SC-900 Describe the capabilities of Microsoft security solutions Practice Test 26 — 15 Questions

Question 1

A security analyst needs to investigate a potential data exfiltration incident involving sensitive files being sent via email. Which Microsoft Purview solution provides the necessary monitoring?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) policies monitor and control sensitive data in email and other locations.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Audit

Question 2

An organization uses Microsoft Defender for Cloud to secure its Azure workloads. They want to receive recommendations for improving the security posture of their virtual machines. What should they enable?

Accepted Answer

Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM). Microsoft Defender for Cloud provides security recommendations based on assessments. Enabling Defender for Cloud (with the foundational CSPM or enhanced security features) will generate recommendations.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Answer

Azure Policy

Question 3

A company has deployed Microsoft Defender for Identity and wants to detect pass-the-hash attacks in real time. Which alert type should they monitor?

Accepted Answer

Suspected Pass-the-Hash attack. Microsoft Defender for Identity uses behavioral analytics to detect lateral movement and credential theft, including pass-the-hash attacks, and generates security alerts.

Answer

Suspected Kerberoasting attack

Answer

Suspected Brute Force attack

Answer

Suspected Golden Ticket attack

Question 4

What is the primary purpose of Microsoft Defender for Cloud Apps?

Accepted Answer

Secure cloud applications and data. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility, data controls, and threat protection for cloud applications.

Answer

Monitor network traffic

Answer

Manage mobile devices

Answer

Protect on-premises servers

Question 5

Which TWO of the following are capabilities of Microsoft Purview Information Protection? (Choose two.)

Accepted Answer

Classify and label sensitive data. Microsoft Purview Information Protection allows classification and labeling, and can apply encryption. Activity logging is part of Audit, and DLP is a separate solution.

Answer

Block external sharing of files

Answer

Detect malware in email attachments

Answer

Monitor user activities in real-time

Question 6

Which THREE of the following are included in Microsoft Defender XDR (Extended Detection and Response)? (Choose three.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender XDR unifies Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and more. Azure Information Protection is not part of XDR.

Answer

Microsoft Azure Information Protection

Answer

Microsoft Defender for Cloud

Question 7

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security Information and Event Management (SIEM). Microsoft Sentinel is a SIEM and SOAR solution that collects security data across the enterprise and uses AI to detect threats. It does not manage endpoints or provide identity governance.

Answer

Data loss prevention

Answer

Endpoint detection and response

Answer

Identity governance

Question 8

Refer to the exhibit. The JSON shows a Microsoft Purview DLP policy. A user sends an email with a credit card number to an external recipient. What will happen?

Accepted Answer

The email is blocked and the user receives a notification.. The policy is scoped to Exchange, SharePoint, and OneDrive, and includes a rule with BlockAccess action. Since Exchange is included, the email will be blocked and the user notified.

Answer

The email is delivered normally because TeamsChatAndChannel is false.

Answer

The email is delivered but an alert is generated.

Answer

The email is encrypted before delivery.

Question 9

Refer to the exhibit. The KQL query is run in Microsoft Defender for Endpoint. What is the purpose of this query?

Accepted Answer

To find devices with a high number of operations on potentially sensitive files.. The query looks for devices where multiple file events (over 5) involving files with 'confidential' in the name and larger than 1000 bytes occurred in the last 7 days, grouped by device and action type.

Answer

To list all devices that have files named confidential.

Answer

To detect malware on devices.

Answer

To list all file creation events.

Question 10

Refer to the exhibit. A company has configured the above Conditional Access policy in Microsoft Entra ID. A user attempts to access Exchange Online from an untrusted location. What happens?

Accepted Answer

The user is granted access without MFA because the policy does not apply.. The policy applies only to trusted locations. Since the user is from an untrusted location, the policy does not apply, so the user can access without MFA (assuming no other policies apply).

Answer

Access is blocked because the condition is not met.

Answer

The user is prompted for MFA because the policy applies to all users.

Answer

The user is blocked because the grant requires MFA.

Question 11

Your organization uses Microsoft Defender for Cloud Apps. A security analyst notices anomalous file downloads from a SharePoint site by a user flagged as high risk. What should the analyst configure to automatically block such activity?

Accepted Answer

Configure a session policy. Session policies in Microsoft Defender for Cloud Apps provide real-time control over user activities, including blocking downloads based on risk level. Option A is incorrect because app permissions manage consent, not real-time monitoring. Option B is incorrect because file policies are for static file classification. Option D is incorrect because access policies control initial access, not ongoing session activities.

Answer

Configure a file policy

Answer

Configure an access policy

Answer

Configure an app permission policy

Question 12

A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Highly Confidential' sensitivity label to emails containing a specific credit card pattern. Which solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention policies include rules that can automatically apply sensitivity labels based on sensitive info types like credit card numbers. Option A is incorrect because Microsoft Purview Audit only logs activities. Option B is incorrect because Microsoft Defender for Cloud Apps focuses on app access control. Option D is incorrect because Microsoft Sentinel is for SIEM/SOAR.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Audit

Question 13

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a passcode can access corporate email. What should you configure?

Accepted Answer

Device compliance policy. Compliance policies in Intune define the conditions devices must meet to be considered compliant, such as requiring a passcode. Conditional Access policies then enforce access based on compliance. Option B is incorrect because app protection policies manage data within apps, not device-level requirements. Option C is incorrect because device configuration policies set device settings but do not enforce compliance. Option D is incorrect because enrollment restrictions control which devices can enroll.

Answer

Device configuration policy

Answer

Enrollment restrictions

Answer

App protection policy

Question 14

A company uses Microsoft Sentinel for security operations. They want to automatically create an incident and assign it to a senior analyst when a high-severity alert is generated. Which feature should they use?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents, including creating incidents, assigning them, and running playbooks. Option A is incorrect because analytics rules generate alerts, not manage incident actions. Option B is incorrect because playbooks are triggered by automation rules but don't create incidents themselves. Option D is incorrect because workbooks provide visualization, not automation.

Answer

Analytics rule

Answer

Workbook

Answer

Playbook

Question 15

Your organization uses Microsoft Entra ID. You need to allow external users from a specific partner tenant to access a single internal application, but only after they provide a phone number for verification. What should you configure?

Accepted Answer

Cross-tenant access settings for the partner tenant. Cross-tenant access settings allow you to trust MFA and device compliance from external tenants. By configuring inbound access settings, you can require that the partner tenant's users meet your MFA requirements (phone verification). Option B is incorrect because B2B collaboration settings control invitation, not authentication requirements. Option C is incorrect because Conditional Access policies apply to your tenant but cannot directly enforce MFA on external users without cross-tenant trust. Option D is incorrect because identity protection is for risk detection, not MFA enforcement.

Answer

B2B collaboration invitation settings

Answer

Conditional Access policy for the application

Answer

Identity Protection policy