SC-900 Describe the capabilities of Microsoft security solutions Practice Test 21 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Microsoft 365 resources. You have configured a Conditional Access policy in Microsoft Entra ID that requires devices to be marked as compliant. However, some users report that they can still access email on their non-compliant Android devices. You need to troubleshoot and resolve the issue. What should you do?

Accepted Answer

Check the Conditional Access policy is enabled and includes 'Office 365 Exchange Online' as a cloud app, and that the users have the appropriate licenses for Intune.. Option D is correct because the Conditional Access policy must be scoped to include all cloud apps, and the user must have the Intune license assigned. Option A is wrong because the device must be enrolled in Intune for compliance to be evaluated. Option B is wrong because the user must be in scope. Option C is wrong because the policy should grant access only if compliant, not block non-compliant.

Answer

Change the Conditional Access policy to block access for non-compliant devices instead of requiring compliance.

Answer

Ensure that the Android devices are enrolled in Microsoft Intune and have a compliance policy assigned.

Answer

Verify that the Conditional Access policy includes the users who are accessing email.

Question 2

Your organization uses Microsoft Sentinel as its SIEM. You need to create an analytics rule that detects when a user account is created in Azure AD and then, within 10 minutes, that same account is used to grant admin consent to an application. You have a KQL query that joins AuditLogs and SigninLogs. However, the rule is generating too many false positives. You need to refine the query to reduce false positives. What should you do?

Accepted Answer

Add a condition to exclude accounts that are known admin accounts or service accounts.. Option C is correct because known admin or service accounts are often used for legitimate, automated admin consent grants, which can trigger false positives. By excluding these accounts from the detection logic, the rule focuses on anomalous behavior from non-privileged accounts, reducing noise while preserving the core detection of suspicious account creation followed by admin consent grant.

Answer

Change the rule to alert on every admin consent grant event regardless of account creation.

Answer

Remove the join with SigninLogs and only use AuditLogs.

Answer

Increase the time window from 10 minutes to 30 minutes.

Question 3

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. You have discovered a new cloud app that employees are using to store corporate data. The app is not sanctioned. You need to sanction the app but also ensure that users cannot upload sensitive data to it. You have configured a session policy to monitor the app. What additional step should you take?

Accepted Answer

Create a file policy in Microsoft Defender for Cloud Apps that detects sensitive data and blocks uploads.. Option C is correct because you need to create a file policy in Defender for Cloud Apps to block uploads of sensitive data. Option A is wrong because blocking the app is too restrictive. Option B is wrong because the session policy only monitors, not blocks. Option D is wrong because blocking all uploads is too broad.

Answer

Block the app entirely by adding it to the blocked list.

Answer

Configure a Conditional Access policy to require device compliance for the app.

Answer

Use the session policy to block all uploads to the app.

Question 4

Your organization uses Microsoft Purview Information Protection to classify and protect documents. You have created a sensitivity label that applies encryption to documents marked as 'Confidential'. Users are able to apply the label manually. However, you need to ensure that all documents containing personally identifiable information (PII) are automatically labeled as 'Confidential' when they are saved to SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that scans for PII sensitive info types and applies the 'Confidential' label.. Option D is correct because auto-labeling policies in Microsoft Purview can scan documents for sensitive info types and apply labels automatically. Option A is wrong because manual labeling doesn't meet the automatic requirement. Option B is wrong because DLP policies block but do not apply labels. Option C is wrong because default labeling applies to new documents but does not scan existing content.

Answer

Configure a default label for SharePoint libraries so that all documents are labeled 'Confidential'.

Answer

Create a Data Loss Prevention (DLP) policy that blocks sharing of PII.

Answer

Train users to apply the 'Confidential' label manually when they create documents with PII.

Question 5

Your company uses Microsoft Defender for Identity to monitor on-premises Active Directory. You receive an alert about a potential lateral movement attack involving a service account. The alert indicates that the account was used to log in to multiple servers from a non-domain-joined machine. You need to investigate the alert and determine if the account is compromised. What should you do first?

Accepted Answer

Review the account’s activity timeline in Microsoft Defender for Identity to see all logins and accessed resources.. Option B is correct because checking the account’s recent activity in Microsoft Defender for Identity will show the timeline of events. Option A is wrong because resetting the password may lock out a legitimate user. Option C is wrong because checking group membership is not immediate. Option D is wrong because the alert is about lateral movement, not a user report.

Answer

Check if the account is a member of any privileged groups.

Answer

Immediately reset the service account password.

Answer

Contact the user to verify if they performed the logins.

Question 6

Your organization uses Microsoft Purview eDiscovery to manage legal holds. A legal hold has been placed on a user’s mailbox, but the user has left the company and their mailbox has been converted to a shared mailbox. You need to ensure that the legal hold remains effective. What should you do?

Accepted Answer

Verify that the legal hold is still listed in the eDiscovery case for the mailbox.. Option B is correct because converting a mailbox to a shared mailbox does not remove the hold; however, you should verify that the hold is still in place. Option A is wrong because the hold is already applied. Option C is wrong because you don't need to recreate the hold. Option D is wrong because the hold is not automatically removed.

Answer

Convert the shared mailbox back to a user mailbox to keep the hold.

Answer

Create a new legal hold for the shared mailbox.

Answer

Remove the legal hold and reapply it to the shared mailbox.

Question 7

Your organization uses Microsoft Defender for Cloud to protect Azure subscriptions. You need to enforce that all storage accounts must have encryption at rest enabled. You have enabled Azure Policy to audit this configuration. However, you notice that some storage accounts are non-compliant. You need to automatically remediate non-compliant storage accounts. What should you do?

Accepted Answer

Add a 'deployIfNotExists' policy to automatically enable encryption on storage accounts.. Option C is correct because a 'deployIfNotExists' policy assignment in Azure Policy can automatically remediate non-compliant storage accounts by enabling encryption at rest. This policy effect triggers a remediation task that deploys the required configuration (e.g., setting the 'Encryption' property to 'Enabled' on the storage account resource) without manual intervention. The audit policy only reports non-compliance, while deployIfNotExists actively enforces the desired state.

Answer

Create a Microsoft Defender for Cloud recommendation to enable encryption.

Answer

Use the compliance dashboard to manually enable encryption on non-compliant accounts.

Answer

Change the policy effect from 'audit' to 'deny' to prevent creation of non-compliant accounts.

Question 8

Your organization uses Microsoft Purview to manage data sensitivity and compliance. Which TWO capabilities are provided by Microsoft Purview Information Protection?

Accepted Answer

Create and publish sensitivity labels that can be applied to documents and emails.. Microsoft Purview Information Protection includes sensitivity labels and data classification. Data Loss Prevention (DLP) is a separate policy, and insider risk management is a different solution. Retention policies are part of Microsoft Purview Records Management.

Answer

Define retention labels to keep data for a specified period.

Answer

Detect and manage insider risk activities such as data theft by employees.

Answer

Enforce Data Loss Prevention (DLP) policies to prevent accidental sharing of sensitive data.

Question 9

You are a security administrator for Contoso Ltd. The company uses Microsoft Defender XDR, Microsoft Sentinel, and Microsoft Entra ID. Recently, several users reported receiving phishing emails that bypassed the existing anti-phishing policies. The security team suspects that attackers are using sophisticated techniques to evade detection. You need to enhance the email security posture by implementing a solution that uses AI and machine learning to detect advanced phishing attempts, including those using social engineering and impersonation. Which Microsoft solution should you use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes advanced anti-phishing capabilities with AI and machine learning, such as impersonation protection and spoof intelligence. Microsoft Sentinel is a SIEM/SOAR, not an email security solution. Defender for Cloud Apps is a CASB. Defender for Identity identifies threats via on-premises AD signals. Microsoft Purview focuses on compliance and data governance.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Identity

Question 10

Your organization, Fabrikam Inc., uses Microsoft 365 E5 licenses. The security team is deploying Microsoft Purview to protect sensitive data. They need to ensure that when a user attempts to share a document containing credit card numbers with an external partner, the action is blocked and the user receives a policy tip. Additionally, the incident should be logged for investigation. You have already created a sensitivity label for credit card data and auto-labeled documents. Which Microsoft Purview feature should you configure to meet these requirements?

Accepted Answer

Create a Data Loss Prevention (DLP) policy that applies to documents containing credit card numbers, with an action to block sharing and notify users via policy tip.. Data Loss Prevention (DLP) policies in Microsoft Purview can detect sensitive information (e.g., credit card numbers) in documents and emails, block sharing, display policy tips, and generate incident reports. Sensitivity labels alone do not enforce restrictions on sharing. Records management handles retention. Insider risk management detects risky user activities. Audit logs record events but do not block actions.

Answer

Enable Microsoft Purview Insider Risk Management to detect the sharing activity.

Answer

Implement Microsoft Purview Records Management with a retention label that prevents sharing.

Answer

Configure a sensitivity label policy that blocks external sharing when the label is applied.

Question 11

Your organization uses Microsoft Sentinel for security operations. You need to ensure that when a high-severity incident is created, a Microsoft Teams message is sent to the SOC team automatically. What should you configure?

Accepted Answer

Create an automation rule that triggers on incident creation and runs a playbook.. Automation rules in Microsoft Sentinel allow you to trigger automated responses, such as sending a Teams message, based on incident creation conditions. Playbooks are run by automation rules, but the rule itself defines the trigger. Option B is correct because automation rules are the mechanism to trigger playbooks on incident creation. Option A is wrong because playbooks are the actions, not the trigger. Option C is wrong because analytics rules create incidents but do not directly send notifications. Option D is wrong because workbooks are for visualization, not automation.

Answer

Create a playbook and attach it to an analytics rule.

Answer

Modify the analytics rule to include an automated response.

Answer

Configure a workbook to send email alerts.

Question 12

Your company uses Microsoft Defender for Cloud Apps. You want to discover which cloud apps are being used in your organization and assess their risk levels. What should you use?

Accepted Answer

Cloud Discovery. Microsoft Defender for Cloud Apps provides Cloud Discovery to analyze traffic logs and identify shadow IT. Option B is correct. Option A is wrong because Defender for Cloud Apps does not have a 'Cloud App Security Catalog' feature. Option C is wrong because Microsoft Intune manages devices, not app discovery. Option D is wrong because Microsoft Purview is for data governance, not app discovery.

Answer

Cloud App Security Catalog

Answer

Microsoft Purview Data Map

Answer

Microsoft Intune app inventory

Question 13

Refer to the exhibit. You are reviewing an automation rule in Microsoft Sentinel. The JSON snippet shows a rule designed to create an incident when a high-severity alert is generated. However, the rule is not triggering. What is the most likely reason?

Accepted Answer

Automation rules triggered on alert creation cannot create incidents; they can only run playbooks.. The JSON shows a trigger type 'Microsoft.SecurityInsights/AlertRule' which is used for automation rules that run on alert creation. However, the action type is 'Microsoft.SecurityInsights/AlertRule/Incident' which is intended to create an incident from an alert. The issue is that automation rules that trigger on alert creation cannot directly create incidents; they can only run playbooks. To create an incident from an alert, you need to use an automation rule triggered on incident creation or use an analytics rule. Option B is correct. Option A is wrong because the syntax is correct. Option C is wrong because the resource ID is present. Option D is wrong because the trigger is on alert, not incident.

Answer

The logicAppResourceId is missing a required parameter.

Answer

The action should be of type 'Microsoft.SecurityInsights/AlertRule/Alert' instead.

Answer

The trigger type is incorrect; it should be 'Microsoft.SecurityInsights/Incident'.

Question 14

Which TWO are capabilities of Microsoft Defender for Office 365?

Accepted Answer

Safe Attachments. Safe Attachments is a core capability of Microsoft Defender for Office 365 that uses a detonation chamber environment to open and analyze email attachments in real time before delivery. If malicious behavior is detected, the attachment is blocked or replaced with a warning file, protecting users from zero-day threats and advanced malware.

Answer

Attack surface reduction rules

Answer

Multi-factor authentication enforcement

Answer

Device compliance policies

Question 15

Which THREE are features of Microsoft Purview Data Loss Prevention (DLP)?

Accepted Answer

DLP policies for Exchange Online. Microsoft Purview DLP includes policy tips to notify users, endpoint DLP to monitor devices, and integration with Microsoft 365 services. Option A is correct. Option B is correct. Option C is correct. Option D is wrong because sensitivity labels are part of Microsoft Purview Information Protection, not DLP. Option E is wrong because insider risk management is a separate solution.

Answer

Sensitivity label auto-classification

Answer

Insider risk management analytics