SC-900 Describe the capabilities of Microsoft security solutions Practice Test 25 — 15 Questions

Question 1

Your company uses Microsoft 365 E5 and wants to provide a unified security dashboard showing alerts from endpoints, email, identity, and cloud apps. Which solution should you use?

Accepted Answer

Microsoft Defender XDR portal (security.microsoft.com). Option C is correct because Microsoft Defender XDR (formerly Microsoft 365 Defender) provides a unified dashboard for alerts across domains. Option A is wrong because Microsoft Sentinel is a SIEM that ingests logs but not a simple dashboard. Option B is wrong because Microsoft Purview is for compliance. Option D is wrong because Microsoft Intune is for device management.

Answer

Microsoft Sentinel

Answer

Microsoft Intune admin center

Answer

Microsoft Purview Compliance Portal

Question 2

An organization wants to implement a zero-trust security model. They plan to require multi-factor authentication (MFA) for all users accessing sensitive applications, but only when the sign-in risk is medium or higher. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra ID Conditional Access policy with risk condition. Option A is correct because Conditional Access policies can evaluate sign-in risk (from Identity Protection) and require MFA when risk is medium or higher. Option B is wrong because Identity Protection itself detects risk but doesn't enforce policies. Option C is wrong because Privileged Identity Management (PIM) manages privileged roles. Option D is wrong because Microsoft Defender for Cloud Apps provides app control, not risk-based MFA.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Defender for Cloud Apps access policy

Answer

Microsoft Entra ID Protection risk detection policy

Question 3

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' sensitivity label to any document that contains a Social Security number. What should you create?

Accepted Answer

An auto-labeling policy for sensitivity labels. Option D is correct because auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels based on sensitive info types like SSN. Option A is wrong because a manual label policy requires user action. Option B is wrong because a DLP policy blocks sharing but doesn't apply labels. Option C is wrong because a retention policy manages data retention, not classification.

Answer

A sensitivity label policy with manual labeling

Answer

A Data Loss Prevention (DLP) policy

Answer

A retention policy

Question 4

Your company uses Microsoft Defender for Endpoint. A report shows that several devices are missing critical security updates. What feature should you use to deploy the missing updates?

Accepted Answer

Microsoft Intune update rings for Windows. Option C is correct because Microsoft Intune can manage updates for Windows devices. Option A is wrong because Defender for Endpoint detects but does not deploy updates. Option B is wrong because Microsoft Update is a service, not a management tool. Option D is wrong because Microsoft Configuration Manager is on-premises, but Intune is cloud-based and more likely for modern management.

Answer

Microsoft Defender for Endpoint's threat and vulnerability management (TVM)

Answer

Microsoft Configuration Manager

Answer

Microsoft Update

Question 5

Which TWO Microsoft Purview solutions can be used to protect sensitive data in Microsoft Teams chats and channels? (Choose two.)

Accepted Answer

Microsoft Purview Communication Compliance. Options A and D are correct. Microsoft Purview Data Loss Prevention (DLP) policies can prevent sharing of sensitive data in Teams. Microsoft Purview Communication Compliance can detect policy violations in chats. Option B is wrong because Sensitivity Labels are applied to files, not chats. Option C is wrong because Retention Policies manage data retention, not protection. Option E is wrong because Information Barriers restrict communication between groups, but don't protect sensitive data per se.

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview Retention Policies

Question 6

Which THREE capabilities are provided by Microsoft Defender XDR (formerly Microsoft 365 Defender)? (Choose three.)

Accepted Answer

Identity threat detection. Options A, B, and D are correct. Microsoft Defender XDR includes Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Option C is wrong because Microsoft Purview is a separate compliance solution. Option E is wrong because Microsoft Intune is for device management, not part of XDR.

Answer

Data classification and labeling

Answer

Mobile device management (MDM)

Question 7

Which TWO features are included in Microsoft Entra ID Identity Protection? (Choose two.)

Accepted Answer

Sign-in risk detection. Options A and B are correct. Identity Protection includes sign-in risk and user risk detection. Option C is wrong because it's a Conditional Access feature. Option D is wrong because it's Privileged Identity Management. Option E is wrong because it's Microsoft Defender for Cloud Apps.

Answer

Just-in-time privileged access

Answer

Cloud app discovery

Answer

Multi-factor authentication registration campaign

Question 8

Refer to the exhibit. A Microsoft Purview DLP policy is configured in Test mode. An administrator notices that a user is still able to share a document containing a credit card number. What is the most likely reason?

Accepted Answer

The policy is in Test mode, so actions are not enforced. Option B is correct because the policy is in Test mode, which means it will not enforce actions like BlockAccess; it only logs alerts. Option A is wrong because the rule is correctly configured to detect credit card numbers with high confidence. Option C is wrong because Test mode does not require approval; it simply doesn't enforce. Option D is wrong because DLP policies can block access in SharePoint/OneDrive.

Answer

The credit card number is not detected because low confidence threshold

Answer

The BlockAccess action is not supported for SharePoint Online

Answer

The policy requires an administrator to approve the action

Question 9

Refer to the exhibit. An administrator runs the PowerShell command against Microsoft Defender for Endpoint. The output shows an alert with Severity 'High' and Status 'New'. What should the administrator do next to investigate the alert?

Accepted Answer

Investigate the alert details in the Microsoft Defender XDR portal. Option A is correct because the administrator should investigate the alert in the Microsoft Defender XDR portal to understand the context and determine next steps. Option B is wrong because severity is already high, so it's not about adjusting. Option C is wrong because the alert is new, not resolved. Option D is wrong because the alert is already in Defender, no need to create a Sentinel rule first.

Answer

Change the severity to Medium to reduce false positives

Answer

Resolve the alert as a false positive

Answer

Create a Microsoft Sentinel analytics rule from the alert

Question 10

Refer to the exhibit. An administrator creates a Conditional Access policy in Microsoft Entra ID. What will this policy do?

Accepted Answer

Require MFA for Global Administrators accessing any application. Option C is correct because the policy applies to all applications, for users with Global Administrator role, and requires MFA. Option A is wrong because it applies to all applications, not just specific. Option B is wrong because it applies to Global Administrators, not all users. Option D is wrong because it requires MFA, not block.

Answer

Block access for Global Administrators unless they use MFA

Answer

Require MFA for all users

Answer

Require MFA for users accessing the Microsoft Entra admin center only

Question 11

A company wants to protect against ransomware by detecting and blocking malicious files in email attachments. Which Microsoft security solution should be used?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Attachments and Safe Links to protect against malicious content in email.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Question 12

A security administrator needs to identify users who are repeatedly failing to authenticate from unusual locations. Which Microsoft 365 security feature provides this visibility?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection analyzes sign-in risks and can identify users with multiple failed attempts from atypical locations.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 13

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a compliant antivirus solution can access corporate email. Which policy type should be configured?

Accepted Answer

Conditional Access policy in Microsoft Entra ID. Conditional Access policies can grant access based on device compliance, and compliance policies in Intune can require antivirus to be installed and active.

Answer

App protection policy in Microsoft 365

Answer

Device compliance policy in Intune

Answer

Security baseline in Microsoft Defender for Cloud

Question 14

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically trigger a playbook when a high-severity incident is created. Which automation option should be used?

Accepted Answer

Automation rule in Microsoft Sentinel. Automation rules in Microsoft Sentinel allow you to automatically run playbooks when incidents are created or updated, based on conditions like severity.

Answer

Azure Policy assignment

Answer

Microsoft Power Automate flow directly from Sentinel

Answer

Azure Logic Apps HTTP trigger

Question 15

A multinational corporation needs to restrict data sharing in Microsoft Teams to comply with regional regulations. Users must not be able to share files with external domains from specific departments. What should the administrator configure?

Accepted Answer

Sensitivity labels with container management in Microsoft Purview. Microsoft Purview Information Protection and sensitivity labels can enforce encryption and access restrictions. Additionally, Microsoft Entra ID Conditional Access can block external sharing from specific groups, but the most direct is using sensitivity labels with container management for Teams.

Answer

Microsoft Intune device compliance policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Data Loss Prevention (DLP) policy in Microsoft Purview