SC-900 Describe the capabilities of Microsoft security solutions Practice Test 19 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all storage accounts have soft delete enabled to protect against accidental deletion. Which policy should you implement?

Accepted Answer

Azure Policy with a built-in policy for storage accounts. Option A is correct because Azure Policy can audit or enforce configurations on resources, including enabling soft delete on storage accounts. Option B is wrong because Defender for Cloud recommendations suggest actions but do not enforce them automatically. Option C is wrong because Azure RBAC controls permissions, not configurations. Option D is wrong because Azure Blueprints package resources but do not enforce individual settings.

Answer

Azure Blueprints

Answer

Azure role-based access control (RBAC)

Answer

Defender for Cloud security recommendations

Question 2

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps?

Accepted Answer

Cloud Discovery to identify shadow IT. Option A is correct because Defender for Cloud Apps provides cloud discovery to identify shadow IT. Option C is correct because it offers DLP capabilities for cloud apps. Option B is wrong because endpoint detection is provided by Defender for Endpoint. Option D is wrong because identity protection is provided by Entra ID Protection. Option E is wrong because email security is provided by Defender for Office 365.

Answer

Email security

Answer

Endpoint detection and response

Answer

Identity protection

Question 3

Which THREE actions can Microsoft Sentinel perform as part of automated incident response using playbooks?

Accepted Answer

Block an IP address on a firewall. Option A is correct because playbooks can create incidents in other systems. Option B is correct because playbooks can block IP addresses. Option C is correct because playbooks can reset user passwords. Option D is wrong because playbooks cannot directly modify firewall rules; they can trigger automation. Option E is wrong because playbooks cannot automatically install software.

Answer

Install anti-malware software on a device

Answer

Modify a network security group rule

Question 4

Which TWO features are part of Microsoft Defender XDR?

Accepted Answer

Automated investigation and response. Option A is correct because Microsoft Defender XDR includes incident management. Option C is correct because it includes automated investigation and response. Option B is wrong because cloud app security is part of Defender for Cloud Apps, not XDR. Option D is wrong because identity protection is part of Entra ID Protection. Option E is wrong because endpoint DLP is part of Microsoft Purview.

Answer

Cloud app discovery

Answer

Endpoint data loss prevention

Answer

Identity Protection

Question 5

Your organization, Contoso Ltd., has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are deploying Microsoft Defender for Identity (MDI) to protect against identity-based attacks. You have installed the MDI sensor on domain controllers and configured the service with the necessary permissions. After installation, you notice that MDI is not generating alerts for pass-the-hash attacks. You have verified that the sensors are healthy and that audit policies are correctly configured. You need to ensure that MDI can detect pass-the-hash attacks. What should you do?

Accepted Answer

Enable password hash synchronization in Microsoft Entra Connect. Option A is correct because enabling password hash synchronization (PHS) in Entra Connect allows MDI to analyze NTLM hashes and detect pass-the-hash attacks. Option B is wrong because MFA registration does not affect MDI detection. Option C is wrong because Kerberos logging is not required for pass-the-hash detection. Option D is wrong because Azure ATP agent is the legacy name; the MDI sensor is already installed.

Answer

Install the Azure ATP agent on all servers

Answer

Enable Kerberos event logging on domain controllers

Answer

Configure multi-factor authentication for all users

Question 6

Your company, Fabrikam, uses Microsoft 365 and has Microsoft Purview Information Protection deployed. You need to protect sensitive documents labeled as 'Confidential' so that they cannot be printed or copied when opened in Microsoft Word. You have created a sensitivity label with the appropriate encryption settings. However, users report that they can still print and copy content from these documents. You verify that the label is published and assigned to the correct users. What should you configure to enforce the protection?

Accepted Answer

Configure the sensitivity label to apply an Azure Rights Management template that restricts printing and copying. Option B is correct because rights management (RMS) templates define user rights like printing and copying. The label must be configured with an RMS template that denies these permissions. Option A is wrong because DLP policies detect and block actions but do not enforce rights within documents. Option C is wrong because auto-labeling applies labels but does not enforce rights. Option D is wrong because conditional access policies control access, not usage rights.

Answer

Implement conditional access policies to block access from unmanaged devices

Answer

Configure auto-labeling policies to apply the label automatically

Answer

Create a data loss prevention policy that blocks printing and copying

Question 7

Your organization, Northwind Traders, uses Microsoft Intune to manage Windows 10 devices. You have created a compliance policy that requires devices to have BitLocker enabled. After assigning the policy, you notice that some devices are reporting as non-compliant due to BitLocker not being enabled. You have verified that the devices support BitLocker and that the policy is correctly assigned. You need to ensure that BitLocker is enabled on these devices automatically. What should you do?

Accepted Answer

Create an endpoint protection configuration profile to enable BitLocker. Option A is correct because a device configuration profile for endpoint protection can enable BitLocker automatically. Option B is wrong because the compliance policy only reports compliance, it does not remediate. Option C is wrong because Windows Update policies do not configure BitLocker. Option D is wrong because scripts are not the standard method for BitLocker enabling via Intune.

Answer

Modify the compliance policy to allow non-compliant devices

Answer

Create a Windows update ring policy

Answer

Use a PowerShell script to enable BitLocker manually

Question 8

Your organization uses Microsoft Defender for Cloud to protect Azure virtual machines. You need to ensure that critical vulnerabilities identified on the VMs are automatically remediated using a just-in-time patching mechanism. What should you configure?

Accepted Answer

Enable adaptive application controls and just-in-time VM access in Defender for Cloud. Option B is correct because Microsoft Defender for Cloud's adaptive application controls and just-in-time VM access can be combined with update management to automate patching. Option A is wrong because Azure Update Manager does not provide just-in-time patching. Option C is wrong because Azure Automation Update Management requires manual scheduling. Option D is wrong because Microsoft Intune is for endpoint management, not Azure VMs.

Answer

Deploy Microsoft Intune for update management

Answer

Configure Azure Automation Update Management

Answer

Enable Azure Update Manager

Question 9

A company uses Microsoft Sentinel for security information and event management (SIEM). The security team needs to detect and automatically respond to a potential privilege escalation attack where an attacker attempts to add a new user to the Global Administrator role in Microsoft Entra ID. What should the security team configure?

Accepted Answer

Create an analytics rule with an automated playbook in Microsoft Sentinel. Option D is correct because Microsoft Sentinel can create analytics rules to detect the event and automated response using playbooks. Option A is wrong because Microsoft Defender for Cloud Apps handles cloud app security, not Entra ID role changes. Option B is wrong because Microsoft Purview is for data governance. Option C is wrong because Microsoft Intune manages devices, not identity roles.

Answer

Deploy a device compliance policy in Microsoft Intune

Answer

Configure a data classification label in Microsoft Purview

Answer

Create a policy in Microsoft Defender for Cloud Apps

Question 10

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive credit card numbers via email. The DLP policy must trigger automatically when a user attempts to send an email containing a credit card number. Which DLP configuration should you use?

Accepted Answer

Create a DLP policy with a condition that matches the Credit Card Number sensitive info type and an action to block the email. Option C is correct because a DLP policy with a rule that uses a sensitive info type (Credit Card Number) and an action to block the email is the standard approach. Option A is wrong because Microsoft Defender for Office 365 is for anti-phishing and malware, not DLP. Option B is wrong because Customer Key is for encryption, not DLP. Option D is wrong because Double Key Encryption is for protecting data with two keys, not for blocking sharing.

Answer

Configure Double Key Encryption for the Exchange Online mailbox

Answer

Configure a Safe Links policy in Microsoft Defender for Office 365

Answer

Use Microsoft Purview Customer Key for encryption

Question 11

A company uses Microsoft Intune to manage its devices. The security team wants to enforce that all devices running Windows 11 must have BitLocker enabled and a minimum operating system build version. Which Intune policy type should they use?

Accepted Answer

Compliance policy. Option A is correct because compliance policies enforce device compliance rules like BitLocker and OS version. Option B is wrong because configuration profiles configure settings, not compliance. Option C is wrong because app protection policies manage data on mobile apps. Option D is wrong because enrollment restrictions limit device enrollment.

Answer

Configuration profile

Answer

Enrollment restriction

Answer

App protection policy

Question 12

Your organization uses Microsoft Defender XDR. You need to investigate a potential lateral movement attack where a compromised user account is used to access multiple workstations. Which feature should you use to visualize the attack path?

Accepted Answer

Attack graph. Option B is correct because the attack graph in Microsoft Defender XDR provides a visual representation of attack paths. Option A is wrong because the incident queue lists alerts, not attack paths. Option C is wrong because Microsoft Sentinel's workbooks are for custom visualization but not specifically for attack paths. Option D is wrong because Microsoft 365 Defender's threat analytics provide threat reports, not attack paths.

Answer

Microsoft Sentinel workbooks

Answer

Threat analytics in Microsoft 365 Defender

Answer

Incident queue

Question 13

A company uses Microsoft Purview to classify and label data. The compliance team needs to automatically apply a 'Highly Confidential' sensitivity label to any document containing a passport number that is stored in SharePoint Online. The label should also encrypt the document. What should the compliance team configure?

Accepted Answer

Create an auto-labeling policy for sensitivity labels. Option D is correct because an auto-labeling policy can be set to scan SharePoint for content containing a passport number and apply a label with encryption. Option A is wrong because manual labeling is not automatic. Option B is wrong because a DLP policy blocks sharing but does not apply labels. Option C is wrong because a retention label is for retention, not encryption.

Answer

Create a retention label with a retention rule

Answer

Create a data loss prevention (DLP) policy

Answer

Create a manual sensitivity label and train users

Question 14

Your organization wants to enable passwordless authentication for users. Which Microsoft Entra ID feature should you use?

Accepted Answer

Passwordless authentication methods. Passwordless authentication methods is the correct feature because it is the specific Microsoft Entra ID capability that allows users to sign in without a password, using methods such as Windows Hello for Business, the Microsoft Authenticator app, FIDO2 security keys, or phone sign-in. This directly enables the organization's goal of passwordless authentication.

Answer

Conditional Access

Answer

Privileged Identity Management

Answer

Identity Protection

Question 15

A security analyst in your organization receives an alert from Microsoft Defender XDR indicating that a user's device may be infected with ransomware. The analyst needs to immediately isolate the device from the network to prevent further spread. What should the analyst do?

Accepted Answer

Use Microsoft Defender for Endpoint to initiate device isolation. Option B is correct because Microsoft Defender for Endpoint (part of Defender XDR) provides the ability to isolate a device from the network. Option A is wrong because Microsoft Sentinel is SIEM, not endpoint action. Option C is wrong because Microsoft Intune can wipe devices but is slower and not immediate isolation. Option D is wrong because Microsoft Entra ID is for identity, not device isolation.

Answer

Revoke the user's session in Microsoft Entra ID

Answer

Open Microsoft Sentinel and run a playbook

Answer

Use Microsoft Intune to wipe the device