for vulnerabilities, not updates. Option C is incorrect because just-in-time access is for management ports. Option D is incorrect because adaptive application controls allowlist applications.

Answer

Just-in-time VM access

Answer

Vulnerability assessment solutions

Answer

Adaptive application controls

Question 8

Your organization uses Microsoft Entra ID and wants to automatically block sign-ins from users located in countries that are not approved for business operations. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access with Named Locations. Conditional Access policies allow you to create location-based policies to block or grant access based on geographic locations. Option A is correct because Named Locations are used in Conditional Access to define countries. Option B (Identity Protection) detects risks but does not directly block by country. Option C (Privileged Identity Management) manages roles. Option D (Terms of Use) presents agreements but does not block by location.

Answer

Privileged Identity Management

Answer

Terms of Use

Answer

Identity Protection user risk policy

Question 9

A security administrator needs to enforce that all Microsoft 365 documents containing credit card numbers are automatically encrypted before being shared externally. Which Microsoft Purview solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Data Loss Prevention (DLP) policies can detect sensitive information like credit card numbers and automatically apply encryption. Option C is correct. Option A (Information Protection) applies labels but does not auto-encrypt based on content. Option B (Audit) logs events. Option D (Communication Compliance) monitors communications.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Information Protection

Question 10

Your organization is planning to deploy Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that logs from your network proxy servers are ingested. Which method should you use to connect the logs?

Accepted Answer

Log collector. Defender for Cloud Apps uses log collectors to ingest traffic logs from proxies and firewalls. Option D is correct. Option A (API connector) connects to cloud apps, not proxies. Option B (Conditional Access) controls access. Option C (Microsoft Sentinel connector) is for SIEM ingestion, not Cloud App Discovery.

Answer

Conditional Access App Control

Answer

Microsoft Sentinel data connector

Answer

App connector API

Question 11

A company wants to allow users to reset their own passwords from the login screen without contacting IT. Which Microsoft Entra ID feature enables this?

Accepted Answer

Self-Service Password Reset. Self-Service Password Reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own passwords from the login screen without contacting IT. It is specifically designed to reduce helpdesk workload by enabling password changes or unlocks through a verified authentication method, such as a phone call, text message, or the Microsoft Authenticator app.

Answer

Conditional Access

Answer

Multifactor authentication

Answer

Identity Protection

Question 12

Your organization uses Microsoft Sentinel. You need to create an analytics rule that triggers an incident when more than 10 failed sign-ins occur from a single IP address within 5 minutes. Which rule type should you use?

Accepted Answer

Scheduled query rule. Scheduled query rules run at intervals and can aggregate events. Option B is correct. Option A (NRT) provides near-real-time but limited aggregation. Option C (ML Behavior Analytics) uses ML. Option D (Fusion) correlates alerts.

Answer

Fusion rule

Answer

Near-real-time (NRT) rule

Answer

ML Behavior Analytics rule

Question 13

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel analytics rule. What is the primary purpose of this rule?

Accepted Answer

To detect when a file labeled 'Highly Confidential' is shared externally. The query filters alerts for 'Sensitive file shared externally' and further refines to files with SensitivityLabel 'Highly Confidential'. It projects the file name and owner. Option C is correct. Option A is too broad (any shared file). Option B mentions 'all alerts'. Option D is incorrect because the query does not block sharing.

Answer

To identify all files shared externally regardless of sensitivity

Answer

To automatically block external sharing of sensitive files

Answer

To list all alerts generated by the rule

Question 14

Your organization wants to prevent users from installing unapproved apps on company-managed Windows devices. Which Microsoft Intune feature should you use?

Accepted Answer

App control policies. Intune app protection policies (APP) protect data, but app control policies (e.g., Windows Defender Application Control) prevent unapproved apps. Option D is correct. Option A (Conditional Access) controls access, not app installation. Option B (Compliance policies) check settings. Option C (Device configuration) manages settings but not app installation control.

Answer

Device configuration profiles

Answer

Conditional Access

Answer

Device compliance policies

Question 15

Your organization uses Microsoft Defender for Office 365. A user reports receiving a phishing email that bypassed the default filters. You need to create a custom mail flow rule to block similar emails based on specific keywords in the subject line. Which tool should you use?

Accepted Answer

Exchange admin center. Exchange admin center (EAC) allows creating mail flow rules (transport rules) based on conditions like subject keywords. Option B is correct. Option A (Security & Compliance Center) includes policies but not mail flow rules. Option C (Defender for Cloud Apps) is for cloud apps. Option D (Microsoft Entra admin center) is for identity.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Defender for Cloud Apps portal

Answer

Microsoft Entra admin center