SC-900 Describe the capabilities of Microsoft security solutions Practice Test 26 — 15 Questions

Question 1

Refer to the exhibit. A security analyst is reviewing a Microsoft Defender XDR alert. Which two tactics identified are most relevant? (This is a multiple-choice question asking which two tactics are shown, but the format is single answer. We need to adjust: The question asks: 'Which two tactics are identified?' The correct answer is the option listing both 'InitialAccess and LateralMovement'.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

InitialAccess and LateralMovement. The exhibit shows a Microsoft Defender XDR alert indicating that an attacker gained initial access (e.g., via a phishing link or compromised credential) and then moved laterally within the network (e.g., using remote desktop or SMB). These two stages correspond directly to the InitialAccess and LateralMovement tactics in the MITRE ATT&CK framework, which are the most relevant based on the alert details.

Answer

LateralMovement and PrivilegeEscalation

Answer

LateralMovement and Exfiltration

Answer

InitialAccess and Persistence

Question 2

Your company uses Microsoft 365 E5 licenses and wants to prevent sensitive data from being shared externally via email. You need to configure a solution that automatically scans outgoing emails for credit card numbers and blocks them if detected. What should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is the correct solution because it is specifically designed to inspect email content and attachments for sensitive data types, such as credit card numbers, using built-in sensitive info types. When a match is detected, the policy can automatically block the email from being sent externally, enforcing the organization's data protection requirements without manual intervention.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Microsoft Intune App Protection policy

Answer

Microsoft Entra ID Conditional Access policy

Question 3

A manufacturing company experiences repeated ransomware attacks targeting their on-premises file servers. They have Microsoft 365 E5 and want to implement a solution to detect and automatically respond to such threats across hybrid environments. What should they deploy?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity is the correct solution because it uses on-premises Active Directory signals to detect, investigate, and respond to advanced threats like ransomware targeting hybrid environments. It integrates with Microsoft 365 Defender to automatically initiate response actions (e.g., disabling compromised accounts) when suspicious lateral movement or credential theft is detected, directly addressing the scenario of repeated ransomware attacks on on-premises file servers.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Question 4

Your organization wants to centrally manage security policies for all devices (Windows, iOS, Android) and ensure they meet compliance requirements before accessing corporate resources. Which Microsoft solution should you use?

Accepted Answer

Microsoft Intune. Microsoft Intune is the correct solution because it is a cloud-based mobile device management (MDM) and mobile application management (MAM) service that centrally manages security policies across Windows, iOS, and Android devices. It enforces compliance requirements—such as encryption, OS version, and jailbreak detection—before granting access to corporate resources, integrating with Conditional Access in Microsoft Entra ID.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Entra ID

Question 5

A global company uses Microsoft Teams and SharePoint Online. They need to automatically detect and prevent sharing of intellectual property files containing 'Project X' with external users. What should they configure?

Accepted Answer

Microsoft Purview Data Loss Prevention policy for SharePoint and OneDrive. Microsoft Purview Data Loss Prevention (DLP) policies for SharePoint and OneDrive can be configured to automatically detect files containing sensitive content (e.g., 'Project X') and block sharing with external users. DLP policies inspect content at rest and during sharing actions, applying rules to prevent unauthorized external access.

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Defender for Cloud Apps Session Policy

Question 6

Your organization uses Microsoft Sentinel for SIEM. You receive an alert that a user account was compromised. You need to automatically disable the user's access across all cloud apps (SaaS) and reset their password. What should you use?

Accepted Answer

Create a Microsoft Sentinel automated response playbook. Microsoft Sentinel's automated response playbooks, built on Azure Logic Apps, can trigger an incident-based workflow that disables the user in Microsoft Entra ID and resets their password via the Microsoft Graph API. This provides the necessary cross-cloud automation to remediate a compromised account across all SaaS apps without manual intervention.

Answer

Use Microsoft Intune to remote wipe the user's device

Answer

Manually disable the user in Microsoft Entra ID and reset password

Answer

Configure a Microsoft Defender for Cloud Apps session policy

Question 7

Your company uses Microsoft 365 E5 and wants to provide a unified security dashboard showing alerts from endpoints, email, identity, and cloud apps. Which solution should you use?

Accepted Answer

Microsoft Defender XDR portal (security.microsoft.com). Microsoft Defender XDR portal (security.microsoft.com) aggregates alerts from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), identity (Microsoft Defender for Identity), and cloud apps (Microsoft Defender for Cloud Apps) into a single unified dashboard. This is the correct solution because it provides cross-domain correlation and a centralized view of security incidents across these Microsoft 365 E5 workloads without requiring additional licensing or data ingestion.

Answer

Microsoft Sentinel

Answer

Microsoft Intune admin center

Answer

Microsoft Purview Compliance Portal

Question 8

An organization wants to implement a zero-trust security model. They plan to require multi-factor authentication (MFA) for all users accessing sensitive applications, but only when the sign-in risk is medium or higher. Which Microsoft Entra ID capability should they use?

Accepted Answer

Microsoft Entra ID Conditional Access policy with risk condition. B is correct because Microsoft Entra ID Conditional Access policies allow administrators to enforce MFA based on sign-in risk level, which is evaluated by Microsoft Entra ID Protection. By configuring a policy with a risk condition (e.g., medium or higher), the organization can require MFA only when the sign-in risk meets that threshold, aligning with a zero-trust model that grants access based on real-time risk assessment rather than a static rule.

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Microsoft Defender for Cloud Apps access policy

Answer

Microsoft Entra ID Protection risk detection policy

Question 9

Your organization uses Microsoft Purview to classify data. You need to automatically apply a 'Confidential' sensitivity label to any document that contains a Social Security number. What should you create?

Accepted Answer

An auto-labeling policy for sensitivity labels. An auto-labeling policy for sensitivity labels in Microsoft Purview can automatically apply a 'Confidential' sensitivity label to documents containing sensitive information types like Social Security numbers. This policy uses content scanning and pattern matching to detect the data and apply the label without user intervention, meeting the requirement for automatic classification.

Answer

A sensitivity label policy with manual labeling

Answer

A Data Loss Prevention (DLP) policy

Answer

A retention policy

Question 10

Your company uses Microsoft Defender for Endpoint. A report shows that several devices are missing critical security updates. What feature should you use to deploy the missing updates?

Accepted Answer

Microsoft Intune update rings for Windows. Microsoft Intune update rings for Windows allow you to configure and deploy Windows quality and feature updates to managed devices. Since the question specifies deploying missing security updates, update rings provide the policy-based mechanism to schedule and enforce installation of those updates across devices enrolled in Intune.

Answer

Microsoft Defender for Endpoint's threat and vulnerability management (TVM)

Answer

Microsoft Configuration Manager

Answer

Microsoft Update

Question 11

Which TWO Microsoft Purview solutions can be used to protect sensitive data in Microsoft Teams chats and channels? (Choose two.)

Accepted Answer

Microsoft Purview Communication Compliance. Microsoft Purview Communication Compliance is correct because it helps organizations detect and act on inappropriate or sensitive messages in Teams chats and channels by analyzing communications for policy violations such as offensive language, harassment, or sharing of sensitive data. Microsoft Purview Data Loss Prevention (DLP) policies are correct because they can be configured to automatically detect and prevent the sharing of sensitive information (e.g., credit card numbers, social security numbers) in Teams chats and channels by scanning messages and attachments in real time.

Answer

Microsoft Purview Sensitivity Labels

Answer

Microsoft Purview Information Barriers

Answer

Microsoft Purview Retention Policies

Question 12

Refer to the exhibit. A Microsoft Purview DLP policy is configured in Test mode. An administrator notices that a user is still able to share a document containing a credit card number. What is the most likely reason?

Accepted Answer

The policy is in Test mode, so actions are not enforced. When a Microsoft Purview DLP policy is configured in Test mode, it logs policy matches and generates alerts but does not enforce any restrictive actions such as blocking access or sharing. The administrator observed that the user could still share the document because Test mode explicitly disables action enforcement, allowing the organization to evaluate the policy's impact before moving to Enforce mode.

Answer

The credit card number is not detected because low confidence threshold

Answer

The BlockAccess action is not supported for SharePoint Online

Answer

The policy requires an administrator to approve the action

Question 13

Refer to the exhibit. An administrator runs the PowerShell command against Microsoft Defender for Endpoint. The output shows an alert with Severity 'High' and Status 'New'. What should the administrator do next to investigate the alert?

Accepted Answer

Investigate the alert details in the Microsoft Defender XDR portal. The alert has a severity of 'High' and status 'New', indicating a potentially critical threat that requires immediate investigation. The correct next step is to use the Microsoft Defender XDR portal to examine the alert details, including the affected devices, user accounts, and related events, to determine the scope and impact of the threat. Changing severity or resolving the alert without investigation would risk missing a real security incident.

Answer

Change the severity to Medium to reduce false positives

Answer

Resolve the alert as a false positive

Answer

Create a Microsoft Sentinel analytics rule from the alert

Question 14

Refer to the exhibit. An administrator creates a Conditional Access policy in Microsoft Entra ID. What will this policy do?

Accepted Answer

Require MFA for Global Administrators accessing any application. The policy targets 'Global Administrators' and the 'All cloud apps' condition, then requires 'Require multi-factor authentication' as the access control. This means any Global Administrator attempting to access any application (not just the Entra admin center) must satisfy MFA. Option C correctly captures this scope.

Answer

Block access for Global Administrators unless they use MFA

Answer

Require MFA for all users

Answer

Require MFA for users accessing the Microsoft Entra admin center only

Question 15

A company wants to protect against ransomware by detecting and blocking malicious files in email attachments. Which Microsoft security solution should be used?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 includes Safe Attachments and Safe Links features that scan email attachments in real-time using detonation chambers and machine learning to detect and block ransomware and other malicious files. This solution is specifically designed to protect Exchange Online and SharePoint Online from threats delivered via email, making it the correct choice for blocking malicious attachments.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint