SC-900 Describe the capabilities of Microsoft security solutions Practice Test 31 — 15 Questions

Question 1

A company wants to classify and label data in Microsoft SharePoint Online automatically based on content containing passport numbers. Which Microsoft Purview feature should they use?

Accepted Answer

Auto-labeling policy. Correct: Auto-labeling policy in Purview applies labels automatically. Option B: DLP policy prevents sharing. Option C: Data classification dashboard shows classification results. Option D: Audit logs are for activity tracking.

Answer

Audit log

Answer

Data classification dashboard

Answer

Data loss prevention (DLP) policy

Question 2

Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps? (Select TWO.)

Accepted Answer

Control access with Conditional Access App Control. Correct: Discover shadow IT (A) and Control access via Conditional Access App Control (D). Option B: DLP is in Purview, not Defender for Cloud Apps. Option C: Device compliance is in Intune/Entra. Option E: Threat analytics is in Defender for Endpoint/Office.

Answer

Enforce device compliance policies

Answer

Provide threat analytics reports

Answer

Classify sensitive data across cloud apps

Question 3

Which THREE of the following are capabilities of Microsoft Sentinel? (Select THREE.)

Accepted Answer

Security information and event management (SIEM). Correct: SIEM (B), SOAR (C), and UEBA (E). Option A: Device management is Intune. Option D: DLP is Purview.

Answer

Mobile device management

Answer

Data loss prevention

Question 4

Which TWO of the following are features of Microsoft Purview Data Loss Prevention (DLP)? (Select TWO.)

Accepted Answer

Provide policy tips to users. Correct: Monitor and prevent sharing of sensitive data (A) and Provide policy tips to users (D). Option B: Threat protection is Defender. Option C: Sensitivity labels are Information Protection. Option E: Identity governance is Entra ID Governance.

Answer

Detect and block malware

Answer

Apply sensitivity labels

Answer

Manage user access rights

Question 5

You are a security administrator for Contoso Ltd., which uses Microsoft 365 E5. The company has 10,000 users and uses Microsoft Entra ID for identity. The security team has noticed an increase in sign-in attempts from anonymous IP addresses and from locations outside the company's home country. They want to implement a solution that automatically blocks sign-ins from anonymous IP addresses and requires MFA for sign-ins from outside the home country. They also want to ensure that if a user's risk level is high, they are forced to change their password. The solution must use Microsoft Entra ID Protection and Conditional Access. You have already configured a Conditional Access policy to require MFA for all users. Which of the following is the most efficient way to meet all requirements with minimal administrative overhead?

Accepted Answer

Configure Identity Protection sign-in risk policy to block anonymous IP addresses, user risk policy to require password change for high-risk users, and create a Conditional Access policy to require MFA for sign-ins from outside the home country.. Correct: D. Using Identity Protection's risk policies for anonymous IP and high risk, plus a Conditional Access policy for location-based MFA, is efficient. Option A: Combining all in one policy is not possible because Conditional Access cannot detect anonymous IP automatically (Identity Protection does). Option B: Only Conditional Access cannot detect anonymous IP. Option C: Missing location-based MFA requirement.

Answer

Create a single Conditional Access policy that blocks anonymous IP addresses, requires MFA based on location, and forces password change for high-risk users.

Answer

Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to block sign-ins from outside the home country.

Answer

Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to require MFA for all users.

Question 6

You are responsible for Microsoft Purview Information Protection at a law firm that handles highly confidential client documents. The firm uses Microsoft 365 E5. You need to ensure that any document containing the phrase 'Attorney-Client Privileged' is automatically labeled with a 'Highly Confidential' sensitivity label and encrypted. Additionally, if a user attempts to send such a document via email outside the organization, the action should be blocked and the user should be prompted with a policy tip. You have already created the sensitivity label with encryption settings. What should you do next?

Accepted Answer

Create an auto-labeling policy for the label, and create a DLP policy that detects the label and blocks external sharing with a policy tip.. Correct: B. Create an auto-labeling policy for the label, and a DLP policy that detects the label and blocks external sharing with policy tip. Option A: Missing DLP policy. Option C: Manual labeling is not automatic. Option D: DLP policy alone cannot auto-label.

Answer

Create a DLP policy that detects the phrase and automatically applies the label, then blocks external sharing.

Answer

Create an auto-labeling policy for the label, and create a mail flow rule in Exchange to block external emails with that label.

Answer

Create a manual labeling policy and train users to apply the label, then create a DLP policy.

Question 7

You work at a mid-sized company that uses Microsoft Defender for Business (a subscription included with Microsoft 365 Business Premium). The company has 300 devices enrolled in Microsoft Intune. Recently, a malware outbreak occurred on several devices. You need to implement a solution that automatically remediates devices that are found to be infected with malware. The solution should isolate the device from the network and run a full scan. Which action should you take?

Accepted Answer

Enable automatic investigation and remediation in Microsoft Defender for Business.. Correct: A. Defender for Business includes automated investigation and remediation capabilities. Option B: Intune compliance policies enforce compliance but do not automatically remediate malware. Option C: Conditional Access controls access, not remediation. Option D: Antivirus policies set baseline but do not automate response.

Answer

Create a Conditional Access policy to block access for devices with malware.

Answer

Create an Intune compliance policy to mark devices as non-compliant if malware is detected.

Answer

Configure Microsoft Defender Antivirus to run a weekly scan.

Question 8

A company uses Microsoft 365 E5 and wants to protect against advanced cyber threats. Which TWO capabilities of Microsoft Defender XDR should they implement?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Endpoint and Microsoft Defender for Office 365 are core components of Microsoft Defender XDR. Defender for Cloud Apps is a separate product, and Microsoft Sentinel is a SIEM. Microsoft Intune is for device management.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 9

An organization is using Microsoft Purview Compliance Portal to manage data lifecycle. Which THREE actions can be performed using retention labels?

Accepted Answer

Trigger a disposition review at the end of retention. Retention labels can apply retention actions, mark as records, and trigger disposition review. They do not automatically delete data without a policy; instead, they work with retention policies. They cannot be used for DLP directly.

Answer

Automatically delete content after a specified period

Answer

Block sharing of sensitive information via email

Question 10

A company wants to enforce multifactor authentication for all users. Which TWO Microsoft Entra ID features can be used together to achieve this?

Accepted Answer

Conditional Access. Conditional Access policies can require MFA, and Authentication methods management allows configuring MFA methods. Security defaults also enforce MFA but is not a feature to combine. Identity Protection is risk-based. Password protection is not MFA.

Answer

Identity Protection

Answer

Security defaults

Answer

Password protection

Question 11

A security analyst is using Microsoft Sentinel to investigate an incident. Which THREE data sources can be ingested into Sentinel?

Accepted Answer

Azure Active Directory logs. Microsoft Sentinel can ingest logs from Office 365, Azure AD, and Windows Security Events via MMA/AMA. Azure DevOps is not a supported data connector. Power BI is not a log source.

Answer

Power BI usage metrics

Answer

Azure DevOps audit logs

Question 12

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. Which THREE actions can be taken automatically when a DLP policy matches?

Accepted Answer

Show a policy tip to the user. DLP can block sharing, show policy tips, and encrypt content. It does not delete content or automatically notify legal; notification is via admin alert or user tip.

Answer

Automatically notify the legal department

Answer

Delete the sensitive content

Question 13

A company wants to use Microsoft Defender for Cloud to secure their hybrid cloud environment. Which TWO resource types can be assessed by Defender for Cloud?

Accepted Answer

Azure Virtual Machines. Defender for Cloud assesses Azure VMs and on-premises servers via Azure Arc. AWS accounts are not directly assessed; only Azure resources. SQL Server on-premises is not supported unless via arc. Kubernetes is not a resource type listed.

Answer

AWS EC2 instances

Answer

Kubernetes clusters

Answer

On-premises SQL Server

Question 14

A security team uses Microsoft Defender XDR to respond to incidents. Which THREE components are part of Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Defender for Endpoint, Office 365, and Identity are core components. Sentinel is separate, and Intune is MDM.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 15

An organization uses Microsoft Purview Information Protection to classify and protect data. Which TWO methods can be used to apply sensitivity labels automatically?

Accepted Answer

Auto-labeling policies in Microsoft 365 compliance center. Auto-labeling policies can apply labels based on conditions. Client-side labeling via the Azure Information Protection unified labeling client also supports automatic classification. Manual labeling is not automatic. Labeling in Microsoft 365 Apps is default but not automatic. PowerShell cannot directly apply labels automatically without scripts.

Answer

Default labeling policy for Microsoft 365 Apps

Answer

Manual labeling by end users

Answer

PowerShell scripts to apply labels on export