SC-900 Describe the capabilities of Microsoft security solutions Practice Test 27 — 15 Questions

Question 1

A company wants to classify and label documents in SharePoint automatically based on sensitive content like social security numbers. Which Microsoft Purview solution should they use?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview automatically apply sensitivity labels to documents in SharePoint based on sensitive info types. Option B is incorrect because data loss prevention policies can apply labels but are primarily for preventing data leaks. Option C is incorrect because audit logs activities. Option D is incorrect because eDiscovery is for searching and exporting data.

Answer

eDiscovery

Answer

Audit log

Answer

Data loss prevention policy

Question 2

Your organization uses Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from their CEO asking for a wire transfer. The email passed through the spam filter. What additional protection should be enabled to detect such attacks?

Accepted Answer

Impersonation protection in anti-phishing policy. Impersonation protection in Microsoft Defender for Office 365 specifically detects emails that impersonate executives or domains. It can be configured in anti-phishing policies. Option A is incorrect because safe attachments protect against malicious attachments, not impersonation. Option B is incorrect because safe links protect against malicious URLs. Option C is incorrect because anti-spam policies filter bulk mail, not targeted impersonation.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Safe Links policy

Question 3

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from copying credit card numbers from an internal web application to a personal cloud storage app. Which DLP policy setting should they configure?

Accepted Answer

Endpoint DLP with clipboard control. Endpoint DLP policies can monitor and control clipboard operations, including copying sensitive data to unallowed apps. Option A is incorrect because browser DLP only covers browser-based activities. Option C is incorrect because email DLP covers email. Option D is incorrect because Teams DLP covers Teams chats and channels.

Answer

Browser DLP

Answer

Exchange DLP

Answer

Teams DLP

Question 4

Your organization wants to use Microsoft Entra ID to require multi-factor authentication (MFA) for all users when accessing a financial application. What should you configure?

Accepted Answer

Conditional Access policy. Conditional Access policies allow you to enforce MFA based on application and user conditions. Option B is incorrect because MFA registration policy only enforces registration, not usage. Option C is incorrect because identity protection focuses on risk. Option D is incorrect because per-user MFA is a legacy method; Conditional Access is the modern approach.

Answer

Identity Protection policy

Answer

Per-user MFA

Answer

MFA registration policy

Question 5

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Session controls for real-time monitoring of app usage. Microsoft Defender for Cloud Apps provides cloud app discovery (shadow IT) and session controls for real-time monitoring. Option B is incorrect because device management is Intune. Option D is incorrect because email security is Defender for Office 365. Option E is incorrect because device compliance is Intune and Conditional Access.

Answer

Mobile device management

Answer

Device compliance enforcement

Answer

Email filtering and anti-phishing

Question 6

Which THREE Microsoft Purview solutions help protect sensitive data in Microsoft 365? (Choose three.)

Accepted Answer

Data Loss Prevention. Microsoft Purview Data Loss Prevention, Information Protection (sensitivity labels), and Insider Risk Management all help protect sensitive data. Option B is incorrect because Audit is for logging, not protection. Option D is incorrect because eDiscovery is for discovery, not protection.

Answer

Audit

Answer

eDiscovery

Question 7

Which TWO Microsoft security solutions can be used to detect and respond to threats across email, endpoints, and identities? (Choose two.)

Accepted Answer

Microsoft Sentinel. Microsoft Defender XDR (extended detection and response) and Microsoft Sentinel (SIEM/SOAR) can integrate signals across email, endpoints, and identities. Option A is incorrect because Defender for Cloud Apps focuses on cloud apps. Option C is incorrect because Intune is for management. Option E is incorrect because Purview is for data protection, not threat detection.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview

Question 8

Refer to the exhibit. You are a security administrator for a company using Azure Virtual Network Manager. You have deployed the security admin configuration shown. What is the impact of this rule?

Accepted Answer

It blocks inbound SMB traffic from the internet to the subnet.. The rule denies inbound TCP traffic on port 445 (SMB) from the Internet to the subnet 10.0.0.0/24. This blocks external SMB access, preventing common ransomware propagation. Option A is incorrect because port 445 is SMB, not RDP (3389). Option C is incorrect because direction is inbound. Option D is incorrect because it denies all traffic only on port 445, not all ports.

Answer

It blocks outbound traffic from the subnet to the internet.

Answer

It denies all traffic from the internet to the subnet.

Answer

It blocks inbound RDP traffic from the internet.

Question 9

Refer to the exhibit. You are a security analyst using Microsoft Sentinel. You run this KQL query. What does the query return?

Accepted Answer

Incident IDs for high-severity alerts that have an open incident.. The query returns incident IDs for high-severity alerts that have an associated incident that is not closed. Option A is incorrect because it returns incidents with status not closed, not all. Option B is incorrect because it filters high severity. Option C is incorrect because it joins alerts with incidents, not just alerts without incidents.

Answer

High-severity alerts that do not have an incident assigned.

Answer

High-severity alerts that were closed within the last hour.

Answer

All incidents created in the last hour.

Question 10

Refer to the exhibit. You are configuring a Microsoft Entra ID group. What does the exhibit represent?

Accepted Answer

A dynamic security group based on department attribute.. The JSON shows a dynamic group in Microsoft Entra ID with a membership rule that includes users whose department equals 'Marketing'. Option A is incorrect because it's a dynamic group, not assigned. Option C is incorrect because it's a security group, not a Microsoft 365 group (no mailEnabled). Option D is incorrect because the rule is for department, not location.

Answer

A Microsoft 365 group with dynamic membership.

Answer

A dynamic group based on user location.

Answer

A static security group with assigned members.

Question 11

Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous user behavior such as impossible travel. Which type of policy should you configure?

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Defender for Cloud Apps use UEBA to detect behaviors like impossible travel, ransomware activity, and credential access. Option A is correct. Activity policies are used for specific activities, not behavior patterns. Session policies control real-time access. App discovery policies identify cloud apps in use.

Answer

Activity policy

Answer

App discovery policy

Answer

Session policy

Question 12

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. You need to ensure that when a user attempts to share a document containing a credit card number via email, the email is blocked and the user receives a policy tip. Which action should you configure in the DLP policy?

Accepted Answer

Block with user notification. In Microsoft Purview DLP, the 'Block' action with user notification sends a policy tip and blocks the email. 'Block override' allows override with justification. 'Audit only' logs without blocking. 'Notify user' sends an email but does not block. Option B is correct because it blocks the email and shows a policy tip.

Answer

Notify user

Answer

Audit only

Answer

Block override

Question 13

Refer to the exhibit. You are reviewing a policy in Microsoft Defender for Cloud that monitors for unencrypted data uploads to an S3 bucket. The policy condition is shown. Which statement about this policy is correct?

Accepted Answer

The policy enforces encryption for objects uploaded to the 'documents' bucket.. The condition specifies that the request must have server-side encryption set to AES256. This is a security control to ensure data is encrypted at rest. The policy restricts uploads without encryption, but it allows uploads with AES256 encryption. The resource is a wildcard under the 'documents' bucket. Option D correctly states that the policy applies to objects in the 'documents' bucket.

Answer

The policy applies to all S3 buckets in the account.

Answer

The policy requires encryption with AWS KMS.

Answer

The policy denies all uploads to the bucket.

Question 14

Your organization uses Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing the company's financial application. Which security feature should you use?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA based on conditions like application, user, or location. Identity Protection detects risks but does not enforce access. Privileged Identity Management (PIM) manages roles. Security defaults provide a baseline but do not allow per-application granularity. Option C is correct.

Answer

Security defaults

Answer

Privileged Identity Management

Answer

Identity Protection

Question 15

Your organization uses Microsoft Sentinel. You need to create an automation rule that automatically closes a low-severity incident after 24 hours of inactivity. Which action should you include in the rule?

Accepted Answer

Change status to Closed. Automation rules in Microsoft Sentinel can change incident status. The 'Change status' action can set an incident to 'Closed'. 'Run playbook' triggers a playbook but does not close directly. 'Create incident' creates a new incident. 'Add comment' adds a comment. Option B is correct to change status to closed.

Answer

Run playbook

Answer

Create incident

Answer

Add comment