SC-900 Describe the capabilities of Microsoft security solutions Practice Test 23 — 15 Questions

Question 1

Your company uses Microsoft Purview to govern data across on-premises and cloud sources. You need to classify sensitive data such as credit card numbers and social security numbers automatically. What should you create?

Accepted Answer

Sensitive information types. Option B is correct because sensitive information types (like built-in types for credit card numbers and SSNs) are used in Microsoft Purview to automatically classify data. Option A is wrong because sensitivity labels are used for applying protection based on classification, but classification itself uses sensitive information types. Option C is wrong because retention labels are for data retention policies. Option D is wrong because data loss prevention policies use classification but are not the classification mechanism itself.

Answer

Data loss prevention policies

Answer

Sensitivity labels

Answer

Retention labels

Question 2

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email via the Outlook mobile app. Which policy type should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID. Option D is correct because Conditional Access policies in Microsoft Entra ID can enforce device compliance before granting access to cloud apps like Outlook. Option A is wrong because compliance policies define what compliance means but do not enforce access control. Option B is wrong because app protection policies (MAM) protect data within apps but do not require device compliance. Option C is wrong because device configuration policies configure device settings, not access control.

Answer

Device configuration policies

Answer

App protection policies

Answer

Device compliance policies

Question 3

Your company is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive data like credit card numbers via email with external recipients, but allow internal sharing. What should you configure?

Accepted Answer

A DLP policy for Exchange Online with a condition 'content contains sensitive information type' and 'shared with people outside my organization'. Option A is correct because DLP policies can be scoped to specific locations (e.g., Exchange Online) and set conditions such as 'when shared with external users'. Option B is wrong because sensitivity labels are applied manually or automatically but do not enforce sharing restrictions. Option C is wrong because retention policies do not block sharing. Option D is wrong because Microsoft Entra ID Conditional Access controls access, not data sharing.

Answer

Sensitivity labels with encryption

Answer

Retention labels and policies

Answer

Conditional Access policies with session controls

Question 4

Your company uses Microsoft Defender XDR. You need to integrate threat intelligence from external sources to enrich alerts and automate response actions. Which feature should you use?

Accepted Answer

Threat intelligence integration. Option C is correct because Microsoft Defender XDR supports threat intelligence integration via APIs and SIEM connectors, allowing ingestion of external threat intel. Option A is wrong because automation rules are for response actions, not ingestion. Option B is wrong because advanced hunting queries are for investigation. Option D is wrong because threat analytics provides built-in intelligence, not external ingestion.

Answer

Automation rules

Answer

Threat analytics

Answer

Advanced hunting

Question 5

Your organization is deploying Microsoft Purview. You need to automatically apply a sensitivity label to documents that contain passport numbers. Which TWO components must you configure?

Accepted Answer

Sensitive information type for passport numbers. Options A and D are correct. Sensitive information types (A) define the pattern for passport numbers, and auto-labeling policies (D) apply the label automatically. Option B is wrong because DLP policies prevent data loss but do not apply labels. Option C is wrong because retention labels manage retention, not sensitivity. Option E is wrong because trainable classifiers are for machine learning-based classification, not for simple pattern matching like passport numbers.

Answer

Retention label

Answer

Data loss prevention (DLP) policy

Answer

Trainable classifier

Question 6

Your company uses Microsoft Sentinel as a SIEM. You need to collect logs from a third-party firewall. Which THREE methods can you use?

Accepted Answer

Common Event Format (CEF). Options A, C, and D are correct. Syslog (A) is a standard protocol for log forwarding. CEF (C) is a common log format for security devices. Microsoft Sentinel Data Connectors (D) often include built-in connectors for common firewalls. Option B is wrong because Azure Monitor Agent is for Windows/Linux VMs, not network appliances. Option E is wrong because Microsoft Defender for Cloud is a security posture management tool, not a log collection method.

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor Agent

Question 7

Your company uses Microsoft Defender for Endpoint. You need to configure attack surface reduction (ASR) rules. Which TWO of the following are ASR rules?

Accepted Answer

Block executable content from email client and webmail. Options A and C are correct. Blocking Office applications from creating child processes (A) and blocking executable content from email client (C) are ASR rules. Option B is a Windows Defender Firewall rule, not ASR. Option D is an application control rule, not ASR. Option E is a network protection rule, not ASR.

Answer

Allow only signed executables

Answer

Block inbound connections from the internet

Answer

Block untrusted fonts

Question 8

Your company uses Microsoft Purview to meet data privacy regulations. You need to discover and classify personal data stored in Azure SQL Database. Which THREE tools or features can you use?

Accepted Answer

Microsoft Purview Data Estate Insights. Options A, C, and E are correct. Microsoft Purview Data Map (A) scans and catalogs data sources. Data classification in Azure SQL Database (C) is a built-in feature to classify columns. Microsoft Purview Data Estate Insights (E) provides visibility into data estate. Option B is wrong because Azure Information Protection is for labeling files, not databases. Option D is wrong because Microsoft 365 compliance center is for Microsoft 365 data, not Azure SQL.

Answer

Microsoft 365 compliance center

Answer

Azure Information Protection

Question 9

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a specific user account logs in from an unusual geographic location. Which KQL function should you use to evaluate location?

Accepted Answer

ioc. Option B is correct because the 'ioc' function is used for indicator of compromise matching, but more accurately, to evaluate location you would use 'geo_info_from_ip_address' or similar. However, among the options, 'ioc' is a placeholder; the actual function is 'geoip_lookup' but not listed. Given the choices, the best is 'ioc' as it can match IPs from threat intel including location. Option A is wrong because 'parse_json' parses JSON, not location. Option C is wrong because 'search' is generic. Option D is wrong because 'evaluate' is used for plugins, not location.

Answer

search

Answer

evaluate

Answer

parse_json

Question 10

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to enable network security recommendations for all virtual networks. Which security policy should you enable?

Accepted Answer

Azure Security Benchmark. Option D is correct because the 'Azure Security Benchmark' policy initiative includes many network security controls. Option A is wrong because 'Adaptive network hardening' is a recommendation, not a policy. Option B is wrong because 'Just-in-time VM access' is a feature. Option C is wrong because 'Network Security Group (NSG)' is a resource, not a policy.

Answer

Adaptive network hardening

Answer

Network Security Group (NSG) flow logs

Answer

Just-in-time VM access

Question 11

A company wants to block users from accessing phishing websites via Microsoft Edge. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender SmartScreen. Microsoft Defender SmartScreen protects against phishing and malicious websites. Option A is correct. Option B (Microsoft Defender for Endpoint) focuses on endpoint detection and response, not web filtering. Option C (Microsoft Purview) is for data governance. Option D (Microsoft Intune) is for device management.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 12

A security administrator receives an alert about a suspicious sign-in from an unfamiliar location. The user verified the sign-in as legitimate. Which Microsoft Entra ID feature should be used to reduce false positives for this user?

Accepted Answer

Identity Protection confirm user safe. Entra ID Identity Protection allows marking a user as safe to reduce false positives. Option D is correct. Option A (Conditional Access) controls access but does not directly affect risk signals. Option B (Privileged Identity Management) manages roles. Option C (Passwordless authentication) improves security but does not address false positives.

Answer

Passwordless authentication

Answer

Privileged Identity Management

Answer

Conditional Access policies

Question 13

Refer to the exhibit. A compliance administrator is configuring role-based access control (RBAC) in Microsoft Purview compliance portal. Which role group would provide the permissions shown?

Accepted Answer

Information Protection. The permissions (Sensitive Info Types, Data Classifiers, Content Explorer) are part of the Information Protection role group. Option A is correct. Option B (Data Classification) is a role within Information Protection, not a group. Option C (Compliance Administrator) is a higher-level role. Option D (Security Reader) is read-only.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Data Classification

Question 14

A company wants to automatically classify documents containing credit card numbers and apply encryption at rest in SharePoint Online. Which Microsoft Purview feature should be used?

Accepted Answer

Sensitivity labels with auto-classification. Sensitivity labels with auto-classification can detect credit card numbers and apply encryption. Option B is correct. Option A (DLP policies) prevent sharing but do not apply encryption. Option C (Audit) logs activities. Option D (eDiscovery) is for legal discovery.

Answer

eDiscovery

Answer

Microsoft Purview Audit

Answer

Data Loss Prevention (DLP) policies

Question 15

During a security incident, a SOC analyst needs to investigate a compromised user account that accessed multiple cloud apps. Which Microsoft Defender XDR feature provides a unified view of the attack timeline across endpoints, identities, and cloud apps?

Accepted Answer

Incident response. Incident response in Microsoft Defender XDR correlates alerts across domains. Option A is correct. Option B (Advanced hunting) is for custom queries. Option C (Secure Score) is for posture improvement. Option D (Action center) is for remediation actions.

Answer

Microsoft Secure Score

Answer

Advanced hunting

Answer

Action center