SC-900 Describe the capabilities of Microsoft security solutions Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. You run an Advanced Hunting query in Microsoft Defender XDR. What is the primary purpose of this query?

Accepted Answer

Identify accounts with high number of interactive logons, potentially indicating brute-force activity.. The query filters for interactive logon events to Office 365 over the past 7 days, groups by user and IP, and counts occurrences. It then filters for accounts with more than 10 logon events, which helps identify accounts with unusually high logon activity, potentially indicating brute-force attacks or compromised accounts. Option A is correct.

Answer

Find IP addresses with failed logon attempts.

Answer

List all interactive logons from Office 365 applications.

Answer

Detect non-interactive logons to Office 365.

Question 2

Your organization uses Microsoft Purview Communication Compliance to detect potential harassment in Microsoft Teams messages. Which role is required to review and act on policy matches?

Accepted Answer

Communication Compliance analyst. Communication Compliance roles: 'Communication Compliance admin' can create policies, 'Communication Compliance analyst' can review and act on matches, 'Communication Compliance investigator' has additional remediation capabilities, 'Compliance administrator' has broader compliance admin rights. Option B is correct for reviewing matches.

Answer

Communication Compliance admin

Answer

Communication Compliance investigator

Answer

Compliance administrator

Question 3

Your organization uses Microsoft Intune for mobile device management. You need to ensure that users cannot copy corporate data from managed apps to personal apps. Which policy should you configure?

Accepted Answer

App Protection Policy. App Protection Policies (APP) in Intune protect data at the app level, with settings like 'Allow app to transfer data to other apps' set to 'None' or 'Policy managed apps only'. Compliance policies enforce device compliance. Configuration policies configure app settings. Conditional Access can require managed apps but does not restrict data transfer. Option A is correct.

Answer

App Configuration Policy

Answer

Device Compliance Policy

Answer

Conditional Access Policy

Question 4

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy JSON snippet. The policy is enabled and contains one rule. What is the effect of this rule?

Accepted Answer

Blocks access to content containing a credit card number in Exchange and SharePoint, without user notification.. The rule detects credit card numbers in Exchange Online and SharePoint Online. The action 'BlockAccess' will block access to the content. The rule does not include user notification, so users will not receive a policy tip. The policy applies to all users (no user filter). Option A correctly describes this.

Answer

Applies only to SharePoint, not Exchange.

Answer

Only audits the activity, does not block.

Answer

Blocks access and sends a policy tip to users.

Question 5

Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps? (Choose TWO.)

Accepted Answer

Session control. Microsoft Defender for Cloud Apps provides cloud discovery (identifying cloud apps in use), and session control (real-time monitoring and control of app sessions). Information protection is part of Microsoft Purview, not Defender for Cloud Apps. Vulnerability management is part of Defender for Endpoint. Threat intelligence is from Microsoft Sentinel or Defender Threat Intelligence.

Answer

Vulnerability management

Answer

Threat intelligence

Answer

Information protection

Question 6

Which THREE Microsoft Purview solutions support data classification and labeling? (Choose THREE.)

Accepted Answer

Information Protection. Microsoft Purview Information Protection handles classification and labeling of data. Data Loss Prevention uses labels to enforce policies. Data Lifecycle Management uses labels for retention and deletion. Communication Compliance monitors communications but does not directly classify or label data. Insider Risk Management identifies risky activities but does not classify data.

Answer

Insider Risk Management

Answer

Communication Compliance

Question 7

Which TWO Microsoft security solutions can be used to centrally manage security policies across hybrid environments including on-premises and cloud? (Choose TWO.)

Accepted Answer

Microsoft Sentinel. Microsoft Defender for Cloud provides unified security management across multicloud and on-premises. Microsoft Sentinel is a SIEM/SOAR that aggregates security data from various sources. Defender for Cloud Apps focuses on SaaS applications. Defender for Office 365 protects email. Intune manages endpoints. Defender for Cloud and Sentinel work across hybrid environments.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Question 8

Which THREE capabilities are provided by Microsoft Defender XDR? (Choose THREE.)

Accepted Answer

Advanced hunting. Microsoft Defender XDR provides incident management (correlated alerts), automated investigation and response (self-healing), and advanced hunting (KQL queries). Vulnerability management is part of Defender for Endpoint, not the XDR platform. Cloud security posture management is from Defender for Cloud. Defender XDR is for cross-domain threat protection.

Answer

Cloud security posture management

Answer

Vulnerability management

Question 9

Which TWO Microsoft Purview solutions can help identify and protect sensitive data in Microsoft Teams? (Choose TWO.)

Accepted Answer

Information Protection. Data Loss Prevention (DLP) can scan Teams messages for sensitive data and block sharing. Information Protection applies sensitivity labels to content in Teams. Insider Risk Management detects risky activities but does not directly identify or protect data. Communication Compliance monitors for policy violations. Data Lifecycle Management manages retention, not protection.

Answer

Communication Compliance

Answer

Data Lifecycle Management

Answer

Insider Risk Management

Question 10

Which THREE are features of Microsoft Entra ID Protection? (Choose THREE.)

Accepted Answer

Sign-in risk detection. Sign-in risk detection is a core feature of Microsoft Entra ID Protection. It uses real-time and offline machine learning models to evaluate each sign-in attempt for anomalies such as impossible travel, anonymous IP addresses, or atypical locations, assigning a risk level (low, medium, high). This allows organizations to automatically respond to suspicious sign-ins before compromise occurs.

Answer

Privileged role management

Answer

Identity governance

Question 11

A company uses Microsoft Defender for Cloud Apps to protect its SaaS apps. The security team needs to detect when a user downloads more than 100 files from SharePoint Online within 10 minutes. Which policy type should they create?

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Defender for Cloud Apps use behavioral analytics to detect unusual patterns like mass file download. Activity policy is for specific activities, but anomaly detection is better for this scenario. Option A is wrong because it's a generic term; Option B is wrong because it's for threat detection; Option D is wrong because it's for compliance.

Answer

Activity policy

Answer

Threat detection policy

Answer

Compliance policy

Question 12

A security analyst receives an alert from Microsoft Sentinel indicating a potential ransomware attack. The analyst needs to quickly understand the full scope of the attack, including all affected accounts and devices. Which Microsoft Sentinel feature should they use?

Accepted Answer

Incident investigation. Incident investigation in Microsoft Sentinel provides a visual graph of entities and relationships, helping to understand the attack scope. Option A is wrong because Workbooks are for reporting; Option B is wrong because Playbooks are for automation; Option D is wrong because Analytics rules are for creating alerts.

Answer

Analytics rules

Answer

Workbooks

Answer

Playbooks

Question 13

A company deploys Microsoft Entra ID Protection. The security team wants to automatically block sign-ins from anonymous IP addresses. They configure a Conditional Access policy. Which assignment condition should they use?

Accepted Answer

Sign-in risk level condition with 'High'. Entra ID Protection provides risk detections like 'Anonymous IP address'. Conditional Access can use this as a condition. Option A is wrong because it's too broad; Option B is wrong because it's for compliance; Option D is wrong because it's for device trust.

Answer

User risk level condition with 'Medium'

Answer

Device condition with 'Compliant'

Answer

Location condition with 'Any IP'

Question 14

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to ensure that when a user tries to share a document containing a credit card number externally via email, the user sees a policy tip and the email is blocked. Which DLP rule action should they configure?

Accepted Answer

Block the message and notify the user with a policy tip. DLP rules can have actions like 'Block' and 'Notify user with policy tip'. Option A is wrong because it doesn't block; Option B is wrong because it doesn't notify; Option D is wrong because it doesn't block.

Answer

Notify user with policy tip only

Answer

Block the message only

Answer

Redirect the message to the compliance admin

Question 15

A company wants to use Microsoft Defender for Office 365 to protect against malicious links in email. Which feature should they enable?

Accepted Answer

Safe Links. Safe Links is the Defender for Office 365 feature that provides time-of-click protection against malicious URLs. Option A is wrong because it's for attachments; Option C is wrong because it's for anti-malware; Option D is wrong because it's for anti-spam.

Answer

Safe Attachments

Answer

Anti-malware policy

Answer

Anti-spam policy

SC-900 Describe the capabilities of Microsoft security solutions Practice Test 28 — 15 Questions

Exhibit

SC-900 Describe the capabilities of Microsoft security solutions Practice Test 28 — 15 Questions

Exhibit