SC-900 Describe the capabilities of Microsoft security solutions Practice Test 29 — 15 Questions

Question 1

A company uses Microsoft Intune for mobile device management (MDM). They need to ensure that corporate data on personal devices is encrypted. Which configuration profile type should they deploy?

Accepted Answer

Device restrictions profile. Device restrictions profiles include settings for encryption. For iOS, this includes 'Encrypt device' setting. Option A is wrong because it's for email; Option B is wrong because it's for certificates; Option D is wrong because it's for compliance.

Answer

Email profile

Answer

Certificate profile

Answer

Compliance policy

Question 2

A company uses Microsoft Defender for Cloud to secure its Azure resources. The security team wants to receive a single recommendation for all resources that are missing just-in-time (JIT) VM access. Which Microsoft Defender for Cloud feature should they use?

Accepted Answer

Security recommendations. Security recommendations in Defender for Cloud provide a list of best practices like enabling JIT. Option A is wrong because it's for alerts; Option B is wrong because it's for compliance; Option D is wrong because it's for inventory.

Answer

Regulatory compliance dashboard

Answer

Inventory

Answer

Security alerts

Question 3

A company uses Microsoft Purview Information Protection to classify and label sensitive documents. The compliance team wants to automatically apply a 'Confidential' label to documents containing an employee's passport number. Which method should they use?

Accepted Answer

Auto-labeling policy. Auto-labeling in Microsoft Purview uses sensitive info types to automatically apply labels based on content. Option B is wrong because it's manual; Option C is wrong because it's for classification, not labeling; Option D is wrong because it's for DLP.

Answer

Manual labeling by users

Answer

Trainable classifiers

Answer

DLP policy

Question 4

A company uses Microsoft Sentinel as its SIEM. They need to create a custom analytics rule that runs every hour and queries for failed logins from a specific IP address. Which rule scheduling option should they configure?

Accepted Answer

Run every 1 hour with a 1-hour query period. Analytics rules in Sentinel have run frequency and query period. Option A is wrong because it's too frequent; Option B is correct but the query period should be set to cover the data; Option C is wrong because it's for over a day; Option D is wrong because it's for real-time.

Answer

Run every 5 minutes with a 5-minute query period

Answer

Run every 24 hours with a 24-hour query period

Answer

Run every 1 hour with a 5-minute query period

Question 5

Which TWO are capabilities of Microsoft Defender for Cloud Apps? (Choose two.)

Accepted Answer

Session control to monitor user activity in cloud apps. Option D is correct because Microsoft Defender for Cloud Apps includes session control capabilities, which allow administrators to monitor and control user activity in real time within cloud applications. This is achieved through reverse proxy integration, enabling granular access policies and data loss prevention (DLP) actions during active sessions.

Answer

Endpoint detection and response (EDR)

Answer

Identity protection for user accounts

Answer

Data classification of on-premises files

Question 6

Which THREE are features of Microsoft Purview Data Lifecycle Management (formerly Records Management)? (Choose three.)

Accepted Answer

Retention policies. Data Lifecycle Management includes retention labels, retention policies, and disposition review. Option A is for Information Protection; Option E is for Microsoft 365 compliance center general features.

Answer

Data loss prevention

Answer

Sensitivity labels

Question 7

Which TWO are capabilities of Microsoft Intune? (Choose two.)

Accepted Answer

Mobile application management (MAM). Intune provides mobile device management (MDM) and mobile application management (MAM). Option C is for Microsoft Purview; Option D is for Microsoft Defender for Cloud; Option E is for Microsoft Entra ID.

Answer

Identity protection

Answer

Security posture management

Answer

Data loss prevention

Question 8

Your organization recently deployed Microsoft Defender for Cloud Apps. You need to identify which users are using a personal Dropbox account to access corporate files. Which feature should you use?

Accepted Answer

Cloud Discovery. Option B is correct because Cloud Discovery identifies shadow IT usage, such as personal Dropbox. Option A is incorrect because file policies are for DLP, not discovery. Option C is incorrect because app permissions focus on OAuth apps. Option D is incorrect because activity policies monitor activities but do not discover apps.

Answer

Activity policies

Answer

File policies

Answer

App permissions

Question 9

Your company uses Microsoft Defender for Endpoint. A security analyst reports that a device is showing multiple alerts for the same malware variant, but the alerts are being automatically suppressed after the initial detection. What is the most likely reason for this behavior?

Accepted Answer

Alert suppression is enabled to reduce noise from repeated detections. Option C is correct because alert suppression is a built-in feature to reduce alert fatigue for repeated detections. Option A is incorrect because suppression is not due to low severity—it's based on duplicate detection. Option B is incorrect because automatic investigation and remediation may run, but suppression is separate. Option D is incorrect because suppression is not a configuration error.

Answer

The alerts are classified as low severity

Answer

The device is not properly onboarded to Microsoft Defender for Endpoint

Answer

Automatic investigation and remediation resolved the alerts

Question 10

You need to ensure that sensitive documents in Microsoft SharePoint Online are automatically classified and protected when they contain credit card numbers. What should you configure?

Accepted Answer

A sensitivity label with auto-labeling for Microsoft Purview Information Protection. Option A is correct because a sensitivity label with auto-labeling can be configured to detect sensitive info types like credit card numbers. Option B is incorrect because retention labels manage retention, not protection. Option C is incorrect because DLP policies can block or alert but do not apply labels automatically. Option D is incorrect because a retention policy is for retention, not classification.

Answer

A retention policy for SharePoint

Answer

A data loss prevention (DLP) policy

Answer

A retention label for regulatory compliance

Question 11

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a user fails to sign in more than five times within an hour. Which rule type should you use?

Accepted Answer

Scheduled query rule. Option D is correct because scheduled query rules allow custom KQL queries and can trigger based on conditions like count of events. Option A is incorrect because NRT rules are for near-real-time, but scheduled rules are more appropriate for aggregation. Option B is incorrect because fusion rules use machine learning for multistage attacks. Option C is incorrect because ML behavioral analytics detect anomalies, not fixed thresholds.

Answer

Fusion rule

Answer

Near-real-time (NRT) analytics rule

Answer

Machine learning (ML) behavioral analytics rule

Question 12

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud Apps alert. Based on the evidence, which action should you take first?

Accepted Answer

Request file upload for analysis. Option B is correct because the evidence shows a suspicious file, and requesting file upload for analysis is a standard first step. Option A is incorrect because isolating the device may escalate unnecessarily. Option C is incorrect because suspending the user is premature. Option D is incorrect because marking as benign without investigation is risky.

Answer

Mark the alert as benign

Answer

Suspend the user account

Answer

Isolate the device immediately

Question 13

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

A conditional access policy in Microsoft Entra ID. Option C is correct because conditional access policies in Microsoft Entra ID can require compliant devices. Option A is incorrect because compliance policies define compliance but do not enforce access. Option B is incorrect because in Azure AD, now Entra ID, it's conditional access. Option D is incorrect because the Microsoft 365 admin center does not configure device compliance enforcement.

Answer

An app protection policy in Microsoft 365 admin center

Answer

A conditional access policy in Azure AD

Answer

A device compliance policy in Intune

Question 14

Your company uses Microsoft Purview Data Lifecycle Management. You need to automatically delete all emails in users' mailboxes that are older than three years, except for emails that have a legal hold. What should you configure?

Accepted Answer

A retention policy with a retention action of 'Delete items' and an adaptive scope for Exchange mailboxes. Option A is correct because a retention policy with retention action 'Delete items' and an adaptive scope can target all mailboxes. Option B is incorrect because a retention label with auto-labeling is for classification, not automatic deletion. Option C is incorrect because a DLP policy does not delete items. Option D is incorrect because a sensitivity label does not delete items.

Answer

A data loss prevention (DLP) policy for Exchange

Answer

A retention label with auto-labeling for all Exchange emails

Answer

A sensitivity label with mandatory labeling

Question 15

Your organization uses Microsoft Defender XDR (formerly Microsoft 365 Defender). A user reports receiving a suspicious email with a link. The email was not blocked by Exchange Online Protection (EOP). Which feature should you use to investigate the link's reputation in real time?

Accepted Answer

Safe Links policy. Option B is correct because Safe Links in Defender for Office 365 provides real-time link protection and investigation. Option A is incorrect because Safe Attachments is for file attachments. Option C is incorrect because anti-phish policies handle phishing detection but not link investigation. Option D is incorrect because EOP is the baseline but not for real-time link analysis.

Answer

Exchange Online Protection (EOP) filtering

Answer

Anti-phish policy

Answer

Safe Attachments policy