SC-900 Describe the capabilities of Microsoft security solutions Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. Your company uses Microsoft Defender for Cloud. You find the policy snippet in your policy assignments. What is the primary goal of this policy?

Accepted Answer

To audit virtual machines that are not configured to send logs to Azure Monitor. The policy audits virtual machines to ensure they have the Microsoft Monitoring Agent extension installed, which is used for log collection and security monitoring. Option A is wrong because the effect is 'AuditIfNotExists', not 'Deny'. Option B is wrong because the policy does not check for vulnerability assessment. Option C is wrong because the policy checks for the Monitoring Agent, not Endpoint Protection.

Answer

To block deployment of virtual machines without a specific extension

Answer

To identify virtual machines missing vulnerability assessment

Answer

To ensure virtual machines have endpoint protection installed

Question 2

Your company uses Microsoft Sentinel as a SIEM. You need to collect logs from a third-party firewall. Which THREE methods can you use?

Accepted Answer

Common Event Format (CEF). Microsoft Sentinel uses data connectors (C) to ingest logs from various sources. For third-party firewalls, these connectors often leverage standard logging protocols and formats. Syslog (D) is a widely supported protocol that many firewalls use to send logs. Often, these Syslog messages are formatted according to the Common Event Format (CEF) (B), which provides a standardized way to represent security events. Sentinel has built-in data connectors that can ingest both generic Syslog and CEF-formatted logs, typically using an agent on a Linux forwarder.

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor Agent

Question 3

Your organization uses Microsoft Sentinel. You need to create a custom analytics rule that triggers an incident when a specific user account logs in from an unusual geographic location. Which KQL function should you use to evaluate location?

Accepted Answer

ioc. The `ioc` function in KQL is used to match data against Indicators of Compromise (IoCs) from threat intelligence feeds (e.g., malicious IP addresses, domains, file hashes). While `ioc` can be used to detect logins from specific geographic locations if those locations are represented by IP address ranges that have been ingested as IoCs into Microsoft Sentinel, it does not perform geolocation or evaluate whether a location is 'unusual' based on behavioral analytics or baselines. Detecting 'unusual geographic location' often requires additional KQL operations like geolocation lookups (e.g., using `lookup` with a geo-IP table or leveraging built-in fields like `LocationDetails` in `SigninLogs`) and then comparing the resulting location against a user's historical login locations or a defined policy. The `ioc` function is a matching function for pre-defined threat intelligence, not a general-purpose location evaluation function.

Answer

search

Answer

evaluate

Answer

parse_json

Question 4

Refer to the exhibit. A compliance administrator is configuring role-based access control (RBAC) in Microsoft Purview compliance portal. Which role group would provide the permissions shown?

Accepted Answer

Information Protection. The exhibit displays permissions related to managing sensitivity labels, label policies, and data loss prevention (DLP) rules within Microsoft Purview. The Information Protection role group is specifically designed for administrators who need to configure and manage these information protection features, making it the correct choice as it directly encompasses all the displayed permissions.

Answer

Compliance Administrator

Answer

Security Reader

Answer

Data Classification

Question 5

A company wants to restrict access to a sensitive SharePoint site based on the user's location and device compliance. Which Microsoft Entra ID feature should they configure?

Accepted Answer

Conditional Access. Conditional Access policies can enforce location and device compliance. Option A is correct. Option B (Privileged Identity Management) is for role management. Option C (Entitlement Management) is for access packages. Option D (Identity Protection) is for risk detection.

Answer

Privileged Identity Management

Answer

Entitlement Management

Answer

Identity Protection

Question 6

Which THREE Microsoft Purview features can be used to protect data in Microsoft 365? (Select three.)

Accepted Answer

Data Loss Prevention. Data Loss Prevention (DLP) is a Microsoft Purview feature that helps protect sensitive data by identifying, monitoring, and automatically blocking risky or unauthorized sharing of data across Microsoft 365 services like Exchange, SharePoint, and OneDrive. It uses policy-based rules to detect and prevent accidental or intentional leaks of sensitive information such as credit card numbers or personally identifiable information (PII).

Insider Risk Management in Microsoft Purview helps organizations detect, investigate, and act on malicious and inadvertent insider activities that could lead to data theft, leakage, or misuse. It uses signals from Microsoft 365 and other services to identify risky user behaviors.

Sensitivity labels, part of Microsoft Information Protection (a core component of Microsoft Purview), allow organizations to classify and protect sensitive data across Microsoft 365. They can apply encryption, visual markings (like headers/footers), and access restrictions to documents and emails, ensuring data remains protected wherever it travels.

Answer

eDiscovery

Answer

Microsoft Defender for Cloud Apps

Question 7

Which THREE capabilities are provided by Microsoft Defender XDR (formerly Microsoft 365 Defender)? (Choose three.)

Accepted Answer

Identity threat detection. Microsoft Defender XDR (formerly Microsoft 365 Defender) provides a unified security suite across multiple domains. It includes:

*   **Identity threat detection (A)**: Delivered through Microsoft Defender for Identity, it correlates signals from Azure Active Directory (now Microsoft Entra ID) and on-premises Active Directory to detect attacks like pass-the-hash, brute force, and privilege escalation using behavioral analytics and machine learning.
*   **Endpoint detection and response (EDR) (C)**: Provided by Microsoft Defender for Endpoint, it offers advanced threat protection, post-breach detection, automated investigation, and response capabilities for endpoints (workstations, servers, mobile devices).
*   **Email and collaboration protection (E)**: Delivered by Microsoft Defender for Office 365, it safeguards against sophisticated threats in email, links, and collaboration tools like SharePoint, OneDrive, and Microsoft Teams, including phishing, malware, and business email compromise.

Answer

Data classification and labeling

Answer

Mobile device management (MDM)

Question 8

Which TWO features are included in Microsoft Entra ID Identity Protection? (Choose two.)

Accepted Answer

Sign-in risk detection. Microsoft Entra ID Identity Protection includes sign-in risk detection (B) and user risk detection (E) as its two core risk detection capabilities. Multi-factor authentication registration campaign is a separate Microsoft Entra authentication methods feature, not a feature of Identity Protection. Identity Protection has an MFA registration policy, which is different from a registration campaign. Therefore, the correct features are B and E.

Answer

Just-in-time privileged access

Answer

Cloud app discovery

Answer

Multi-factor authentication registration campaign

Question 9

Which THREE of the following are included in Microsoft Defender XDR (Extended Detection and Response)? (Choose three.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender XDR (Extended Detection and Response) is a unified security operations suite that natively integrates signals from multiple Defender components to provide cross-domain detection and automated response. The core components integrated into Defender XDR include Microsoft Defender for Endpoint (for devices), Microsoft Defender for Identity (for identities), and Microsoft Defender for Office 365 (for email and collaboration). These components work together to provide a comprehensive view and response to threats across an organization's digital estate.

Answer

Microsoft Azure Information Protection

Answer

Microsoft Defender for Cloud

Question 10

Your organization uses Microsoft Entra ID. You need to allow external users from a specific partner tenant to access a single internal application, but only after they provide a phone number for verification. What should you configure?

Accepted Answer

Conditional Access policy for the application. Conditional Access is the correct control to enforce MFA for external users accessing a specific application. Cross-tenant access settings for a partner tenant can be used to configure trust settings for MFA claims from the partner tenant, but they do not enforce MFA or require phone verification. A Conditional Access policy targeting the application and external users can require MFA, such as phone verification, before access is granted.

Answer

Cross-tenant access settings for the partner tenant

Answer

B2B collaboration invitation settings

Answer

Identity Protection policy

Question 11

Refer to the exhibit. You are a security analyst using Microsoft Sentinel. You run this KQL query. What does the query return?

Accepted Answer

Incident IDs for high-severity alerts that have an open incident.. The KQL query filters alerts with a severity of 'High' and then projects only the IncidentId for those alerts where the IncidentId is not empty (i.e., an incident has been assigned). This returns the Incident IDs for high-severity alerts that have an incident assigned.

Answer

High-severity alerts that do not have an incident assigned.

Answer

High-severity alerts that were closed within the last hour.

Answer

All incidents created in the last hour.

Question 12

Refer to the exhibit. You are reviewing a policy in Microsoft Defender for Cloud that monitors for unencrypted data uploads to an S3 bucket. The policy condition is shown. Which statement about this policy is correct?

Accepted Answer

The policy enforces encryption for objects uploaded to the 'documents' bucket.. The policy condition in Microsoft Defender for Cloud is configured to monitor for unencrypted data uploads specifically to an S3 bucket named 'documents'. When the condition detects an upload without encryption, it triggers an enforcement action that requires encryption for objects uploaded to that bucket. This aligns with option A, as the policy is scoped to the 'documents' bucket and enforces encryption on uploads.

Answer

The policy applies to all S3 buckets in the account.

Answer

The policy requires encryption with AWS KMS.

Answer

The policy denies all uploads to the bucket.

Question 13

Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps? (Choose TWO.)

Accepted Answer

Session control. Microsoft Defender for Cloud Apps provides session control through its Conditional Access App Control feature, which allows real-time monitoring and control of user activities in cloud apps by enforcing policies at the session level. This capability enables administrators to block downloads, restrict access, or require multi-factor authentication during a user's session, leveraging reverse proxy integration with Azure AD. Additionally, Defender for Cloud Apps offers cloud discovery (Shadow IT discovery) to identify and assess all cloud applications used across an organization, providing visibility into sanctioned and unsanctioned apps.

Answer

Vulnerability management

Answer

Threat intelligence

Answer

Information protection

Question 14

Which THREE capabilities are provided by Microsoft Defender XDR? (Choose THREE.)

Accepted Answer

Advanced hunting. Microsoft Defender XDR provides a unified security experience across various domains. Its core capabilities include **Advanced hunting**, which allows security analysts to proactively query raw data across endpoints, email, identities, and cloud apps using Kusto Query Language (KQL) to uncover sophisticated threats. It also offers **Automated investigation and response (AIR)**, which automatically investigates alerts and takes remediation actions to resolve threats efficiently. Furthermore, **Incident management** is a key capability, consolidating alerts from various Defender components into incidents for a holistic view and streamlined security operations, enabling coordinated response across the enterprise.

Answer

Cloud security posture management

Answer

Vulnerability management

Question 15

Which TWO Microsoft Purview solutions can help identify and protect sensitive data in Microsoft Teams? (Choose TWO.)

Accepted Answer

Information Protection. Microsoft Information Protection (MIP) helps identify and protect sensitive data in Microsoft Teams by enabling classification and labeling of content through sensitivity labels. These labels can enforce encryption, visual markings, and access restrictions on messages, files, and other data shared within Teams channels and chats. Microsoft Purview Data Loss Prevention (DLP) policies complement this by identifying, monitoring, and automatically preventing sensitive information from being shared inappropriately or leaving the organization through Teams messages, files, and other interactions, ensuring sensitive data is handled according to organizational policies.

Answer

Communication Compliance

Answer

Data Lifecycle Management

Answer

Insider Risk Management