SC-900 Describe the capabilities of Microsoft security solutions Practice Test 17 — 15 Questions

Question 1

Your company uses Microsoft Sentinel to manage security incidents. You need to automatically assign incidents to a specific analyst team based on the incident category (e.g., phishing incidents to the SOC team). What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Automation rule with a condition on incident category and an action to assign to the SOC team. Automation rules in Microsoft Sentinel allow you to define conditions based on incident properties (like category) and automatically take actions such as assigning the incident to a specific team. This is the correct and most efficient method for routing incidents by category without requiring custom code or external playbooks.

Answer

Create a watchlist mapping categories to teams and use it in analytics rules

Answer

Configure the analytics rule to set the incident owner in the rule query

Answer

Playbook triggered by incident creation that assigns the incident

Question 2

Your organization uses Microsoft Purview to govern data in Azure Data Lake Storage. You need to create a data classification policy that automatically tags files containing personally identifiable information (PII) such as social security numbers. Which scanning solution should you use?

Accepted Answer

Microsoft Purview Data Map scanning. Microsoft Purview Data Map scanning is the correct solution because it provides automated scanning and classification of data assets across Azure Data Lake Storage and other sources. It uses built-in classifiers to detect sensitive data types like social security numbers and applies the classification labels directly to the files, enabling governance and policy enforcement.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Data Loss Prevention (DLP)

Answer

Microsoft Purview Audit

Question 3

A SOC analyst is investigating a potential security incident in Microsoft Sentinel. Which three are valid methods to gather additional context about a user entity? (Choose three.)

Accepted Answer

Run an advanced hunting query in Microsoft 365 Defender. Running an advanced hunting query in Microsoft 365 Defender allows the SOC analyst to proactively search for user-related activities, such as logins, alerts, and behaviors, across the Microsoft 365 security ecosystem. This provides deep, contextual data about the user entity that can help confirm or refute the incident, leveraging the Kusto Query Language (KQL) to correlate events from multiple data sources.

Answer

Create an automation rule to assign the incident

Answer

Add the user to a watchlist

Question 4

Your company wants to protect sensitive data in Microsoft Teams. Which two Microsoft Purview features can help prevent accidental sharing of confidential information? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policies for Teams. Data Loss Prevention (DLP) policies for Teams can detect and block sharing of sensitive information (e.g., credit card numbers, social security numbers) in Teams messages and channels, preventing accidental exposure. Sensitivity labels allow you to classify and protect Teams sites and content by applying encryption, visual markings, and access restrictions, ensuring confidential data is not shared with unauthorized users.

Answer

Audit log search for Teams

Answer

eDiscovery for Teams

Answer

Retention policies for Teams messages

Question 5

Refer to the exhibit. The exhibit shows an Azure Policy definition. A storage account named 'storagedev' is created with network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules. What will happen when this policy is assigned?

Accepted Answer

The storage account creation will be denied. The Azure Policy definition shown uses the 'Deny' effect, which explicitly blocks any resource creation that does not meet the specified conditions. Since the storage account 'storagedev' has network ACLs set to allow all traffic (defaultAction: Allow) and no IP rules, it violates the policy's requirement for restricted network access. Therefore, Azure Policy will deny the creation of this storage account, preventing it from being provisioned.

Answer

The storage account will be created successfully

Answer

The policy will audit the storage account and mark it as non-compliant

Answer

The storage account will be created, but the policy will modify the ACLs

Question 6

Refer to the exhibit. The exhibit shows an alert from Microsoft Defender for Endpoint. The SOC team needs to decode the PowerShell command to understand the malicious intent. Which tool or method should they use?

Accepted Answer

Decode the Base64 string using a built-in decoder or online tool. The exhibit shows a PowerShell command encoded in Base64, which is a common obfuscation technique used by attackers to hide malicious intent. Decoding the Base64 string using a built-in decoder (e.g., `[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String()`) or an online tool directly reveals the plaintext command. This is the correct approach because Base64 is not encryption—it is an encoding scheme that can be reversed without any keys.

Answer

Search for the SHA256 hash in threat intelligence feeds

Answer

Decrypt the command using the device's decryption keys

Answer

Use PowerShell script block logging to capture the decoded command

Question 7

Your organization uses Microsoft Purview Compliance Manager to track compliance with regulatory standards. You need to create a custom assessment for a new internal policy. What should you do first?

Accepted Answer

Create a custom template with your internal controls. In Microsoft Purview Compliance Manager, assessments are built from templates that define the controls, improvement actions, and scoring parameters. To create a custom assessment for a new internal policy, you must first create a custom template that includes your own controls, because assessments cannot be created from scratch without a template. This template serves as the foundation for the assessment, allowing you to define the specific controls and actions that map to your internal policy.

Answer

Define the score calculation method for the assessment

Answer

Create control actions and assign them to the assessment

Answer

Use an existing Microsoft template and modify the improvement actions

Question 8

You are the security administrator for a company using Microsoft Defender XDR. A user reports receiving a suspicious email with a link. What Microsoft Defender XDR feature should you use to investigate the email's threat level?

Accepted Answer

Email & collaboration in Microsoft Defender XDR. Microsoft Defender XDR's Email & collaboration feature (part of Defender for Office 365) is the correct tool for investigating a suspicious email. It provides a unified investigation experience, including threat explorer, email entity pages, and detonation analysis, allowing you to inspect the email's headers, attachments, URLs, and determine its threat level using Microsoft's threat intelligence and machine learning models.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 9

Your organization is adopting Microsoft 365 Copilot for enterprise users. Which Microsoft Purview capability should you configure to prevent sensitive data from being inadvertently shared during Copilot interactions?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies are the correct Microsoft Purview capability to prevent sensitive data from being inadvertently shared during Copilot interactions. DLP policies can inspect content in real time, including Copilot prompts and responses, and apply actions such as blocking or warning when sensitive information types (e.g., credit card numbers, social security numbers) are detected. This directly addresses the requirement to prevent inadvertent sharing of sensitive data within the Copilot environment.

Answer

Customer Lockbox

Answer

Sensitivity labels

Answer

eDiscovery

Question 10

You are investigating an alert in Microsoft Defender XDR. Based on the exhibit, what is the primary detection source for this alert?

Accepted Answer

Microsoft Defender for Identity. The exhibit shows an alert from Microsoft Defender XDR with a detection source of 'Microsoft Defender for Identity'. Defender for Identity uses on-premises Active Directory signals and network traffic to detect identity-based threats like lateral movement, privilege escalation, and compromised credentials. The alert details indicate suspicious activity tied to an on-premises domain controller, which is the core focus of Defender for Identity.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Question 11

Your company uses Microsoft Purview to protect sensitive data in SharePoint Online. You need to automatically apply a 'Confidential' sensitivity label to documents containing credit card numbers. What should you create?

Accepted Answer

An auto-labeling policy. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive info types, such as credit card numbers. Option B (DLP policy) is incorrect because while DLP can detect and protect sensitive data, it does not automatically apply labels; it applies actions like blocking or warning. Option C (retention policy) is incorrect because retention policies manage data retention and deletion, not labeling. Option D (eDiscovery case) is incorrect because eDiscovery cases are used for searching and legal hold purposes.

Answer

A Data Loss Prevention (DLP) policy

Answer

A retention policy

Answer

An eDiscovery case

Question 12

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access. Conditional Access in Microsoft Entra ID is the correct feature because it allows you to enforce policies that require devices to be marked as compliant by Microsoft Intune before granting access to corporate email. By integrating with Intune, Conditional Access evaluates device compliance status in real time and blocks or allows access accordingly, ensuring only managed and compliant devices can reach email resources.

Answer

Privileged Identity Management

Answer

Self-Service Password Reset

Answer

Identity Protection

Question 13

You are investigating an alert in Microsoft 365 Defender. The KQL query in the exhibit retrieves evidence for alert-5678. What type of entities does this query filter for?

Accepted Answer

File entities. The KQL query filters for evidence related to alert-5678 by specifying a hash value (SHA256) of a file. In Microsoft 365 Defender, file entities are uniquely identified by their hash values, such as SHA256, SHA1, or MD5. The query uses the `where` clause to match the specific file hash, confirming that the filtered entities are file entities.

Answer

Registry entities

Answer

Process entities

Answer

Network entities

Question 14

Your organization is using Microsoft Sentinel as a SIEM. You want to automatically respond to a high-severity incident by opening a ticket in ServiceNow and notifying the security team via email. What should you create?

Accepted Answer

An automation rule. Automation rules in Microsoft Sentinel can be configured to trigger automated responses when an incident is created, such as running a playbook (a Logic App) that opens a ticket in ServiceNow and sends an email notification. Option B is wrong because workbooks are for visualization and reporting, not automation. Option C is wrong because analytics rules generate alerts/incidents based on data queries, but they do not directly perform response actions; instead, automation rules handle the response. Option D is wrong because watchlists are collections of data for correlation and enrichment, not for automated response.

Answer

A workbook

Answer

An analytics rule

Answer

A watchlist

Question 15

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to assess compliance with the CIS benchmark. What should you enable?

Accepted Answer

Regulatory compliance standards in Microsoft Defender for Cloud. To assess compliance with the CIS benchmark in Microsoft Defender for Cloud, you must enable the appropriate regulatory compliance standard. Defender for Cloud includes built-in support for industry standards like CIS, and by adding the CIS benchmark as a regulatory compliance standard, the service continuously assesses your Azure resources against the CIS controls and displays compliance status in the dashboard.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Firewall