SC-900 Describe the capabilities of Microsoft security solutions Practice Test 29 — 15 Questions

Question 1

Refer to the exhibit. You run an Advanced Hunting query in Microsoft Defender XDR. What is the primary purpose of this query?

Accepted Answer

Identify accounts with high number of interactive logons, potentially indicating brute-force activity.. The query uses `AADSignInEventsBeta` to count interactive logon events per account, then filters for accounts with more than 10 such events. A high count of interactive logons from a single account is a classic indicator of brute-force activity, where an attacker repeatedly attempts to guess credentials. This makes D correct because the query's primary purpose is to identify accounts with a suspiciously high number of interactive logons.

Answer

Find IP addresses with failed logon attempts.

Answer

List all interactive logons from Office 365 applications.

Answer

Detect non-interactive logons to Office 365.

Question 2

Your organization uses Microsoft Purview Communication Compliance to detect potential harassment in Microsoft Teams messages. Which role is required to review and act on policy matches?

Accepted Answer

Communication Compliance analyst. The Communication Compliance analyst role is specifically designed to review policy matches, investigate message details, and take remediation actions such as escalating or resolving alerts in Microsoft Purview Communication Compliance. This role has the necessary permissions to view and act on detected violations without the broader administrative privileges of a Compliance administrator.

Answer

Communication Compliance admin

Answer

Communication Compliance investigator

Answer

Compliance administrator

Question 3

Your organization uses Microsoft Intune for mobile device management. You need to ensure that users cannot copy corporate data from managed apps to personal apps. Which policy should you configure?

Accepted Answer

App Protection Policy. App Protection Policies (APP) in Microsoft Intune are designed to manage how data is handled within applications, regardless of device enrollment. By configuring a 'Save as' or 'Copy/paste' restriction between managed and unmanaged apps, you can prevent corporate data from being transferred to personal apps. This policy operates at the app layer, not the device layer, making it the correct choice for this data leakage scenario.

Answer

App Configuration Policy

Answer

Device Compliance Policy

Answer

Conditional Access Policy

Question 4

Refer to the exhibit. You are reviewing a Microsoft Purview DLP policy JSON snippet. The policy is enabled and contains one rule. What is the effect of this rule?

Accepted Answer

Blocks access to content containing a credit card number in Exchange and SharePoint, without user notification.. The JSON snippet shows a DLP rule with an action of 'BlockAccess' and 'NotifyUser' set to 'False', meaning the rule blocks access to content containing a credit card number in both Exchange and SharePoint (the locations are not restricted to a single workload). Since 'NotifyUser' is false, no policy tip or email notification is sent to the user. Therefore, the correct effect is that access is blocked without user notification, matching option D.

Answer

Applies only to SharePoint, not Exchange.

Answer

Only audits the activity, does not block.

Answer

Blocks access and sends a policy tip to users.

Question 5

Which THREE Microsoft Purview solutions support data classification and labeling? (Choose THREE.)

Accepted Answer

Information Protection. Microsoft Purview Information Protection handles classification and labeling of data. Data Loss Prevention uses labels to enforce policies. Data Lifecycle Management uses labels for retention and deletion. Communication Compliance monitors communications but does not directly classify or label data. Insider Risk Management identifies risky activities but does not classify data.

Answer

Insider Risk Management

Answer

Communication Compliance

Question 6

Which TWO Microsoft security solutions can be used to centrally manage security policies across hybrid environments including on-premises and cloud? (Choose TWO.)

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides centralized security analytics and threat intelligence across the entire enterprise, including on-premises and multi-cloud environments. It collects data from various sources via connectors (e.g., Azure Monitor Agent, Syslog, Windows Security Events) and allows security teams to manage policies, detect threats, and respond from a single pane of glass. This makes it a correct answer for centrally managing security policies across hybrid environments.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Question 7

Which THREE are features of Microsoft Entra ID Protection? (Choose THREE.)

Accepted Answer

Sign-in risk detection. Sign-in risk detection is a core feature of Microsoft Entra ID Protection. It uses real-time and offline machine learning models to evaluate each sign-in attempt for anomalies such as impossible travel, anonymous IP addresses, or atypical locations, assigning a risk level (low, medium, high). This allows organizations to automatically respond to suspicious sign-ins before compromise occurs.

Answer

Privileged role management

Answer

Identity governance

Question 8

A company uses Microsoft Defender for Cloud Apps to protect its SaaS apps. The security team needs to detect when a user downloads more than 100 files from SharePoint Online within 10 minutes. Which policy type should they create?

Accepted Answer

Anomaly detection policy. Anomaly detection policies in Microsoft Defender for Cloud Apps use machine learning to establish a baseline of normal user behavior and then trigger alerts when deviations occur, such as a user downloading over 100 files from SharePoint Online within 10 minutes. This specific scenario—unusually high download volume in a short time—is a classic example of a behavioral anomaly that an anomaly detection policy is designed to catch, as it may indicate a data exfiltration attempt.

Answer

Activity policy

Answer

Threat detection policy

Answer

Compliance policy

Question 9

A security analyst receives an alert from Microsoft Sentinel indicating a potential ransomware attack. The analyst needs to quickly understand the full scope of the attack, including all affected accounts and devices. Which Microsoft Sentinel feature should they use?

Accepted Answer

Incident investigation. D is correct because Microsoft Sentinel's incident investigation feature provides a visual, interactive graph that maps relationships between entities (e.g., accounts, devices, IP addresses) involved in an incident. This allows the analyst to quickly see the full scope of a ransomware attack by exploring all affected resources and their connections, rather than relying on static reports or automated responses.

Answer

Analytics rules

Answer

Workbooks

Answer

Playbooks

Question 10

A company deploys Microsoft Entra ID Protection. The security team wants to automatically block sign-ins from anonymous IP addresses. They configure a Conditional Access policy. Which assignment condition should they use?

Accepted Answer

Sign-in risk level condition with 'High'. C is correct because the sign-in risk level condition in Conditional Access allows you to target sign-ins that have been assessed by Microsoft Entra ID Protection as risky. Anonymous IP addresses are a specific sign-in risk detection, and configuring the policy to block sign-ins with a 'High' sign-in risk level will automatically block those sign-ins. This directly addresses the security team's requirement to block sign-ins from anonymous IP addresses.

Answer

User risk level condition with 'Medium'

Answer

Device condition with 'Compliant'

Answer

Location condition with 'Any IP'

Question 11

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They need to ensure that when a user tries to share a document containing a credit card number externally via email, the user sees a policy tip and the email is blocked. Which DLP rule action should they configure?

Accepted Answer

Block the message and notify the user with a policy tip. The requirement is to both block the email and show a policy tip to the user. In Microsoft Purview DLP, the 'Block the message and notify the user with a policy tip' action enforces the block at the transport level while simultaneously displaying a customizable policy tip in Outlook or Outlook on the web, informing the user why the message was blocked. This meets the dual need of prevention and user notification.

Answer

Notify user with policy tip only

Answer

Block the message only

Answer

Redirect the message to the compliance admin

Question 12

A company wants to use Microsoft Defender for Office 365 to protect against malicious links in email. Which feature should they enable?

Accepted Answer

Safe Links. Safe Links is the correct feature because it specifically protects against malicious links in email by scanning URLs at the time of click, checking them against real-time threat intelligence, and blocking or warning users if the link is malicious. This is a core capability of Microsoft Defender for Office 365 designed to prevent phishing and malware delivery via hyperlinks.

Answer

Safe Attachments

Answer

Anti-malware policy

Answer

Anti-spam policy

Question 13

A company uses Microsoft Intune for mobile device management (MDM). They need to ensure that corporate data on personal devices is encrypted. Which configuration profile type should they deploy?

Accepted Answer

Device restrictions profile. Device restrictions profile in Microsoft Intune allows administrators to enforce device-level security settings, including encryption of corporate data on personal devices. This profile type can require BitLocker (Windows) or FileVault (macOS) encryption, and for mobile devices, it can mandate device encryption via policies that align with platform-specific encryption standards (e.g., Android's full-disk encryption or iOS Data Protection). By deploying a device restrictions profile with encryption settings enabled, the organization ensures that corporate data stored on the device is protected at rest.

Answer

Email profile

Answer

Certificate profile

Answer

Compliance policy

Question 14

A company uses Microsoft Defender for Cloud to secure its Azure resources. The security team wants to receive a single recommendation for all resources that are missing just-in-time (JIT) VM access. Which Microsoft Defender for Cloud feature should they use?

Accepted Answer

Security recommendations. Microsoft Defender for Cloud's security recommendations feature provides a centralized list of actionable steps to improve your security posture, including a specific recommendation to enable just-in-time (JIT) VM access on all eligible virtual machines. This recommendation aggregates all resources missing JIT configuration into a single entry, allowing the security team to remediate them collectively. The other options do not aggregate missing JIT configurations into a single recommendation.

Answer

Regulatory compliance dashboard

Answer

Inventory

Answer

Security alerts

Question 15

A company uses Microsoft Purview Information Protection to classify and label sensitive documents. The compliance team wants to automatically apply a 'Confidential' label to documents containing an employee's passport number. Which method should they use?

Accepted Answer

Auto-labeling policy. An auto-labeling policy in Microsoft Purview Information Protection automatically applies sensitivity labels to documents and emails based on sensitive information types (e.g., passport numbers) without user intervention. This method uses content scanning to detect patterns and enforce labeling rules, making it the correct choice for the compliance team's requirement.

Answer

Manual labeling by users

Answer

Trainable classifiers

Answer

DLP policy