SC-900 Describe the capabilities of Microsoft security solutions Practice Test 28 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a passcode can access corporate email. What should you configure?

Accepted Answer

Device compliance policy. A device compliance policy in Microsoft Intune evaluates device settings, such as requiring a passcode, and marks devices as noncompliant if they lack one. Conditional Access policies can then block noncompliant devices from accessing corporate email, ensuring only compliant devices with a passcode are allowed.

Answer

Device configuration policy

Answer

Enrollment restrictions

Answer

App protection policy

Question 2

A company uses Microsoft Sentinel for security operations. They want to automatically create an incident and assign it to a senior analyst when a high-severity alert is generated. Which feature should they use?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to automatically trigger incident creation, assignment, and other actions when an alert is generated. By configuring an automation rule with a condition for high-severity alerts, you can set it to create an incident and assign it to a specific senior analyst, streamlining the response process.

Answer

Analytics rule

Answer

Workbook

Answer

Playbook

Question 3

A company wants to classify and label documents in SharePoint automatically based on sensitive content like social security numbers. Which Microsoft Purview solution should they use?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview can automatically detect sensitive content such as social security numbers in SharePoint documents and apply the appropriate sensitivity label. This enables consistent classification and protection without manual user intervention, directly meeting the company's requirement.

Answer

eDiscovery

Answer

Audit log

Answer

Data loss prevention policy

Question 4

Your organization uses Microsoft Defender for Office 365. A user reports receiving a suspicious email that appears to be from their CEO asking for a wire transfer. The email passed through the spam filter. What additional protection should be enabled to detect such attacks?

Accepted Answer

Impersonation protection in anti-phishing policy. The attack described is a business email compromise (BEC) or CEO fraud, which relies on impersonation rather than malicious links or attachments. Microsoft Defender for Office 365's anti-phishing policy includes impersonation protection that specifically detects and mitigates attempts where a sender spoofs a high-profile user (like the CEO) or domain. Enabling impersonation protection in the anti-phishing policy is the correct additional safeguard because the email passed the spam filter, indicating it was not a bulk or malware-based threat.

Answer

Safe Attachments policy

Answer

Anti-spam policy

Answer

Safe Links policy

Question 5

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from copying credit card numbers from an internal web application to a personal cloud storage app. Which DLP policy setting should they configure?

Accepted Answer

Endpoint DLP with clipboard control. Endpoint DLP with clipboard control is the correct setting because it monitors and restricts data movement at the device level, specifically preventing users from copying sensitive content (like credit card numbers) from a web application and pasting it into an unauthorized personal cloud storage app. This policy enforces restrictions on clipboard operations between different applications on the endpoint, directly addressing the cross-application data exfiltration scenario described.

Answer

Browser DLP

Answer

Exchange DLP

Answer

Teams DLP

Question 6

Your organization wants to use Microsoft Entra ID to require multi-factor authentication (MFA) for all users when accessing a financial application. What should you configure?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA based on specific conditions, such as the application being accessed (the financial app). This is the correct, modern approach to require MFA for a specific application rather than for all sign-ins globally. It provides granular control by evaluating signals like user, device, location, and application before granting access.

Answer

Identity Protection policy

Answer

Per-user MFA

Answer

MFA registration policy

Question 7

Which TWO capabilities are provided by Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Session controls for real-time monitoring of app usage. Microsoft Defender for Cloud Apps provides session controls that enable real-time monitoring and control of app usage. These controls use reverse proxy architecture to enforce policies on user activities within cloud apps, such as blocking downloads or requiring multi-factor authentication during a session.

Answer

Mobile device management

Answer

Device compliance enforcement

Answer

Email filtering and anti-phishing

Question 8

Which THREE Microsoft Purview solutions help protect sensitive data in Microsoft 365? (Choose three.)

Accepted Answer

Data Loss Prevention. Data Loss Prevention (DLP) is correct because it identifies, monitors, and automatically protects sensitive data across Exchange Online, SharePoint, OneDrive, and Teams by applying policies that block or warn users when sensitive content (e.g., credit card numbers or PII) is shared inappropriately. It uses deep content analysis, including keyword matches, regex patterns, and machine learning classifiers, to enforce protection actions.

Answer

Audit

Answer

eDiscovery

Question 9

Which TWO Microsoft security solutions can be used to detect and respond to threats across email, endpoints, and identities? (Choose two.)

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel (option D) is correct because it is a cloud-native SIEM and SOAR platform that ingests logs from across the entire environment—including email, endpoints, and identity sources—to detect and respond to threats using analytics and automated playbooks. Microsoft Defender XDR (option E) is correct because it is a unified, pre- and post-breach detection and response solution that correlates signals across email (Exchange Online), endpoints (Microsoft Defender for Endpoint), and identities (Microsoft Defender for Identity).

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Purview

Question 10

Refer to the exhibit. You are a security administrator for a company using Azure Virtual Network Manager. You have deployed the security admin configuration shown. What is the impact of this rule?

Accepted Answer

It blocks inbound SMB traffic from the internet to the subnet.. This security admin configuration in Azure Virtual Network Manager creates a rule that denies inbound traffic on port 445 (SMB) from the 'Internet' service tag to the target subnet. Since the rule has a priority of 100 (lowest number = highest priority) and the action is 'Deny', it overrides any lower-priority or default allow rules, effectively blocking inbound SMB traffic from the internet to the subnet. The rule does not affect outbound traffic or other protocols like RDP unless they are explicitly specified.

Answer

It blocks outbound traffic from the subnet to the internet.

Answer

It denies all traffic from the internet to the subnet.

Answer

It blocks inbound RDP traffic from the internet.

Question 11

Refer to the exhibit. You are configuring a Microsoft Entra ID group. What does the exhibit represent?

Accepted Answer

A dynamic security group based on department attribute.. The exhibit shows a rule syntax of `(user.department -eq "Sales")`, which is the expression used to dynamically add or remove members based on the department attribute. This is the defining characteristic of a dynamic security group in Microsoft Entra ID, where membership is evaluated automatically when user attributes change.

Answer

A Microsoft 365 group with dynamic membership.

Answer

A dynamic group based on user location.

Answer

A static security group with assigned members.

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous user behavior such as impossible travel. Which type of policy should you configure?

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning and behavioral analytics to establish a baseline of normal user activity and then flag deviations such as impossible travel (e.g., a user logging in from New York and then from London within an unrealistic time frame). This policy type is specifically designed to detect suspicious patterns like credential theft or account compromise without requiring predefined rules.

Answer

Activity policy

Answer

App discovery policy

Answer

Session policy

Question 13

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect credit card numbers. You need to ensure that when a user attempts to share a document containing a credit card number via email, the email is blocked and the user receives a policy tip. Which action should you configure in the DLP policy?

Accepted Answer

Block with user notification. In Microsoft Purview DLP, the 'Block with user notification' action sends a policy tip and blocks the email. 'Block override' allows override with justification. 'Audit only' logs without blocking. 'Notify user' sends an email but does not block. Option C is correct because it blocks the email and shows a policy tip.

Answer

Notify user

Answer

Audit only

Answer

Block override

Question 14

Your organization uses Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing the company's financial application. Which security feature should you use?

Accepted Answer

Conditional Access. Conditional Access policies in Microsoft Entra ID allow you to enforce MFA specifically for the financial application by targeting the application in the policy. This provides granular control over authentication requirements based on conditions such as user, location, device state, and application, which is exactly what is needed to secure a specific app.

Answer

Security defaults

Answer

Privileged Identity Management

Answer

Identity Protection

Question 15

Your organization uses Microsoft Sentinel. You need to create an automation rule that automatically closes a low-severity incident after 24 hours of inactivity. Which action should you include in the rule?

Accepted Answer

Change status to Closed. Changing the status to 'Closed' is the direct action needed to automatically resolve a low-severity incident after a period of inactivity in Microsoft Sentinel. Automation rules can trigger status changes based on conditions like time elapsed, and closing the incident removes it from the active queue without manual intervention.

Answer

Run playbook

Answer

Create incident

Answer

Add comment