SC-900 Describe the capabilities of Microsoft security solutions Practice Test 24 — 15 Questions

Question 1

Your company wants to use Microsoft Defender for Identity to detect security threats from on-premises Active Directory. What is a prerequisite for deploying Defender for Identity?

Accepted Answer

Install a sensor on a domain controller. Microsoft Defender for Identity requires a sensor installed on a domain controller to capture and analyze on-premises Active Directory traffic, including authentication events and Kerberos requests. Without this sensor, Defender for Identity cannot monitor AD activities or detect threats like pass-the-hash or Golden Ticket attacks.

Answer

Obtain Microsoft 365 E3 licenses

Answer

Install a sensor on each user's workstation

Answer

Configure Azure AD Connect

Question 2

Refer to the exhibit. You are a compliance administrator running PowerShell to update a sensitivity label in Microsoft Purview. The command fails with an error that the label is not found. What is the most likely cause?

Accepted Answer

The cmdlet Get-MgInformationProtectionPolicy does not return labels.. The cmdlet Get-MgInformationProtectionPolicy retrieves the policy configuration but does not return individual sensitivity labels. To update a specific label, you must use Get-MgInformationProtectionSensitivityLabel to first retrieve the label object, then pipe it to Set-MgInformationProtectionSensitivityLabel. The error 'label not found' occurs because the cmdlet used does not expose labels, not because the label is missing or misspelled.

Answer

The -Settings parameter is deprecated.

Answer

The user does not have permissions to view labels.

Answer

The label name is misspelled.

Question 3

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

A conditional access policy. Conditional Access policies in Azure AD evaluate signals (like device compliance status reported by Intune) to enforce access controls. By configuring a Conditional Access policy that requires device compliance for the Exchange Online or corporate email app, only devices marked as compliant by Intune will be granted access. This is the correct mechanism to gate access based on compliance.

Answer

A device compliance policy

Answer

A device configuration policy

Answer

An app protection policy

Question 4

Your organization needs to prevent sensitive data in SharePoint Online from being shared externally. Which Microsoft Purview solution should you use?

Accepted Answer

Data Loss Prevention (DLP). Data Loss Prevention (DLP) is the correct Microsoft Purview solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), by applying policies that can block external sharing in SharePoint Online. DLP policies can be configured to scan content in real-time and enforce actions like blocking access or sending notifications when sensitive data is detected in external sharing scenarios.

Answer

eDiscovery

Answer

Sensitivity labels

Answer

Insider Risk Management

Question 5

Your company uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on a specific device. Which feature should you use to get real-time visibility into running processes and network connections?

Accepted Answer

Live response. Live response gives security operators a remote shell connection to the device, enabling real-time investigation of running processes, network connections, and other forensic data. This is the correct feature for interactive, real-time visibility into a specific device during an active malware outbreak.

Answer

Threat analytics

Answer

Device inventory

Answer

Automated investigation

Question 6

Refer to the exhibit. You are deploying a custom assessment automation in Microsoft Defender for Cloud using Bicep. The deployment fails with an error that the resource type is not valid. What is the most likely reason?

Accepted Answer

The property 'supportedCloud' should be 'supportedClouds' as an array.. In Bicep for Microsoft Defender for Cloud custom assessments, the property that defines which cloud environments the assessment applies to must be named 'supportedClouds' and must be an array of strings (e.g., ['Azure', 'AWS', 'GCP']). Using the singular 'supportedCloud' is invalid syntax and causes the deployment to fail with a resource type validation error.

Answer

The API version is not supported.

Answer

The name property is missing.

Answer

The resource type is misspelled.

Question 7

Your organization uses Microsoft Copilot for Security. You want to use natural language to generate a KQL query for threat hunting. What should you do?

Accepted Answer

Use the Copilot prompt bar in the Microsoft Defender portal.. Microsoft Copilot for Security is integrated directly into the Microsoft Defender portal, allowing security analysts to use natural language prompts to generate KQL queries for threat hunting. The Copilot prompt bar interprets the natural language input and converts it into the appropriate KQL syntax, eliminating the need for manual query writing.

Answer

Manually write the KQL query in the advanced hunting page.

Answer

Install the Copilot add-in for Sentinel.

Answer

Subscribe to Microsoft 365 Copilot.

Question 8

Your company is deploying Microsoft Defender for Cloud Apps. You need to detect and block the use of unsanctioned cloud apps that exhibit risky behavior. Which feature should you configure?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs to identify unsanctioned cloud apps and assess their risk based on behavioral factors such as data upload volume, user count, and security posture. Once identified, Defender for Cloud Apps can automatically block these apps using the built-in app governance controls, enforcing policies to prevent risky app usage.

Answer

Azure Information Protection labels

Answer

Conditional Access policies

Answer

Data Loss Prevention (DLP) policies

Question 9

Your company uses Microsoft Defender for Cloud to secure multicloud workloads. You need to ensure that regulatory compliance frameworks (e.g., SOC 2, ISO 27001) are continuously assessed and any drift is reported. What should you implement?

Accepted Answer

Regulatory compliance standards in Microsoft Defender for Cloud. Regulatory compliance standards in Defender for Cloud provide continuous assessment against frameworks. Option B is wrong because Microsoft Sentinel is for SIEM/SOAR, not compliance assessment. Option C is wrong because Azure Policy is used for policy enforcement, not assessment of compliance frameworks. Option D is wrong because Defender for Cloud Apps focuses on cloud app security.

Answer

Microsoft Sentinel analytics rules

Answer

Azure Policy initiatives

Answer

Microsoft Defender for Cloud Apps session policies

Question 10

Your organization's security team wants to automatically investigate and respond to sophisticated email threats like business email compromise (BEC) without manual intervention. Which Microsoft 365 security solution should you use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes automated investigation and response (AIR) capabilities specifically designed to handle sophisticated email threats like business email compromise (BEC). It uses machine learning models and heuristics to detect BEC patterns—such as spoofed domains, compromised accounts, and social engineering—and can automatically trigger playbooks to contain, investigate, and remediate threats without manual intervention.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Question 11

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the most likely purpose of this query?

Accepted Answer

To identify potential brute-force attack attempts. The query filters for Windows Event ID 4625 (failed logon) and then counts occurrences per account and source IP within a 5-minute window, keeping only those with more than 10 failures. This pattern is the classic signature of a brute-force attack, where an attacker attempts many passwords against the same account or from the same IP. Option D is correct because the query is specifically designed to identify potential brute-force attempts by aggregating failed logons.

Answer

To identify successful logins after multiple failures

Answer

To detect privilege escalation events

Answer

To detect accounts that have been locked out

Question 12

Your company uses Microsoft Purview to govern data across on-premises and cloud sources. You need to classify sensitive data such as credit card numbers and social security numbers automatically. What should you create?

Accepted Answer

Sensitive information types. Sensitive information types (like built-in types for credit card numbers and SSNs) are used in Microsoft Purview to automatically classify data. Option A is wrong because data loss prevention policies use classification but are not the classification mechanism itself. Option B is wrong because sensitivity labels are used for applying protection based on classification, not for classification itself. Option D is wrong because retention labels are for data retention policies.

Answer

Data loss prevention policies

Answer

Sensitivity labels

Answer

Retention labels

Question 13

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email via the Outlook mobile app. Which policy type should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID are the correct choice because they evaluate device compliance status (reported by Intune) as a condition for granting access to cloud apps like Exchange Online. By requiring that only compliant devices can access corporate email via the Outlook mobile app, you configure a Conditional Access policy that blocks or grants access based on the device compliance state, integrating Intune's compliance assessment with Entra ID's access control.

Answer

Device configuration policies

Answer

App protection policies

Answer

Device compliance policies

Question 14

Your company is implementing Microsoft Purview Data Loss Prevention (DLP). You need to prevent users from sharing sensitive data like credit card numbers via email with external recipients, but allow internal sharing. What should you configure?

Accepted Answer

A DLP policy for Exchange Online with a condition 'content contains sensitive information type' and 'shared with people outside my organization'. To prevent sharing of sensitive data with external recipients via email, you need to configure a DLP policy that applies to Exchange Online and includes a condition for the sensitive information type (e.g., credit card numbers) and an action to block sharing when the content is shared with people outside the organization. Option B correctly describes this configuration. Option A is incorrect because sensitivity labels with encryption classify and protect data at rest and in transit but do not by themselves enforce sharing restrictions based on recipients. Option C is incorrect because retention policies are used to retain or delete data, not to block sharing. Option D is incorrect because Conditional Access policies control access to applications based on conditions like user location or device state, not data sharing actions.

Answer

Sensitivity labels with encryption

Answer

Retention labels and policies

Answer

Conditional Access policies with session controls

Question 15

Your company uses Microsoft Defender XDR. You need to integrate threat intelligence from external sources to enrich alerts and automate response actions. Which feature should you use?

Accepted Answer

Threat intelligence integration. Microsoft Defender XDR's threat intelligence integration (option D) allows you to import custom threat indicators (IOCs) from external sources—such as STIX/TAXII feeds, APIs, or manual uploads—into the Microsoft 365 Defender platform. These indicators are then used to enrich alerts, trigger automated response actions via custom detection rules, and correlate with telemetry across endpoints, email, and identities. This directly meets the requirement to integrate external threat intelligence for enrichment and automation.

Answer

Automation rules

Answer

Threat analytics

Answer

Advanced hunting