SC-900 Describe the capabilities of Microsoft security solutions Practice Test 18 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing a Microsoft Purview Information Protection policy in JSON format. The policy defines two sensitivity labels. What is the key difference between the 'Confidential' label and the 'Highly Confidential' label?

Accepted Answer

The 'Highly Confidential' label restricts edit rights. The 'Confidential' label grants VIEW and EDIT rights, while 'Highly Confidential' grants only VIEW. Option B is correct. Option A is incorrect because both have encryption. Option C is incorrect because both are sublabels? Not necessarily. Option D is incorrect because the JSON does not mention sublabels.

Answer

Only the 'Confidential' label applies encryption

Answer

The 'Highly Confidential' label allows printing

Answer

The 'Confidential' label is a parent label

Question 2

Which TWO Microsoft Purview solutions can help detect and prevent data exfiltration?

Accepted Answer

Microsoft Purview Insider Risk Management. Data Loss Prevention (DLP) and Insider Risk Management are both designed to detect and prevent data exfiltration. Option A (Audit) logs but does not prevent. Option E (Compliance Manager) manages compliance posture. Option D (eDiscovery) is for legal discovery.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview eDiscovery

Question 3

Which THREE capabilities are provided by Microsoft Defender for Cloud? (Choose three.)

Accepted Answer

Security recommendations for resources. Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM), vulnerability assessment for VMs, and security recommendations. Option B (threat protection for Azure) is also a capability but is part of the broader 'Defender for Cloud' workload protection. However, the question asks for capabilities; CSPM, vulnerability assessment, and security recommendations are core. Option D (Just-in-Time VM access) is a feature, but the three most common are A, C, E.

Answer

Just-in-Time (JIT) VM access

Answer

Regulatory compliance assessment

Question 4

Which TWO actions can be performed using Microsoft Entra Identity Governance? (Choose two.)

Accepted Answer

Automate user lifecycle workflows. Identity Governance includes access reviews and entitlement management. Option B (assign roles via PIM) is Privileged Identity Management, which is part of Identity Governance. Option C (lifecycle workflows) is also part of Identity Governance. Option A (SSPR) is separate. Option E (Conditional Access) is not part of Identity Governance.

Answer

Configure self-service password reset

Answer

Reset user passwords

Answer

Create conditional access policies

Question 5

Refer to the exhibit. You run the Azure PowerShell command for a storage account. What is the current network access configuration?

Accepted Answer

The storage account is not accessible from any network.. DefaultAction is Deny, and no rules are defined. This means all network traffic is denied by default. Option B is correct. Option A says 'all networks' which would be Allow. Option C says only specific IPs, but IpRules is empty. Option D says only VNets, but VirtualNetworkRules is empty.

Answer

The storage account is accessible only from specific virtual networks.

Answer

The storage account is accessible from all networks.

Answer

The storage account is accessible only from specific IP addresses.

Question 6

Your organization needs to monitor and respond to security threats across on-premises, cloud, and hybrid environments. Which Microsoft solution provides a unified SIEM and SOAR capability?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct answer because it is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automation and Response (SOAR) solution. It provides unified threat monitoring, detection, and response across on-premises, cloud, and hybrid environments by ingesting data from various sources, using built-in analytics, and enabling automated playbooks.

Answer

Microsoft Defender XDR

Answer

Microsoft Defender for Cloud

Answer

Microsoft Intune

Question 7

Refer to the exhibit. You are reviewing an ARM template for an Azure resource. Assuming the resource is a Key Vault, what is the effect of the networkAcls configuration?

Accepted Answer

The Key Vault is accessible only from the 10.0.0.0/24 subnet.. The defaultAction is Deny, but an IP rule allows traffic from 10.0.0.0/24. So only that subnet can access the Key Vault. Option D is correct. Option A is wrong because public network access is disabled, so it's not accessible from the internet. Option B is wrong because the IP rule allows the subnet. Option C is wrong because the default action is Deny, not Allow.

Answer

The Key Vault is accessible from any network.

Answer

The Key Vault is accessible from all Azure services.

Answer

The Key Vault is not accessible from any network.

Question 8

Your organization is deploying Microsoft Defender for Cloud Apps to protect against cloud app threats. You need to ensure that users are prompted for authentication when accessing a sanctioned cloud app from an unmanaged device. Which policy type should you configure?

Accepted Answer

Session policy. Option B is correct because session policies (now called app session policies in Defender for Cloud Apps) allow you to monitor and control user sessions in real-time, including requiring authentication for access from unmanaged devices. Option A is wrong because access policies control access based on conditions but do not provide session-level control. Option C is wrong because activity policies trigger alerts and actions based on activities but not session-level authentication. Option D is wrong because anomaly detection policies detect suspicious behavior but do not enforce access controls.

Answer

Activity policy

Answer

Access policy

Answer

Anomaly detection policy

Question 9

Your company uses Microsoft Intune to manage devices. You need to ensure that only devices that are compliant with your security policies can access corporate email via Microsoft Outlook. What should you implement?

Accepted Answer

Conditional Access policies. Option C is correct because Conditional Access policies in Entra ID can enforce device compliance as a condition for accessing cloud apps like Exchange Online. Option A is wrong because app protection policies protect data within apps but do not control access based on device compliance. Option B is wrong because device compliance policies define compliance requirements but do not enforce access control. Option D is wrong because Windows Information Protection (WIP) protects corporate data on devices but does not control access to email.

Answer

Windows Information Protection

Answer

Device compliance policies

Answer

App protection policies

Question 10

You are investigating an alert in Microsoft Sentinel. The exhibit shows the JSON output of an alert that was generated from a sign-in log. The alert is linked to an active incident. Which action should you take to prioritize the incident for investigation?

Accepted Answer

Change the incident severity to critical. Option B is correct because increasing the incident severity to critical will ensure it is prioritized. Option A is wrong because closing the incident would stop investigation. Option C is wrong because changing assignment does not change priority. Option D is wrong because deleting the alert does not resolve the incident.

Answer

Close the incident as a false positive

Answer

Delete the alert from the incident

Answer

Reassign the incident to another analyst

Question 11

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers in emails to external recipients. Which DLP rule action should you configure?

Accepted Answer

Block the message from being sent. Option A is correct because blocking the message from being sent is the appropriate action to prevent data loss. Option B is wrong because allowing override with justification does not prevent sharing. Option C is wrong because notifying the user without blocking still allows the email to be sent. Option D is wrong because auditing alone does not block the action.

Answer

Audit the activity only

Answer

Allow the message but notify the user

Answer

Allow the message with a policy tip

Question 12

Your company has Microsoft Defender for Office 365 and wants to configure anti-phishing policies to protect against spear-phishing attacks targeting executives. Which policy setting should you enable to provide the highest level of protection?

Accepted Answer

Impersonation protection for users. Option C is correct because impersonation protection specifically protects against spear-phishing attacks targeting specific users like executives. Option A is wrong because spoof intelligence detects spoofed domains but not user impersonation. Option B is wrong because bulk email filtering reduces bulk mail but not targeted phishing. Option D is wrong because malware filter handles attachments with malware, not phishing.

Answer

Malware filter

Answer

Bulk email filtering

Answer

Spoof intelligence

Question 13

Your organization uses Microsoft Entra ID for identity management. You need to require multi-factor authentication (MFA) for all users when accessing the Azure portal. Which feature should you use?

Accepted Answer

Conditional Access policy. Option C is correct because Conditional Access policies in Entra ID allow you to enforce MFA for specific applications. Option A is wrong because Entra ID P1 includes Conditional Access but the feature itself is Conditional Access. Option B is wrong because Identity Protection detects risks but does not enforce MFA directly. Option D is wrong because Privileged Identity Management manages elevated roles, not MFA.

Answer

Privileged Identity Management

Answer

Identity Protection user risk policy

Answer

Entra ID P1 license

Question 14

Your company uses Microsoft Sentinel to centralize security event monitoring. You need to create a custom analytics rule that triggers an alert when a user account is created outside of business hours. Which rule type should you use?

Accepted Answer

Scheduled query analytics rule. Option D is correct because scheduled query rules run on a schedule and can detect patterns like account creation outside business hours. Option A is wrong because NRT rules are for near-real-time detection but are limited in logic. Option B is wrong because Microsoft Security incident creation rules create incidents from other alerts. Option C is wrong because Anomaly rules use ML for behavioral anomalies, not specific conditions.

Answer

Microsoft Security incident creation rule

Answer

Anomaly analytics rule

Answer

Near-real-time (NRT) analytics rule

Question 15

You are troubleshooting a Windows device that is reporting as non-compliant in Microsoft Intune. The exhibit shows the output of a PowerShell command run on the device. Based on the output, which component is likely misconfigured?

Accepted Answer

Microsoft Defender for Endpoint sensor onboarding. Option D is correct because the output shows that all Defender components are enabled, so the issue is likely not with Defender for Endpoint. The non-compliance could be due to missing updates, which are not shown. Option A is wrong because AMService is enabled. Option B is wrong because Antispyware is enabled. Option C is wrong because Antivirus is enabled.

Answer

Antivirus protection

Answer

Antispyware protection

Answer

Microsoft Defender Antivirus real-time protection

SC-900 Describe the capabilities of Microsoft security solutions Practice Test 18 — 15 Questions

Exhibit

SC-900 Describe the capabilities of Microsoft security solutions Practice Test 18 — 15 Questions

Exhibit