SC-900 Describe the capabilities of Microsoft security solutions Practice Test 25 — 15 Questions

Question 1

Your organization is deploying Microsoft Purview. You need to automatically apply a sensitivity label to documents that contain passport numbers. Which TWO components must you configure?

Accepted Answer

Sensitive information type for passport numbers. A sensitive information type (SIT) for passport numbers defines the pattern and validation logic that Microsoft Purview uses to detect passport numbers in content. An auto-labeling policy then applies the specified sensitivity label automatically when the SIT is matched, enabling automated classification and protection without user intervention.

Answer

Retention label

Answer

Data loss prevention (DLP) policy

Answer

Trainable classifier

Question 2

Your company uses Microsoft Defender for Endpoint. You need to configure attack surface reduction (ASR) rules. Which TWO of the following are ASR rules?

Accepted Answer

Block executable content from email client and webmail. ASR rules are designed to block common attack vectors by controlling specific behaviors. 'Block executable content from email client and webmail' prevents malicious scripts or executables from running when delivered via email, which is a primary infection vector. Option E is correct because 'Block Office applications from creating child processes' stops attackers from using Office apps (like Word or Excel) to spawn malicious processes (e.g., PowerShell or cmd.exe), a classic technique for code execution.

Answer

Allow only signed executables

Answer

Block inbound connections from the internet

Answer

Block untrusted fonts

Question 3

Your company uses Microsoft Purview to meet data privacy regulations. You need to discover and classify personal data stored in Azure SQL Database. Which THREE tools or features can you use?

Accepted Answer

Microsoft Purview Data Estate Insights. Microsoft Purview Data Estate Insights (C) provides a centralized dashboard to monitor data estate health, including scanning and classification of personal data across sources like Azure SQL Database. It integrates with the Purview Data Map to track data lineage and sensitivity labels, enabling compliance with data privacy regulations.

Answer

Microsoft 365 compliance center

Answer

Azure Information Protection

Question 4

Your company uses Microsoft Defender for Cloud to secure Azure resources. You need to enable network security recommendations for all virtual networks. Which security policy should you enable?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark provides a comprehensive set of security recommendations, including network security controls for virtual networks, such as restricting inbound/outbound traffic and enforcing encryption. Enabling this policy in Microsoft Defender for Cloud applies built-in Azure Policy initiatives that assess and recommend network security configurations across all virtual networks. This directly meets the requirement to enable network security recommendations for all virtual networks.

Answer

Adaptive network hardening

Answer

Network Security Group (NSG) flow logs

Answer

Just-in-time VM access

Question 5

A company wants to block users from accessing phishing websites via Microsoft Edge. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender SmartScreen. Microsoft Defender SmartScreen is the correct solution because it is specifically designed to protect users from phishing and malicious websites directly within Microsoft Edge. It operates by comparing visited URLs against a dynamic list of reported phishing sites and analyzing site behavior in real time, blocking access before the user can interact with the page.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 6

A security administrator receives an alert about a suspicious sign-in from an unfamiliar location. The user verified the sign-in as legitimate. Which Microsoft Entra ID feature should be used to reduce false positives for this user?

Accepted Answer

Identity Protection confirm user safe. Microsoft Entra ID Identity Protection's 'Confirm user safe' feature allows administrators to manually override a risk detection when a user confirms a suspicious sign-in was legitimate. This reduces false positives by telling Identity Protection to ignore that specific risk event for that user, preventing future alerts based on the same detection.

Answer

Passwordless authentication

Answer

Privileged Identity Management

Answer

Conditional Access policies

Question 7

A company wants to automatically classify documents containing credit card numbers and apply encryption at rest in SharePoint Online. Which Microsoft Purview feature should be used?

Accepted Answer

Sensitivity labels with auto-classification. Sensitivity labels with auto-classification can automatically detect sensitive data types such as credit card numbers using built-in or custom sensitive info types, and then apply a label that enforces encryption at rest in SharePoint Online. This meets the requirement of both automatic classification and encryption enforcement without manual user intervention.

Answer

eDiscovery

Answer

Microsoft Purview Audit

Answer

Data Loss Prevention (DLP) policies

Question 8

During a security incident, a SOC analyst needs to investigate a compromised user account that accessed multiple cloud apps. Which Microsoft Defender XDR feature provides a unified view of the attack timeline across endpoints, identities, and cloud apps?

Accepted Answer

Incident response. Incident response in Microsoft Defender XDR aggregates alerts and activities from endpoints, identities, and cloud apps into a single incident view, providing a unified attack timeline. This allows the SOC analyst to see the full scope of the compromised user account's actions across all integrated workloads without switching between consoles.

Answer

Microsoft Secure Score

Answer

Advanced hunting

Answer

Action center

Question 9

An organization wants to allow users to sign in using their mobile phone number and a verification code. Which Microsoft Entra ID feature enables this?

Accepted Answer

SMS-based authentication. SMS-based authentication allows users to sign in to Microsoft Entra ID by entering their mobile phone number and receiving a verification code via text message. This is a form of passwordless authentication that leverages the user's phone number as the primary identifier and the SMS-delivered code as the second factor, meeting the organization's requirement for phone number and verification code sign-in.

Answer

FIDO2 security keys

Answer

App passwords

Answer

Password hash synchronization

Question 10

A company uses Microsoft Sentinel to centralize security logs. They want to correlate AWS CloudTrail logs with Azure AD sign-in logs. Which Microsoft Sentinel feature should they use?

Accepted Answer

Analytics rules. Analytics rules in Microsoft Sentinel are designed to correlate and analyze data from multiple sources, such as AWS CloudTrail and Azure AD sign-in logs, to detect security threats. By creating a multi-source analytics rule, you can define conditions that trigger alerts when suspicious patterns emerge across these disparate log streams, enabling centralized threat detection.

Answer

Workbooks

Answer

Playbooks

Answer

Hunting

Question 11

Refer to the exhibit. A security analyst runs the KQL query in Microsoft Defender for Endpoint. The query returns no results. What is the most likely cause?

Accepted Answer

The device is not onboarded to Defender for Endpoint. The KQL query in Microsoft Defender for Endpoint returns no results because the device is not onboarded. Defender for Endpoint can only report on devices that have been enrolled and are actively sending telemetry. If a device is not onboarded, no data exists for it in the security portal, so any query targeting that device will return empty results.

Answer

The device has a risk score of zero

Answer

The device runs macOS

Answer

The analyst lacks permissions to view the device

Question 12

Which TWO Microsoft Purview solutions can be used to discover and classify sensitive data in Microsoft 365? (Select two.)

Accepted Answer

Information Protection. Information Protection (option B) provides the ability to discover, classify, and protect sensitive data across Microsoft 365 by using trainable classifiers and content scanning. Data Classification (option E) offers a unified view of sensitive data across the tenant, including classification results from sensitivity labels and retention labels, enabling administrators to identify and monitor sensitive information at scale.

Answer

Data Loss Prevention

Answer

Sensitivity labels

Answer

Audit

Question 13

Which THREE Microsoft Defender XDR components are included in the unified security operations platform? (Select three.)

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR (Extended Detection and Response) unifies signals from across the Microsoft 365 Defender portal. Microsoft Defender for Office 365 is a core component because it protects email, SharePoint, OneDrive, and Teams from threats like phishing and malware, and its alerts feed directly into the unified XDR incident queue. This integration allows cross-domain correlation with endpoint, identity, and cloud app signals.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for IoT

Question 14

Which THREE features are part of Microsoft Entra ID? (Select three.)

Accepted Answer

Privileged Identity Management. Conditional Access is a core feature of Microsoft Entra ID that allows administrators to enforce policies based on conditions such as user location, device state, or sign-in risk, enabling granular access control. Identity Protection is also part of Microsoft Entra ID, using machine learning to detect and respond to identity-based risks like leaked credentials or anomalous sign-in patterns. Privileged Identity Management (PIM) is a key capability of Microsoft Entra ID Governance, which is a set of features within Microsoft Entra ID for managing, controlling, and monitoring access to important resources, and is explicitly covered as a Microsoft Entra ID capability in the SC-900 exam objectives.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 15

Which TWO Microsoft Entra ID capabilities help detect and remediate identity risks? (Select two.)

Accepted Answer

Identity Protection. Identity Protection (A) is correct because it uses machine learning and heuristics to detect identity-based risks such as leaked credentials, impossible travel, and anomalous sign-in behavior. It provides automated remediation actions like requiring password reset or blocking sign-in, directly addressing risk detection and remediation.

Answer

Identity Governance

Answer

Password protection

Answer

Privileged Identity Management