SC-900 Describe the capabilities of Microsoft security solutions Practice Test 24 — 15 Questions

Question 1

An organization wants to allow users to sign in using their mobile phone number and a verification code. Which Microsoft Entra ID feature enables this?

Accepted Answer

SMS-based authentication. Microsoft Entra ID supports SMS-based authentication. Option D is correct. Option A (FIDO2) uses hardware keys. Option B (Password Hash Sync) is for sync. Option C (App passwords) is for legacy apps.

Answer

FIDO2 security keys

Answer

App passwords

Answer

Password hash synchronization

Question 2

A company uses Microsoft Sentinel to centralize security logs. They want to correlate AWS CloudTrail logs with Azure AD sign-in logs. Which Microsoft Sentinel feature should they use?

Accepted Answer

Analytics rules. Analytics rules in Sentinel can correlate data from multiple sources. Option A is correct. Option B (Workbooks) visualize data. Option C (Playbooks) automate responses. Option D (Hunting) is proactive threat search.

Answer

Workbooks

Answer

Playbooks

Answer

Hunting

Question 3

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Defender for Endpoint. The query returns no results. What is the most likely cause?

Accepted Answer

The device is not onboarded to Defender for Endpoint. The table name is DeviceInfo, but in Microsoft Defender for Endpoint the correct table is DeviceInfo (it exists). However, the query may fail if the device is not onboarded. Option C is correct. Option A (risk score) would still show if device exists. Option B (OS) is not a filter. Option D (permissions) would cause an error, not empty results.

Answer

The device has a risk score of zero

Answer

The device runs macOS

Answer

The analyst lacks permissions to view the device

Question 4

A company wants to restrict access to a sensitive SharePoint site based on the user's location and device compliance. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access policies can enforce location and device compliance. Option A is correct. Option B (Identity Protection) is for risk detection. Option C (PIM) is for role management. Option D (Entitlement Management) is for access packages.

Answer

Privileged Identity Management

Answer

Entitlement Management

Answer

Identity Protection

Question 5

Which TWO Microsoft Purview solutions can be used to discover and classify sensitive data in Microsoft 365? (Select two.)

Accepted Answer

Information Protection. Data Classification and Information Protection are correct. Sensitivity labels (Option D) are part of Information Protection. DLPs (Option C) use classifications but do not discover. Audit (Option E) tracks activities.

Answer

Data Loss Prevention

Answer

Sensitivity labels

Answer

Audit

Question 6

Which THREE Microsoft Defender XDR components are included in the unified security operations platform? (Select three.)

Accepted Answer

Microsoft Defender for Office 365. Defender for Endpoint, for Office 365, and for Identity are part of Defender XDR. Defender for Cloud (Option D) is separate. Defender for IoT (Option E) is not included in the core XDR platform.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for IoT

Question 7

Which TWO features are part of Microsoft Entra ID? (Select two.)

Accepted Answer

Conditional Access. Conditional Access and Identity Protection are part of Entra ID. PIM is also part of Entra ID, but the question asks for TWO; only A and C are correct. Intune is separate. Sentinel is separate.

Answer

Privileged Identity Management

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 8

Which THREE Microsoft Purview features can be used to protect data in Microsoft 365? (Select three.)

Accepted Answer

Data Loss Prevention. Data Loss Prevention, Sensitivity labels, and Insider Risk Management are Purview features. Defender for Cloud Apps (Option D) is a separate product. eDiscovery (Option E) is for discovery, not protection.

Answer

eDiscovery

Answer

Microsoft Defender for Cloud Apps

Question 9

Which TWO Microsoft Entra ID capabilities help detect and remediate identity risks? (Select two.)

Accepted Answer

Identity Protection. Identity Protection detects risks, and Conditional Access policies can enforce remediation. PIM (Option C) manages privileges. Password protection (Option D) prevents weak passwords. Identity Governance (Option E) manages access lifecycle.

Answer

Identity Governance

Answer

Password protection

Answer

Privileged Identity Management

Question 10

Refer to the exhibit. A security analyst is reviewing a Microsoft Defender XDR alert. Which two tactics identified are most relevant? (This is a multiple-choice question asking which two tactics are shown, but the format is single answer. We need to adjust: The question asks: 'Which two tactics are identified?' The correct answer is the option listing both 'InitialAccess and LateralMovement'.)

Accepted Answer

InitialAccess and LateralMovement. The exhibit shows "tactics": ["InitialAccess", "LateralMovement"]. Option A lists both. Option B includes Persistence, not shown. Option C includes PrivilegeEscalation. Option D includes Exfiltration.

Answer

LateralMovement and PrivilegeEscalation

Answer

LateralMovement and Exfiltration

Answer

InitialAccess and Persistence

Question 11

Your company uses Microsoft 365 E5 licenses and wants to prevent sensitive data from being shared externally via email. You need to configure a solution that automatically scans outgoing emails for credit card numbers and blocks them if detected. What should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Option B is correct because Microsoft Purview Data Loss Prevention (DLP) policies can scan emails for sensitive data like credit card numbers and block them. Option A is wrong because Microsoft Defender for Office 365 focuses on threat protection, not DLP. Option C is wrong because Microsoft Entra ID is for identity and access management. Option D is wrong because Microsoft Intune is for device management.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Microsoft Intune App Protection policy

Answer

Microsoft Entra ID Conditional Access policy

Question 12

A manufacturing company experiences repeated ransomware attacks targeting their on-premises file servers. They have Microsoft 365 E5 and want to implement a solution to detect and automatically respond to such threats across hybrid environments. What should they deploy?

Accepted Answer

Microsoft Defender for Identity. Option C is correct because Microsoft Defender for Identity is designed to protect on-premises Active Directory and detect attacks like ransomware. Option A is wrong because Microsoft Defender for Cloud Apps focuses on SaaS applications. Option B is wrong because Microsoft Defender for Office 365 protects cloud email and collaboration. Option D is wrong because Microsoft Purview is for data governance and compliance.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Question 13

Your organization wants to centrally manage security policies for all devices (Windows, iOS, Android) and ensure they meet compliance requirements before accessing corporate resources. Which Microsoft solution should you use?

Accepted Answer

Microsoft Intune. Option A is correct because Microsoft Intune is a cloud-based mobile device management (MDM) and mobile application management (MAM) solution. Option B is wrong because Microsoft Entra ID is for identity, not device management. Option C is wrong because Microsoft Defender for Endpoint is for endpoint detection and response, not configuration management. Option D is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Entra ID

Question 14

A global company uses Microsoft Teams and SharePoint Online. They need to automatically detect and prevent sharing of intellectual property files containing 'Project X' with external users. What should they configure?

Accepted Answer

Microsoft Purview Data Loss Prevention policy for SharePoint and OneDrive. Option D is correct because Microsoft Purview DLP policies can monitor and block sharing of sensitive content in Teams and SharePoint. Option A is wrong because sensitivity labels manually classify, but don't automatically block. Option B is wrong because Microsoft Defender for Cloud Apps focuses on SaaS app security, not DLP. Option C is wrong because Microsoft Entra ID Access Reviews are for identity governance.

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Defender for Cloud Apps Session Policy

Question 15

Your organization uses Microsoft Sentinel for SIEM. You receive an alert that a user account was compromised. You need to automatically disable the user's access across all cloud apps (SaaS) and reset their password. What should you use?

Accepted Answer

Create a Microsoft Sentinel automated response playbook. Option B is correct because Microsoft Sentinel can use automation rules with playbooks (Power Automate or Logic Apps) to trigger actions like disabling a user and resetting password in Microsoft Entra ID. Option A is wrong because manual response is not automated. Option C is wrong because Microsoft Defender for Cloud Apps can block access but not reset passwords. Option D is wrong because Microsoft Intune manages devices, not user accounts.

Answer

Use Microsoft Intune to remote wipe the user's device

Answer

Manually disable the user in Microsoft Entra ID and reset password

Answer

Configure a Microsoft Defender for Cloud Apps session policy