SC-900 Describe the capabilities of Microsoft security solutions Practice Test 27 — 15 Questions

Question 1

A security administrator needs to identify users who are repeatedly failing to authenticate from unusual locations. Which Microsoft 365 security feature provides this visibility?

Accepted Answer

Microsoft Entra ID Protection. Microsoft Entra ID Protection (formerly Azure AD Identity Protection) detects and reports risky sign-in behaviors, including repeated authentication failures from unusual locations. It uses machine learning models to evaluate sign-in risk based on factors like unfamiliar IP addresses, anonymous IP addresses, and atypical travel patterns, providing security administrators with visibility into such anomalies.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 2

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a compliant antivirus solution can access corporate email. Which policy type should be configured?

Accepted Answer

Conditional Access policy in Microsoft Entra ID. Conditional Access policies in Microsoft Entra ID evaluate signals such as device compliance status before granting access to cloud apps like corporate email. By integrating with Intune device compliance policies, they can block access from devices that lack a compliant antivirus solution. This is the correct mechanism because Conditional Access enforces the access decision at the authentication layer, not just at the device management layer.

Answer

App protection policy in Microsoft 365

Answer

Device compliance policy in Intune

Answer

Security baseline in Microsoft Defender for Cloud

Question 3

A company uses Microsoft Sentinel as its SIEM. The security team wants to automatically trigger a playbook when a high-severity incident is created. Which automation option should be used?

Accepted Answer

Automation rule in Microsoft Sentinel. Microsoft Sentinel automation rules are specifically designed to trigger automated responses—such as running playbooks—based on incident creation or update conditions, including severity level. When a high-severity incident is created, an automation rule can invoke a playbook without requiring manual intervention or external orchestration.

Answer

Azure Policy assignment

Answer

Microsoft Power Automate flow directly from Sentinel

Answer

Azure Logic Apps HTTP trigger

Question 4

A multinational corporation needs to restrict data sharing in Microsoft Teams to comply with regional regulations. Users must not be able to share files with external domains from specific departments. What should the administrator configure?

Accepted Answer

Sensitivity labels with container management in Microsoft Purview. Sensitivity labels with container management in Microsoft Purview allow administrators to configure external sharing restrictions for Microsoft Teams, SharePoint, and Groups. By applying a sensitivity label to a team, you can block external sharing for specific departments, ensuring compliance with regional regulations. This is the correct solution because it directly controls sharing behavior at the container level based on the label's settings.

Answer

Microsoft Intune device compliance policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Data Loss Prevention (DLP) policy in Microsoft Purview

Question 5

A security analyst needs to investigate a potential data exfiltration incident involving sensitive files being sent via email. Which Microsoft Purview solution provides the necessary monitoring?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it provides real-time monitoring and policy-based enforcement to detect and block sensitive files (e.g., credit card numbers, PII) from being sent via email. DLP policies can inspect email content and attachments in transit, triggering alerts or blocking the message to prevent data exfiltration.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Purview Audit

Question 6

An organization uses Microsoft Defender for Cloud to secure its Azure workloads. They want to receive recommendations for improving the security posture of their virtual machines. What should they enable?

Accepted Answer

Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM). Microsoft Defender for Cloud's Cloud Security Posture Management (CSPM) provides continuous assessment of Azure workloads, including virtual machines, against security baselines and best practices. It generates actionable recommendations to improve the security posture, such as applying missing system updates or enabling encryption. This is the correct feature for receiving VM-specific security recommendations.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Answer

Azure Policy

Question 7

A company has deployed Microsoft Defender for Identity and wants to detect pass-the-hash attacks in real time. Which alert type should they monitor?

Accepted Answer

Suspected Pass-the-Hash attack. Microsoft Defender for Identity specifically detects pass-the-hash attacks by monitoring anomalous NTLM authentication patterns, such as the use of hashed credentials from one machine to authenticate to another. The 'Suspected Pass-the-Hash attack' alert is triggered when Defender for Identity identifies a hash being reused across multiple devices in a way that indicates lateral movement, which is the core behavior of a pass-the-hash attack.

Answer

Suspected Kerberoasting attack

Answer

Suspected Brute Force attack

Answer

Suspected Golden Ticket attack

Question 8

What is the primary purpose of Microsoft Defender for Cloud Apps?

Accepted Answer

Secure cloud applications and data. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides visibility, data controls, and threat protection for cloud applications and data. Its primary purpose is to secure cloud apps (like Microsoft 365, Salesforce, or Dropbox) by enforcing policies, detecting anomalous behavior, and preventing data exfiltration, not to manage network traffic, mobile devices, or on-premises servers.

Answer

Monitor network traffic

Answer

Manage mobile devices

Answer

Protect on-premises servers

Question 9

Which TWO of the following are capabilities of Microsoft Purview Information Protection? (Choose two.)

Accepted Answer

Classify and label sensitive data. Microsoft Purview Information Protection (MIP) enables organizations to classify and label sensitive data based on content inspection and policy rules. It also applies encryption and usage restrictions directly through sensitivity labels, ensuring data is protected regardless of where it is stored or shared.

Answer

Block external sharing of files

Answer

Detect malware in email attachments

Answer

Monitor user activities in real-time

Question 10

Which TWO of the following are features of Microsoft Sentinel? (Choose two.)

Accepted Answer

Security Information and Event Management (SIEM). Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that collects and analyzes security data from across an enterprise. It also provides Security Orchestration, Automation, and Response (SOAR) capabilities through built-in playbooks and automation rules, enabling automated incident response. These two core functions—SIEM and SOAR—are explicitly listed as features of Sentinel.

Answer

Data loss prevention

Answer

Endpoint detection and response

Answer

Identity governance

Question 11

Refer to the exhibit. The JSON shows a Microsoft Purview DLP policy. A user sends an email with a credit card number to an external recipient. What will happen?

Accepted Answer

The email is blocked and the user receives a notification.. The DLP policy in the exhibit has a condition that detects credit card numbers and an action set to 'BlockMessage' with 'NotifyUser' enabled. Since the policy is configured for Exchange (email) and the action blocks the message, the email is blocked and the user receives a notification. The 'TeamsChatAndChannel' property being false is irrelevant because the policy is applied to Exchange, not Teams.

Answer

The email is delivered normally because TeamsChatAndChannel is false.

Answer

The email is delivered but an alert is generated.

Answer

The email is encrypted before delivery.

Question 12

Refer to the exhibit. The KQL query is run in Microsoft Defender for Endpoint. What is the purpose of this query?

Accepted Answer

To find devices with a high number of operations on potentially sensitive files.. The KQL query filters for `DeviceFileEvents` where `SensitivityLabel` is not empty, indicating files with sensitivity labels applied (e.g., confidential, internal). It then summarizes the count of operations per device and orders by the highest count. This identifies devices with a high number of operations on potentially sensitive files, aligning with data loss prevention (DLP) monitoring.

Answer

To list all devices that have files named confidential.

Answer

To detect malware on devices.

Answer

To list all file creation events.

Question 13

Refer to the exhibit. A company has configured the above Conditional Access policy in Microsoft Entra ID. A user attempts to access Exchange Online from an untrusted location. What happens?

Accepted Answer

The user is granted access without MFA because the policy does not apply.. The Conditional Access policy shown in the exhibit is configured with 'Include: All users' and 'Exclude: All users'. When both include and exclude are set to 'All users', the exclusion takes precedence, effectively making the policy apply to no users. Therefore, when a user attempts to access Exchange Online from an untrusted location, the policy does not apply, and the user is granted access without MFA.

Answer

Access is blocked because the condition is not met.

Answer

The user is prompted for MFA because the policy applies to all users.

Answer

The user is blocked because the grant requires MFA.

Question 14

Your organization uses Microsoft Defender for Cloud Apps. A security analyst notices anomalous file downloads from a SharePoint site by a user flagged as high risk. What should the analyst configure to automatically block such activity?

Accepted Answer

Configure a session policy. Session policies in Microsoft Defender for Cloud Apps allow real-time monitoring and control of user activities based on risk level. When a user is flagged as high risk, a session policy can be configured to automatically block anomalous file downloads from SharePoint by intercepting the session and applying actions such as block, allow, or restrict. This is the correct choice because it directly addresses the need to prevent the specific activity in real time.

Answer

Configure a file policy

Answer

Configure an access policy

Answer

Configure an app permission policy

Question 15

A company is implementing Microsoft Purview Information Protection. They want to automatically apply a 'Highly Confidential' sensitivity label to emails containing a specific credit card pattern. Which solution should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention. Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it can automatically apply sensitivity labels to emails based on content inspection, such as detecting credit card patterns using built-in sensitive info types. DLP policies can be configured to classify and label messages in transit in Exchange Online, ensuring the 'Highly Confidential' label is applied before the email leaves the organization.

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview Audit