SC-900 Describe the capabilities of Microsoft security solutions Practice Test 30 — 15 Questions

Question 1

Your organization wants to ensure that all external emails are automatically tagged with a disclaimer at the top of the email body. Which Microsoft Exchange Online feature should you configure?

Accepted Answer

Mail flow rule (transport rule). Option C is correct because mail flow rules (transport rules) can add disclaimers to emails. Option A is incorrect because DLP policies do not add disclaimers. Option B is incorrect because Safe Links adds URL protection, not disclaimers. Option D is incorrect because journaling archives emails.

Answer

Journal rule

Answer

Data loss prevention (DLP) policy

Answer

Safe Links policy

Question 2

Which TWO actions can be performed using Microsoft Purview Communication Compliance? (Choose two.)

Accepted Answer

Review messages for potential regulatory compliance violations. Options A and D are correct. Communication Compliance can detect and review sensitive information and ensure regulatory compliance. Option B is incorrect because automatic encryption is not a feature of Communication Compliance. Option C is incorrect because retention policies are separate. Option E is incorrect because DLP policies are separate.

Answer

Automatically encrypt emails containing sensitive data

Answer

Prevent the sharing of sensitive data with external users

Answer

Enforce retention policies for communications

Question 3

Which THREE capabilities are provided by Microsoft Defender for Cloud Apps? (Choose three.)

Accepted Answer

Threat detection to identify malicious behavior in cloud apps. Options A, B, and C are correct. Cloud Access Security Brokers (CASB) provide discovery, data protection, and threat detection. Option D is incorrect because endpoint detection is in Defender for Endpoint. Option E is incorrect because email scanning is in Defender for Office 365.

Answer

Email scanning and remediation

Answer

Endpoint detection and response (EDR)

Question 4

Which TWO capabilities are part of Microsoft Entra ID Protection? (Choose two.)

Accepted Answer

Risk-based conditional access policies. Options B and D are correct. Entra ID Protection includes risk-based policies and reporting for risky users. Option A is incorrect because passwordless authentication is a feature of Entra ID, but not specifically ID Protection. Option C is incorrect because privileged identity management is Microsoft Entra Privileged Identity Management (PIM). Option E is incorrect because conditional access is a broader feature, but ID Protection provides risk-based conditional access.

Answer

Passwordless authentication

Answer

Just-in-time privileged access

Answer

Conditional access policies for device compliance

Question 5

You are the security administrator for a large healthcare organization that uses Microsoft 365 E5. The organization must comply with HIPAA and GDPR regulations. You have implemented Microsoft Purview Information Protection with sensitivity labels to classify and protect patient data. Recently, the compliance team identified that some documents containing Protected Health Information (PHI) are being shared externally without protection. You need to prevent users from sharing documents classified as 'Highly Confidential' with external users unless the document is encrypted and labeled. Additionally, you must ensure that any external sharing of such documents is automatically blocked. You have the following options available. Which action should you take?

Accepted Answer

Create a data loss prevention (DLP) policy in Microsoft Purview that detects the 'Highly Confidential' label and blocks sharing with external users. Option A is correct because a DLP policy can detect documents with the 'Highly Confidential' label and block external sharing. Option B is incorrect because auto-labeling applies labels but does not block sharing. Option C is incorrect because retention policies do not control sharing. Option D is incorrect because conditional access policies do not inspect document labels.

Answer

Configure auto-labeling for SharePoint to automatically apply the 'Highly Confidential' label to all documents containing PHI

Answer

Configure a conditional access policy in Microsoft Entra ID to block external access to SharePoint sites containing PHI

Answer

Create a retention policy for SharePoint that prevents deletion of documents with the 'Highly Confidential' label

Question 6

You are the security architect for a financial services company that uses Microsoft 365 E5. The company has recently deployed Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. The security team wants to detect when users are accessing corporate data from personal devices that are not managed by Microsoft Intune. You need to implement a solution that alerts the security team when a user accesses Microsoft 365 resources from an unmanaged device. The solution should also allow the user to continue working but with limited capabilities, such as preventing download of files. Which of the following should you configure?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps that monitors and controls access based on device compliance. Option A is correct because session policies in Microsoft Defender for Cloud Apps can control actions based on device management status. Option B is incorrect because conditional access policies can block access but do not provide granular control like preventing downloads. Option C is incorrect because compliance policies define compliance but do not enforce access restrictions. Option D is incorrect because app protection policies apply to mobile apps, not browser sessions.

Answer

Create a device compliance policy in Microsoft Intune that marks unmanaged devices as non-compliant

Answer

Create an app protection policy in Microsoft Intune that prevents data transfer from managed apps

Answer

Create a conditional access policy in Microsoft Entra ID that blocks access from unmanaged devices

Question 7

You are the security administrator for a small business that uses Microsoft 365 Business Premium. The company wants to enable multi-factor authentication (MFA) for all users. You need to ensure that users are prompted for MFA when they sign in from unfamiliar locations or devices. The solution should be easy to deploy without additional licensing. Which of the following should you configure?

Accepted Answer

Enable security defaults in Microsoft Entra ID. Option B is correct because security defaults are a pre-configured set of security policies that include MFA based on risk. Option A is incorrect because conditional access policies require Azure AD Premium licenses, which are not included in Business Premium. Option C is incorrect because risk-based policies require Azure AD Premium P2. Option D is incorrect because the Microsoft Authenticator app alone does not enforce MFA.

Answer

Create a conditional access policy in Microsoft Entra ID that requires MFA for all cloud apps

Answer

Deploy the Microsoft Authenticator app and instruct users to enable it

Answer

Configure identity protection to enable risk-based MFA

Question 8

Your organization uses Microsoft Defender for Cloud Apps. Security team wants to be alerted when a user accesses a cloud app from a risky IP address. Which solution should you use to create a policy that triggers an alert based on this activity?

Accepted Answer

Create an activity policy.. Correct: Activity policy in Defender for Cloud Apps can monitor specific activities (e.g., logins) and trigger alerts based on risk factors like IP. Option A: Access policies control access, not alerting. Option C: Session policies control sessions. Option D: App discovery policies are for discovering shadow IT.

Answer

Create a session policy.

Answer

Create an app discovery policy.

Answer

Create an access policy.

Question 9

Contoso uses Microsoft Sentinel. They want to automate response to a high-severity incident by blocking the source IP in Azure Firewall and sending a notification to the SOC team via email. Which feature should they use?

Accepted Answer

Create an automation rule.. Correct: Automation rules in Microsoft Sentinel run playbooks based on trigger conditions (e.g., incident creation). Option A: Workbooks are for visualization. Option B: Hunting queries are for proactive threat hunting. Option D: Fusion is a correlation engine.

Answer

Create a hunting query.

Answer

Enable Fusion.

Answer

Create a workbook.

Question 10

An organization uses Microsoft Defender for Endpoint (MDE). The security team wants to identify devices that have not received a security update in the last 30 days. Which report should they use?

Accepted Answer

Device health report. Correct: Device health report in MDE shows missing updates. Option A: Threat analytics is for threat intelligence. Option B: Vulnerability management dashboard shows vulnerabilities but not specifically missing updates. Option D: Secure Score is for overall posture.

Answer

Threat analytics report

Answer

Vulnerability management dashboard

Answer

Microsoft Secure Score report

Question 11

Your company uses Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to documents containing a credit card number. What should they create?

Accepted Answer

An auto-labeling policy. Correct: Auto-labeling policy in Purview automatically labels documents based on sensitive info types. Option A: Sensitivity label alone defines the label but doesn't auto-apply. Option C: DLP policy prevents sharing but doesn't label. Option D: Retention label is for retention, not sensitivity.

Answer

A sensitivity label

Answer

A data loss prevention (DLP) policy

Answer

A retention label policy

Question 12

A SOC analyst in Microsoft Sentinel needs to create a custom detection rule that triggers an incident when more than 10 failed logins occur from a single IP address within 5 minutes. Which rule type should they use?

Accepted Answer

Scheduled query analytics rule. Correct: Scheduled query rule allows custom KQL and schedule. Option A: NRT rule is for near-real-time but limited. Option B: Microsoft Security rule is for built-in detections. Option D: Anomaly rule is for ML-based anomalies.

Answer

Anomaly analytics rule

Answer

Near-real-time (NRT) analytics rule

Answer

Microsoft security analytics rule

Question 13

An organization wants to ensure that only managed and compliant devices can access corporate email in Exchange Online. Which Microsoft Entra ID Conditional Access policy setting should they use?

Accepted Answer

Require device to be marked as compliant. Correct: 'Require device to be marked as compliant' enforces compliance. Option B: 'Require MFA' is about authentication. Option C: 'Require approved client app' is for app-level. Option D: 'Require hybrid Azure AD joined' is for domain-joined devices.

Answer

Require approved client app

Answer

Require hybrid Azure AD joined device

Answer

Require multi-factor authentication

Question 14

Your organization uses Microsoft Defender for Office 365. Users report receiving phishing emails that bypassed the default anti-phishing policy. What should you do to improve protection?

Accepted Answer

Create a custom anti-phishing policy.. Correct: Create a custom anti-phishing policy with stricter settings. Option A: Increase spam confidence level is for spam, not phishing. Option C: Enable safe attachments is for attachment scanning. Option D: Configure anti-malware policy is for malware.

Answer

Enable Safe Attachments.

Answer

Configure anti-malware policy.

Answer

Increase the spam confidence level (SCL) threshold.

Question 15

Contoso has a hybrid identity with AD DS synced to Microsoft Entra ID. They want to block legacy authentication protocols that bypass MFA. Which security solution should they use?

Accepted Answer

Conditional Access policy. Correct: Conditional Access policy can block legacy authentication. Option A: Identity Protection detects risk but doesn't block protocols. Option B: Azure AD Connect has no such feature. Option D: Password Protection blocks weak passwords.

Answer

Microsoft Entra Password Protection

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Connect Health