SC-900 Describe the capabilities of Microsoft security solutions Practice Test 21 — 15 Questions

Question 1

You are investigating an alert in Microsoft Sentinel. The exhibit shows the JSON output of an alert that was generated from a sign-in log. The alert is linked to an active incident. Which action should you take to prioritize the incident for investigation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the incident severity to critical. Changing the incident severity to critical in Microsoft Sentinel directly influences the prioritization and triage workflow. By elevating the severity, the incident is flagged for immediate attention, ensuring it appears at the top of the queue for investigation. This action aligns with the incident management best practice of using severity levels to indicate business impact and urgency.

Answer

Close the incident as a false positive

Answer

Delete the alert from the incident

Answer

Reassign the incident to another analyst

Question 2

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers in emails to external recipients. Which DLP rule action should you configure?

Accepted Answer

Block the message from being sent. Microsoft Purview DLP allows you to configure rule actions that enforce protective measures. When you need to prevent users from sharing credit card numbers in emails to external recipients, the 'Block the message from being sent' action stops the email from being delivered, ensuring the sensitive data is not leaked. This action can be combined with a notification or override option, but the core enforcement is blocking the message.

Answer

Audit the activity only

Answer

Allow the message but notify the user

Answer

Allow the message with a policy tip

Question 3

Your company has Microsoft Defender for Office 365 and wants to configure anti-phishing policies to protect against spear-phishing attacks targeting executives. Which policy setting should you enable to provide the highest level of protection?

Accepted Answer

Impersonation protection for users. Impersonation protection for users is the correct setting because it specifically defends against spear-phishing attacks that impersonate high-value targets like executives. Microsoft Defender for Office 365 uses machine learning and sender intelligence to detect and block emails that spoof the display name or email address of protected users, providing the highest level of protection against targeted impersonation attacks.

Answer

Malware filter

Answer

Bulk email filtering

Answer

Spoof intelligence

Question 4

Your organization uses Microsoft Entra ID for identity management. You need to require multi-factor authentication (MFA) for all users when accessing the Azure portal. Which feature should you use?

Accepted Answer

Conditional Access policy. Conditional Access policy (Option D) is correct because it allows you to create policies that enforce MFA for specific applications like the Azure portal. Option A, Privileged Identity Management, is used for managing and auditing privileged roles, not for enforcing MFA. Option B, Identity Protection user risk policy, can trigger MFA based on risk but cannot enforce MFA for all users unconditionally. Option C, an Entra ID P1 license, is a prerequisite for using Conditional Access but is not a feature itself.

Answer

Privileged Identity Management

Answer

Identity Protection user risk policy

Answer

Entra ID P1 license

Question 5

Your company uses Microsoft Sentinel to centralize security event monitoring. You need to create a custom analytics rule that triggers an alert when a user account is created outside of business hours. Which rule type should you use?

Accepted Answer

Scheduled query analytics rule. A scheduled query analytics rule is the correct choice because it allows you to define a KQL query that runs on a set schedule (e.g., every 5 minutes) and triggers an alert based on conditions such as user account creation events occurring outside of business hours. This rule type is designed for custom detection scenarios where you need to evaluate log data against specific time-based or threshold-based criteria, making it ideal for monitoring user creation events with a custom schedule.

Answer

Microsoft Security incident creation rule

Answer

Anomaly analytics rule

Answer

Near-real-time (NRT) analytics rule

Question 6

You are troubleshooting a Windows device that is reporting as non-compliant in Microsoft Intune. The exhibit shows the output of a PowerShell command run on the device. Based on the output, which component is likely misconfigured?

Accepted Answer

Microsoft Defender for Endpoint sensor onboarding. The PowerShell output shows the 'OnboardingState' value is 0, which indicates the device is not onboarded to Microsoft Defender for Endpoint. Intune uses the Defender for Endpoint sensor as a compliance signal; if the sensor is not properly onboarded, the device will report as non-compliant regardless of other security settings.

Answer

Antivirus protection

Answer

Antispyware protection

Answer

Microsoft Defender Antivirus real-time protection

Question 7

Your organization uses Microsoft Defender for Cloud to secure Azure resources. You need to ensure that all storage accounts have soft delete enabled to protect against accidental deletion. Which policy should you implement?

Accepted Answer

Azure Policy with a built-in policy for storage accounts. Azure Policy with a built-in policy for storage accounts is correct because it allows you to enforce organizational standards and assess compliance at scale. The built-in policy 'Storage accounts should have soft delete enabled' can be assigned to a subscription or resource group to automatically audit or remediate storage accounts that do not have soft delete configured, ensuring protection against accidental deletion.

Answer

Azure Blueprints

Answer

Azure role-based access control (RBAC)

Answer

Defender for Cloud security recommendations

Question 8

Which THREE actions can Microsoft Sentinel perform as part of automated incident response using playbooks?

Accepted Answer

Block an IP address on a firewall. Microsoft Sentinel playbooks, built on Azure Logic Apps, can automate responses to security incidents. Blocking an IP address on a firewall is a common automated action because Logic Apps connectors exist for many firewall vendors (e.g., Palo Alto, Fortinet), allowing Sentinel to trigger a block action directly from a playbook. Resetting a user's password is possible using connectors like Azure AD, enabling automated password resets as part of incident response. Creating an incident in ServiceNow is supported via the ServiceNow connector, allowing integration with IT service management (ITSM) systems. These three actions leverage available Logic Apps connectors, while installing software or modifying NSG rules are not standard actions supported by Sentinel playbooks.

Answer

Install anti-malware software on a device

Answer

Modify a network security group rule

Question 9

Which TWO features are part of Microsoft Defender XDR?

Accepted Answer

Automated investigation and response. Automated investigation and response (AIR) is a core capability of Microsoft Defender XDR, enabling automatic response to threats across workloads. Option E is correct because Incident management across workloads allows security teams to manage and correlate incidents from multiple sources in a unified console within Defender XDR. Option B is incorrect because Cloud app discovery is a feature of Microsoft Defender for Cloud Apps, not Defender XDR. Option C is incorrect because Endpoint data loss prevention (Endpoint DLP) is part of Microsoft Purview compliance solutions. Option D is incorrect because Identity Protection is a feature of Microsoft Entra ID (formerly Azure AD), not Defender XDR.

Answer

Cloud app discovery

Answer

Endpoint data loss prevention

Answer

Identity Protection

Question 10

Your organization, Contoso Ltd., has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. You are deploying Microsoft Defender for Identity (MDI) to protect against identity-based attacks. You have installed the MDI sensor on domain controllers and configured the service with the necessary permissions. After installation, you notice that MDI is not generating alerts for pass-the-hash attacks. You have verified that the sensors are healthy and that audit policies are correctly configured. You need to ensure that MDI can detect pass-the-hash attacks. What should you do?

Accepted Answer

Enable password hash synchronization in Microsoft Entra Connect. The current explanation states: "Enabling password hash synchronization (PHS) in Entra Connect allows MDI to analyze NTLM hashes and detect pass-the-hash attacks." This is incorrect. Password Hash Synchronization (PHS) is a method for synchronizing user password hashes from on-premises Active Directory to Microsoft Entra ID for cloud authentication purposes. MDI's detection of pass-the-hash attacks relies on monitoring NTLM authentication traffic and relevant security events on domain controllers, not on the hashes synchronized to Microsoft Entra ID via PHS. Therefore, enabling PHS does not enable or enhance MDI's ability to detect pass-the-hash attacks on-premises.

Option B is wrong because the MDI sensor is already installed on domain controllers, and installing it on all servers is not the specific missing step for pass-the-hash detection. 
Option C is wrong because pass-the-hash attacks primarily leverage NTLM hashes, and while Kerberos logging is important for other attacks, it's not the primary mechanism for pass-the-hash detection. The stem also states audit policies are correctly configured.
Option D is wrong because multi-factor authentication is a preventative control that strengthens authentication; it does not enable MDI to detect pass-the-hash attacks. Given that the sensors are healthy and audit policies are correctly configured, none of the provided options directly address a common missing configuration for MDI to detect pass-the-hash attacks.

Answer

Install the Azure ATP agent on all servers

Answer

Enable Kerberos event logging on domain controllers

Answer

Configure multi-factor authentication for all users

Question 11

Your company, Fabrikam, uses Microsoft 365 and has Microsoft Purview Information Protection deployed. You need to protect sensitive documents labeled as 'Confidential' so that they cannot be printed or copied when opened in Microsoft Word. You have created a sensitivity label with the appropriate encryption settings. However, users report that they can still print and copy content from these documents. You verify that the label is published and assigned to the correct users. What should you configure to enforce the protection?

Accepted Answer

Configure the sensitivity label to apply an Azure Rights Management template that restricts printing and copying. The sensitivity label must be configured with an Azure Rights Management (RMS) template that specifies user rights, such as denying printing and copying. The label's encryption settings allow applying an RMS template that restricts these actions. Option B is incorrect because conditional access policies control access to resources, not usage rights within documents. Option C is incorrect because auto-labeling policies only automatically apply labels but do not enforce rights. Option D is incorrect because data loss prevention (DLP) policies can detect and block certain actions, but to prevent printing and copying within the document, rights management via RMS is required.

Answer

Implement conditional access policies to block access from unmanaged devices

Answer

Configure auto-labeling policies to apply the label automatically

Answer

Create a data loss prevention policy that blocks printing and copying

Question 12

Your organization, Northwind Traders, uses Microsoft Intune to manage Windows 10 devices. You have created a compliance policy that requires devices to have BitLocker enabled. After assigning the policy, you notice that some devices are reporting as non-compliant due to BitLocker not being enabled. You have verified that the devices support BitLocker and that the policy is correctly assigned. You need to ensure that BitLocker is enabled on these devices automatically. What should you do?

Accepted Answer

Create an endpoint protection configuration profile to enable BitLocker. An endpoint protection configuration profile in Microsoft Intune can be used to enforce BitLocker settings on Windows 10 devices automatically. This profile applies the necessary encryption policies without manual intervention. Option A is wrong because modifying the compliance policy to allow non-compliant devices does not enable BitLocker; it only accepts the non-compliant status. Option C is wrong because Windows update ring policies control update deployment, not BitLocker configuration. Option D is wrong while a PowerShell script could enable BitLocker, it is not the standard or recommended method within Intune; configuration profiles provide a managed, scalable solution.

Answer

Modify the compliance policy to allow non-compliant devices

Answer

Create a Windows update ring policy

Answer

Use a PowerShell script to enable BitLocker manually

Question 13

Your organization uses Microsoft Defender for Cloud to protect Azure virtual machines. You need to ensure that critical vulnerabilities identified on the VMs are automatically remediated using a just-in-time patching mechanism. What should you configure?

Accepted Answer

Enable Azure Update Manager. Azure Update Manager is a unified service that provides managed update capabilities for Azure VMs and Arc-enabled servers. It enables just-in-time patching by allowing you to schedule and apply critical updates as needed, automatically remediating vulnerabilities. In contrast, Adaptive application controls and just-in-time VM access in Defender for Cloud are security controls that reduce attack surface but do not apply patches. Intune is for endpoint management, and Azure Automation Update Management is a legacy solution being replaced by Azure Update Manager.

Answer

Enable adaptive application controls and just-in-time VM access in Defender for Cloud

Answer

Deploy Microsoft Intune for update management

Answer

Configure Azure Automation Update Management

Question 14

A company uses Microsoft Sentinel for security information and event management (SIEM). The security team needs to detect and automatically respond to a potential privilege escalation attack where an attacker attempts to add a new user to the Global Administrator role in Microsoft Entra ID. What should the security team configure?

Accepted Answer

Create an analytics rule with an automated playbook in Microsoft Sentinel. Microsoft Sentinel is the SIEM solution, and analytics rules define conditions that trigger automated responses. By creating an analytics rule that detects a user being added to the Global Administrator role (e.g., via the AuditLogs or IdentityProtection logs) and linking it to an automated playbook (a logic app), the security team can automatically respond to the privilege escalation attempt without manual intervention.

Answer

Deploy a device compliance policy in Microsoft Intune

Answer

Configure a data classification label in Microsoft Purview

Answer

Create a policy in Microsoft Defender for Cloud Apps

Question 15

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive credit card numbers via email. The DLP policy must trigger automatically when a user attempts to send an email containing a credit card number. Which DLP configuration should you use?

Accepted Answer

Create a DLP policy with a condition that matches the Credit Card Number sensitive info type and an action to block the email. Microsoft Purview DLP policies can be configured to detect sensitive information types, such as the Credit Card Number (defined by regex and checksum validation per PCI DSS), and automatically apply an action to block the email from being sent. This meets the requirement for automatic, policy-driven prevention of sharing credit card numbers via email.

Answer

Configure Double Key Encryption for the Exchange Online mailbox

Answer

Configure a Safe Links policy in Microsoft Defender for Office 365

Answer

Use Microsoft Purview Customer Key for encryption