SC-900 Describe the capabilities of Microsoft security solutions Practice Test 31 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud Apps. Security team wants to be alerted when a user accesses a cloud app from a risky IP address. Which solution should you use to create a policy that triggers an alert based on this activity?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an activity policy.. Activity policies in Microsoft Defender for Cloud Apps monitor specific user activities (such as logins or file downloads) and can trigger alerts based on risk factors like the user's IP address. To be alerted when a user accesses a cloud app from a risky IP, an activity policy is appropriate. Session policies (Option B) control real-time session access and can block or allow actions but are not designed for alerting based on IP alone. App discovery policies (Option C) identify shadow IT and unsanctioned apps, not user activity alerts. Access policies (Option D) enforce conditional access requirements but do not primarily generate IP-based alerts.

Answer

Create a session policy.

Answer

Create an app discovery policy.

Answer

Create an access policy.

Question 2

Contoso uses Microsoft Sentinel. They want to automate response to a high-severity incident by blocking the source IP in Azure Firewall and sending a notification to the SOC team via email. Which feature should they use?

Accepted Answer

Create an automation rule.. Correct: Automation rules in Microsoft Sentinel can automatically trigger playbooks (e.g., to block an IP in Azure Firewall) and send notifications based on incident creation or update, meeting the requirement. Option A (hunting query) is for proactively searching for threats, not automated response. Option C (Fusion) is a correlation engine that detects multistage attacks but does not automate actions. Option D (workbook) is for visualization and reporting, not automation.

Answer

Create a hunting query.

Answer

Enable Fusion.

Answer

Create a workbook.

Question 3

An organization uses Microsoft Defender for Endpoint (MDE). The security team wants to identify devices that have not received a security update in the last 30 days. Which report should they use?

Accepted Answer

Device health report. The Device health report in Microsoft Defender for Endpoint provides a list of devices and their last security update status, including the date of the last update. This report directly answers the requirement to identify devices that have not received a security update in the last 30 days by showing the 'Last update' column and allowing filtering by update age.

Answer

Threat analytics report

Answer

Vulnerability management dashboard

Answer

Microsoft Secure Score report

Question 4

Your company uses Microsoft Purview Information Protection. They want to automatically apply a 'Confidential' sensitivity label to documents containing a credit card number. What should they create?

Accepted Answer

An auto-labeling policy. An auto-labeling policy in Microsoft Purview Information Protection is designed to automatically apply sensitivity labels to documents and emails based on conditions such as the presence of sensitive information types (e.g., credit card numbers). This allows the 'Confidential' label to be applied without user intervention, meeting the requirement.

Answer

A sensitivity label

Answer

A data loss prevention (DLP) policy

Answer

A retention label policy

Question 5

A SOC analyst in Microsoft Sentinel needs to create a custom detection rule that triggers an incident when more than 10 failed logins occur from a single IP address within 5 minutes. Which rule type should they use?

Accepted Answer

Scheduled query analytics rule. A scheduled query analytics rule is the correct choice because it allows the SOC analyst to define a custom KQL query that counts failed logins per IP address over a 5-minute window and triggers an incident when the count exceeds 10. This rule type runs on a recurring schedule (e.g., every 5 minutes) and is designed for threshold-based detection scenarios like brute-force attacks.

Answer

Anomaly analytics rule

Answer

Near-real-time (NRT) analytics rule

Answer

Microsoft security analytics rule

Question 6

An organization wants to ensure that only managed and compliant devices can access corporate email in Exchange Online. Which Microsoft Entra ID Conditional Access policy setting should they use?

Accepted Answer

Require device to be marked as compliant. To ensure only managed and compliant devices access corporate email in Exchange Online, the 'Require device to be marked as compliant' setting in a Conditional Access policy evaluates the device's compliance status reported by Microsoft Intune. This ensures that devices meet security policies (e.g., encryption, patch levels) before granting access, directly addressing the requirement for managed and compliant access.

Answer

Require approved client app

Answer

Require hybrid Azure AD joined device

Answer

Require multi-factor authentication

Question 7

Your organization uses Microsoft Defender for Office 365. Users report receiving phishing emails that bypassed the default anti-phishing policy. What should you do to improve protection?

Accepted Answer

Create a custom anti-phishing policy.. The default anti-phishing policy in Microsoft Defender for Office 365 provides baseline protection, but it cannot be customized. To address specific threats like phishing emails that bypass default settings, you must create a custom anti-phishing policy. This allows you to fine-tune spoof intelligence, impersonation protection, and mailbox intelligence thresholds to catch sophisticated phishing attempts that evade the default policy.

Answer

Enable Safe Attachments.

Answer

Configure anti-malware policy.

Answer

Increase the spam confidence level (SCL) threshold.

Question 8

Contoso has a hybrid identity with AD DS synced to Microsoft Entra ID. They want to block legacy authentication protocols that bypass MFA. Which security solution should they use?

Accepted Answer

Conditional Access policy. Conditional Access policies in Microsoft Entra ID can be configured to block legacy authentication protocols (such as POP3, IMAP, SMTP, and basic authentication) by targeting client apps that do not support modern authentication. This directly prevents bypass of MFA because legacy protocols do not support MFA challenges, making them a common attack vector. By creating a policy that blocks all access from legacy authentication clients, Contoso enforces MFA for all sign-ins that use modern authentication.

Answer

Microsoft Entra Password Protection

Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra Connect Health

Question 9

A company wants to classify and label data in Microsoft SharePoint Online automatically based on content containing passport numbers. Which Microsoft Purview feature should they use?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels to documents in SharePoint Online based on sensitive information types, such as passport numbers. This enables automatic classification and labeling without manual intervention, meeting the requirement to label data based on content.

Answer

Audit log

Answer

Data classification dashboard

Answer

Data loss prevention (DLP) policy

Question 10

Which THREE of the following are capabilities of Microsoft Sentinel? (Select THREE.)

Accepted Answer

Security information and event management (SIEM). Correct: A (SIEM), B (UEBA), D (SOAR). C is not a Sentinel capability; it is a feature of Microsoft Intune. E is a feature of Microsoft Purview.

Answer

Mobile device management

Answer

Data loss prevention

Question 11

Which TWO of the following are features of Microsoft Purview Data Loss Prevention (DLP)? (Select TWO.)

Accepted Answer

Provide policy tips to users. Correct answers: D and E. D: Provide policy tips to users is a feature of Microsoft Purview DLP that educates users about policy violations. E: Monitor and prevent sharing of sensitive data is the primary function of DLP. Option A: Detect and block malware is a feature of Microsoft Defender for Endpoint. Option B: Apply sensitivity labels is a feature of Microsoft Information Protection. Option C: Manage user access rights is a feature of Entra ID (Identity Governance).

Answer

Detect and block malware

Answer

Apply sensitivity labels

Answer

Manage user access rights

Question 12

You are a security administrator for Contoso Ltd., which uses Microsoft 365 E5. The company has 10,000 users and uses Microsoft Entra ID for identity. The security team has noticed an increase in sign-in attempts from anonymous IP addresses and from locations outside the company's home country. They want to implement a solution that automatically blocks sign-ins from anonymous IP addresses and requires MFA for sign-ins from outside the home country. They also want to ensure that if a user's risk level is high, they are forced to change their password. The solution must use Microsoft Entra ID Protection and Conditional Access. You have already configured a Conditional Access policy to require MFA for all users. Which of the following is the most efficient way to meet all requirements with minimal administrative overhead?

Accepted Answer

Configure Identity Protection sign-in risk policy to block anonymous IP addresses, user risk policy to require password change for high-risk users, and create a Conditional Access policy to require MFA for sign-ins from outside the home country.. A is correct. Identity Protection sign-in risk policies can detect and block sign-ins from anonymous IP addresses. User risk policies can require a password change for high-risk users. Conditional Access policies can enforce MFA based on location (e.g., outside home country). Option B is incorrect because a single Conditional Access policy cannot directly detect anonymous IP addresses (this is only available through Identity Protection). Option C is incorrect because it blocks sign-ins from outside the home country instead of requiring MFA. Option D is incorrect because it uses Conditional Access to require MFA for all users, which is already done by the existing policy, and it does not specifically enforce MFA for outside home country; also, requiring MFA for all users adds unnecessary friction. The most efficient method to meet all requirements with minimal administrative overhead is to combine Identity Protection risk policies for anonymous IP and high risk, and create a separate Conditional Access policy for location-based MFA, as in option A.

Answer

Create a single Conditional Access policy that blocks anonymous IP addresses, requires MFA based on location, and forces password change for high-risk users.

Answer

Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to block sign-ins from outside the home country.

Answer

Configure Identity Protection to block anonymous IP addresses and require password change for high-risk users. Use Conditional Access to require MFA for all users.

Question 13

You work at a mid-sized company that uses Microsoft Defender for Business (a subscription included with Microsoft 365 Business Premium). The company has 300 devices enrolled in Microsoft Intune. Recently, a malware outbreak occurred on several devices. You need to implement a solution that automatically remediates devices that are found to be infected with malware. The solution should isolate the device from the network and run a full scan. Which action should you take?

Accepted Answer

Enable automatic investigation and remediation in Microsoft Defender for Business.. Correct: C. Microsoft Defender for Business includes automated investigation and remediation capabilities that can automatically isolate infected devices and run full scans. Option A: Conditional Access policies control access based on conditions but do not perform remediation actions like isolation or scanning. Option B: Intune compliance policies can mark devices as non-compliant but do not automatically remediate malware. Option D: Configuring Microsoft Defender Antivirus to run a weekly scan is a scheduled task, not an automatic response to detected malware.

Answer

Create a Conditional Access policy to block access for devices with malware.

Answer

Create an Intune compliance policy to mark devices as non-compliant if malware is detected.

Answer

Configure Microsoft Defender Antivirus to run a weekly scan.

Question 14

A company wants to enforce multifactor authentication for all users. Which TWO Microsoft Entra ID features can be used together to achieve this?

Accepted Answer

Conditional Access. Conditional Access policies allow you to enforce multifactor authentication (MFA) based on specific conditions such as user, location, or device state. Authentication methods define the MFA verification options (e.g., Microsoft Authenticator, SMS, OATH tokens) that users can register and use. Together, Conditional Access triggers the MFA requirement, while Authentication methods control which verification methods are available.

Answer

Identity Protection

Answer

Security defaults

Answer

Password protection

Question 15

A company wants to use Microsoft Defender for Cloud to secure their hybrid cloud environment. Which FOUR resource types can be assessed by Defender for Cloud?

Accepted Answer

Azure Virtual Machines. Microsoft Defender for Cloud can assess Azure Virtual Machines (native), AWS EC2 instances via multi-cloud connector, on-premises servers connected via Azure Arc, and Kubernetes clusters (Azure or multi-cloud) via Defender for Containers. On-premises SQL Server without Azure Arc is not directly assessed.

Answer

On-premises SQL Server