SC-900 Describe the capabilities of Microsoft security solutions Practice Test 2 — 15 Questions

Question 1

Which TWO features are available in Microsoft Entra ID P2 licenses? (Choose two.)

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is a P2-only feature that provides just-in-time privileged access, time-bound role activation, and approval workflows for Azure AD roles and Azure resources. It is not available in P1 or free tiers, making it a key differentiator for P2 licensing. Identity Protection (risk-based policies), specifically the enforcement of Conditional Access policies based on user or sign-in risk, also requires an Entra ID P2 license. While some Identity Protection reporting features are available in P1, the automated policy enforcement based on risk detection is a P2-exclusive capability.

Answer

Self-service password reset (SSPR)

Answer

Multifactor authentication (MFA)

Answer

Password hash synchronization

Question 2

Your organization uses Microsoft Defender for Cloud to protect hybrid workloads. A security administrator needs to ensure that all Azure subscriptions are automatically covered by Defender for Cloud's security policies. What should the administrator configure?

Accepted Answer

Assign the Azure Security Benchmark initiative to the root management group.. Assigning the Azure Security Benchmark initiative to the root management group ensures that the core security policies, which Microsoft Defender for Cloud uses as its default baseline, are automatically applied and inherited by all subscriptions under that management group. This is the most efficient method for enforcing a consistent security baseline across an entire Azure tenant, allowing Defender for Cloud to monitor compliance against these policies once it is enabled on the subscriptions.

Answer

Assign the Azure Security Benchmark initiative to each resource group.

Answer

Enable Defender for Cloud on each subscription individually.

Answer

Install the Log Analytics agent on all VMs.

Question 3

Refer to the exhibit. You are reviewing a Microsoft Purview Information Protection policy in JSON format. The policy defines two sensitivity labels. What is the key difference between the 'Confidential' label and the 'Highly Confidential' label?

Accepted Answer

The 'Highly Confidential' label restricts edit rights. The 'Highly Confidential' label in the JSON policy includes a 'RightsProtection' action with a 'Rights' array that specifies only 'VIEW', not 'EDIT'. This means users can view the content but cannot edit it, effectively restricting edit rights. The 'Confidential' label, while also applying encryption, is configured to allow full editing and printing, thus it does not restrict edit rights.

Answer

Only the 'Confidential' label applies encryption

Answer

The 'Highly Confidential' label allows printing

Answer

The 'Confidential' label is a parent label

Question 4

Which THREE capabilities are provided by Microsoft Defender for Cloud? (Choose three.)

Accepted Answer

Security recommendations for resources. Microsoft Defender for Cloud offers comprehensive Cloud Security Posture Management (CSPM) capabilities (E), which include continuously assessing your Azure, on-premises, and multi-cloud resources against security best practices. This assessment generates actionable security recommendations (A) based on the Secure Score and the built-in Azure Security Benchmark, helping to identify misconfigurations and weak security controls. Additionally, Defender for Cloud provides Cloud Workload Protection (CWP) features, such as integrated vulnerability assessment for virtual machines (C), to identify and help remediate security weaknesses within your workloads.

Answer

Just-in-Time (JIT) VM access

Answer

Regulatory compliance assessment

Question 5

Which TWO actions can be performed using Microsoft Entra Identity Governance? (Choose two.)

Accepted Answer

Automate user lifecycle workflows. Microsoft Entra Identity Governance includes capabilities like entitlement management, access reviews, and lifecycle workflows. Option C (Automate user lifecycle workflows) is a core feature of Identity Governance, enabling automated provisioning and deprovisioning. Option E (Manage access reviews for groups and applications) is also a key component, allowing periodic review of access. Option A (Configure self-service password reset) is a self-service feature of Microsoft Entra ID, not governance. Option B (Reset user passwords) is an administrative task outside Identity Governance. Option D (Create conditional access policies) is part of Microsoft Entra Conditional Access, which is a security feature, not governance.

Answer

Configure self-service password reset

Answer

Reset user passwords

Answer

Create conditional access policies

Question 6

Your organization is deploying Microsoft Defender for Cloud Apps to protect against cloud app threats. You need to ensure that users are prompted for authentication when accessing a sanctioned cloud app from an unmanaged device. Which policy type should you configure?

Accepted Answer

Session policy. A session policy in Microsoft Defender for Cloud Apps can enforce real-time controls during a session, such as prompting for authentication when a user accesses a sanctioned cloud app from an unmanaged device. Session policies use Conditional Access App Control to intercept access and require additional authentication based on device state, location, or other conditions. Access policies (option B) are used for blocking or allowing access based on criteria like device compliance, but they do not typically prompt for additional authentication; that is a function of session policies.

Answer

Activity policy

Answer

Access policy

Answer

Anomaly detection policy

Question 7

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps?

Accepted Answer

Cloud Discovery to identify shadow IT. Microsoft Defender for Cloud Apps provides Cloud Discovery to identify shadow IT by analyzing traffic logs from firewalls and proxies to discover which cloud apps are being used in an organization, helping security teams gain visibility into unsanctioned app usage. Additionally, it offers Data Loss Prevention (DLP) capabilities specifically for cloud applications, allowing organizations to enforce policies to prevent sensitive data from being exfiltrated or inappropriately shared within and across sanctioned cloud services.

Answer

Email security

Answer

Endpoint detection and response

Answer

Identity protection

Question 8

Your organization is planning to use Microsoft Sentinel as a SIEM solution. Which TWO of the following are required components for Sentinel? (Select TWO.)

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the foundational data store for Microsoft Sentinel. All security data ingested into Sentinel is stored in this workspace, and Sentinel's analytics, detection, and investigation capabilities rely on querying the data within it. Without a Log Analytics workspace, there is no repository for the security events and logs that Sentinel needs to analyze. Data connectors are equally critical as they are the mechanisms by which security data is ingested into the Log Analytics workspace for Sentinel to analyze. Without data connectors, Sentinel would have no data to process, rendering it non-functional as a SIEM solution.

Answer

A playbook for automated response

Answer

A workbook for dashboards

Answer

A KQL query for threat detection

Question 9

Your organization wants to implement a Zero Trust security model. Which TWO principles are part of the Zero Trust model? (Select TWO.)

Accepted Answer

Assume breach. 'Assume breach' is a foundational principle of the Zero Trust model, which operates on the mindset that a breach has already occurred or will occur. This principle ensures that every access request is treated as a potential threat, minimizing the blast radius and preventing lateral movement. It drives the implementation of micro-segmentation, continuous monitoring, and just-in-time access policies. 'Verify explicitly' is another core principle, meaning all access requests must be authenticated and authorized based on all available data points, including user identity, location, device health, service or workload, data classification, and anomalies, rather than relying on implicit trust.

Answer

Grant access based on IP address

Answer

Rely on network perimeter security

Answer

Use implicit trust for internal traffic

Question 10

Which TWO of the following are capabilities of Microsoft Defender for Cloud?

Accepted Answer

Enable just-in-time access to virtual machines. Just-in-time (JIT) VM access is a capability of Microsoft Defender for Cloud that reduces the attack surface by locking down inbound traffic to VMs, opening ports only when requested and for a limited time. This is a core feature of Defender for Cloud's workload protection. Additionally, Defender for Cloud provides Cloud Security Posture Management (CSPM) capabilities, continuously assessing the security configuration of cloud resources, identifying misconfigurations, and offering actionable recommendations to improve the overall security posture and achieve regulatory compliance.

Answer

Centralize security event log analysis from multiple sources

Answer

Monitor domain controllers for malicious activity

Answer

Manage mobile devices and enforce compliance policies

Question 11

Which THREE of the following are features of Microsoft Purview Communication Compliance?

Accepted Answer

Create custom keyword dictionaries to detect policy violations. Microsoft Purview Communication Compliance is designed to help organizations detect, investigate, and act on inappropriate messages across various communication channels like Microsoft Teams, Exchange Online, and Yammer. Key features include the ability to monitor for inappropriate language (E), create custom keyword dictionaries to detect policy violations (D), and integrate with sensitive information types and trainable classifiers. It provides review workflows for designated compliance officers to investigate and remediate policy violations. Policy tips (B) are a distinct feature of Data Loss Prevention (DLP) policies, which provide real-time notifications to users when they attempt to share sensitive information in a non-compliant way, typically before the action is completed.

Answer

Automatically quarantine emails that contain malware

Answer

Provide policy tips to users when they send potentially non-compliant messages

Answer

Enforce multi-factor authentication for sensitive roles

Question 12

Which TWO of the following are capabilities of Microsoft Defender for Office 365?

Accepted Answer

Scan email attachments in a sandbox environment before delivery. Microsoft Defender for Office 365 includes Safe Attachments, which detonates email attachments in a virtual sandbox environment before delivery to the user's mailbox. This allows the service to analyze the file for malicious behavior without risking the recipient's device. Additionally, Defender for Office 365 provides advanced anti-phishing capabilities, including impersonation protection, to safeguard against spear-phishing attacks targeting specific users or domains.

Answer

Enforce device compliance policies for mobile devices

Answer

Place a legal hold on mailboxes for eDiscovery

Answer

Monitor user behavior for compromised accounts

Question 13

Which TWO are capabilities of Microsoft Defender for Office 365?

Accepted Answer

Safe Attachments. Safe Attachments is a core capability of Microsoft Defender for Office 365 that uses a detonation chamber environment to open and analyze email attachments in real time before delivery. If malicious behavior is detected, the attachment is blocked or replaced with a warning file, protecting users from zero-day threats and advanced malware. Safe Links is another key capability that rewrites URLs in emails and Office documents to check them for malicious content at the time of click, preventing users from accessing harmful websites.

Answer

Attack surface reduction rules

Answer

Multi-factor authentication enforcement

Answer

Device compliance policies

Question 14

Which THREE are features of Microsoft Purview Data Loss Prevention (DLP)?

Accepted Answer

DLP policies for Exchange Online. Microsoft Purview DLP offers comprehensive data protection. It includes policies for **Exchange Online** (A) to detect and prevent sensitive data sharing in emails, leveraging transport rules and content scanning. **Endpoint DLP for Windows 10/11** (B) extends these capabilities to devices, monitoring and protecting sensitive data on endpoints. Furthermore, **Policy tips in Outlook** (C) provide real-time notifications to users when they are about to violate a DLP policy, guiding them to comply with data protection rules.

Answer

Sensitivity label auto-classification

Answer

Insider risk management analytics

Question 15

Refer to the exhibit. You are analyzing a Microsoft Sentinel workspace using KQL. The query returns no results, but you know that malware alerts have been generated today. What is the most likely reason?

Accepted Answer

The column name 'AlertName' is incorrect.. The `SecurityAlert` table in Microsoft Sentinel does contain a column for the alert's name. While `AlertName` is the standard column name, KQL is case-sensitive for column names. If the actual column name in the specific Sentinel workspace's `SecurityAlert` table has a different casing (e.g., `alertName` or `Alertname`), or if there is a subtle typo in the query's `AlertName`, then the query will fail to find the column and return no results. Therefore, option D, "The column name 'AlertName' is incorrect," is the most likely reason for the query returning no results, assuming the alerts exist and the time range is sufficient. Options A, B, and C are incorrect because 'AlertSeverity' is a valid column, the query does not contain an 'order by' clause, and `ago(1d)` should cover alerts generated today.

Answer

The table does not contain a 'AlertSeverity' column.

Answer

The 'order by' clause is invalid.

Answer

The time range is too short.