SC-900 Describe the capabilities of Microsoft security solutions Practice Test 4 — 15 Questions

Question 1

Your company uses Microsoft Purview Data Lifecycle Management. You need to automatically delete all emails in users' mailboxes that are older than three years, except for emails that have a legal hold. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A retention policy with a retention action of 'Delete items' and an adaptive scope for Exchange mailboxes. A retention policy with retention action 'Delete items' and an adaptive scope can target all mailboxes, automatically deleting items older than the specified period while inherently respecting legal holds. Option B is incorrect because a data loss prevention (DLP) policy is designed to prevent sensitive data from leaving the organization, not to automatically delete items based on age. Option C is incorrect because while retention labels can be used for deletion, a retention policy is the primary and more direct mechanism for applying broad, age-based deletion rules across an entire location like Exchange mailboxes. Option D is incorrect because a sensitivity label is used for classifying and protecting sensitive data, not for deleting items.

Answer

A data loss prevention (DLP) policy for Exchange

Answer

A retention label with auto-labeling for all Exchange emails

Answer

A sensitivity label with mandatory labeling

Question 2

Which TWO actions can be performed using Microsoft Purview Communication Compliance? (Choose two.)

Accepted Answer

Review messages for potential regulatory compliance violations. Microsoft Purview Communication Compliance is designed to help organizations detect, capture, and act on inappropriate messages that may violate regulatory standards or corporate policies. Option B is correct because the solution allows designated reviewers to examine emails and Microsoft Teams messages for potential regulatory compliance violations, such as insider trading or harassment, by applying customizable policy templates and machine learning classifiers. Option C is also correct as Communication Compliance policies can be configured to detect specific types of confidential information (e.g., sensitive information types, keywords) within communications, flagging them for review by compliance officers.

Answer

Automatically encrypt emails containing sensitive data

Answer

Prevent the sharing of sensitive data with external users

Answer

Enforce retention policies for communications

Question 3

Which THREE capabilities are provided by Microsoft Defender for Cloud Apps? (Choose three.)

Accepted Answer

Threat detection to identify malicious behavior in cloud apps. Microsoft Defender for Cloud Apps offers several key capabilities. **Threat detection** (Option A) uses behavioral analytics and anomaly detection to identify malicious activities like compromised accounts or unusual data exfiltration across connected cloud apps. **Cloud Discovery** (Option B) helps identify and assess 'shadow IT' by discovering cloud apps used within the organization. **Information protection** (Option E) integrates with Microsoft Purview Information Protection to apply sensitivity labels and enforce data governance policies on files stored in cloud applications.

Answer

Email scanning and remediation

Answer

Endpoint detection and response (EDR)

Question 4

You are the security architect for a financial services company that uses Microsoft 365 E5. The company has recently deployed Microsoft Defender for Office 365 and Microsoft Defender for Cloud Apps. The security team wants to detect when users are accessing corporate data from personal devices that are not managed by Microsoft Intune. You need to implement a solution that alerts the security team when a user accesses Microsoft 365 resources from an unmanaged device. The solution should also allow the user to continue working but with limited capabilities, such as preventing download of files. Which of the following should you configure?

Accepted Answer

Create a session policy in Microsoft Defender for Cloud Apps that monitors and controls access based on device compliance. Session policies in Microsoft Defender for Cloud Apps (MDCAS), leveraging Conditional Access App Control, are designed to monitor and control user sessions in real-time based on various conditions, including device compliance status. This allows for granular controls like preventing downloads, uploads, or copy/paste, while still allowing the user to access resources with limited capabilities. This directly addresses the requirement to 'allow the user to continue working but with limited capabilities, such as preventing download of files' from unmanaged devices.

Option B is incorrect because a device compliance policy in Microsoft Intune defines what constitutes a compliant or non-compliant device. While essential for identifying unmanaged devices, it does not, by itself, enforce access restrictions or session controls.

Option C is incorrect because app protection policies (MAM) in Microsoft Intune apply to specific mobile or desktop applications and control data within those apps or between managed/unmanaged apps. They do not control browser-based access to Microsoft 365 resources from unmanaged devices in the way a session policy does.

Option D is incorrect because a Conditional Access policy in Microsoft Entra ID can block access or grant access. While it can be configured to grant access with session controls (by integrating with MDCAS), a standalone Conditional Access policy cannot provide the granular 'limited capabilities' like preventing downloads. If configured to simply block access, it would not meet the requirement to 'allow the user to continue working but with limited capabilities'.

Answer

Create a device compliance policy in Microsoft Intune that marks unmanaged devices as non-compliant

Answer

Create an app protection policy in Microsoft Intune that prevents data transfer from managed apps

Answer

Create a conditional access policy in Microsoft Entra ID that blocks access from unmanaged devices

Question 5

Which TWO of the following are capabilities of Microsoft Defender for Cloud Apps? (Select TWO.)

Accepted Answer

Control access with Conditional Access App Control. Microsoft Defender for Cloud Apps includes Conditional Access App Control, which enforces access and session policies on cloud apps in real time. This capability uses reverse proxy architecture to monitor and control user actions, such as blocking downloads or requiring multi-factor authentication, based on conditions like device state or user risk. Additionally, Defender for Cloud Apps provides Cloud Discovery, a capability that identifies and assesses all cloud apps used in an organization (both sanctioned and unsanctioned, often referred to as 'shadow IT') by analyzing traffic logs from firewalls and proxies, helping organizations gain visibility and control over their cloud app landscape.

Answer

Enforce device compliance policies

Answer

Provide threat analytics reports

Answer

Classify sensitive data across cloud apps

Question 6

You are responsible for Microsoft Purview Information Protection at a law firm that handles highly confidential client documents. The firm uses Microsoft 365 E5. You need to ensure that any document containing the phrase 'Attorney-Client Privileged' is automatically labeled with a 'Highly Confidential' sensitivity label and encrypted. Additionally, if a user attempts to send such a document via email outside the organization, the action should be blocked and the user should be prompted with a policy tip. You have already created the sensitivity label with encryption settings. What should you do next?

Accepted Answer

Create an auto-labeling policy for the label, and create a DLP policy that detects the label and blocks external sharing with a policy tip.. {"A":"A DLP policy cannot automatically apply a sensitivity label. Auto-labeling policies are required for that.","C":"While auto-labeling is correct, a mail flow rule is not the most appropriate or comprehensive solution for detecting sensitivity labels and providing policy tips for blocking external sharing across M365 services; a DLP policy is specifically designed for this.","D":"The stem requires *automatic* labeling, not manual labeling."}

Answer

Create a DLP policy that detects the phrase and automatically applies the label, then blocks external sharing.

Answer

Create an auto-labeling policy for the label, and create a mail flow rule in Exchange to block external emails with that label.

Answer

Create a manual labeling policy and train users to apply the label, then create a DLP policy.

Question 7

A company uses Microsoft 365 E5 and wants to protect against advanced cyber threats. Which THREE capabilities of Microsoft Defender XDR should they implement?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 is correct because it provides advanced threat protection specifically for email, Office applications, and collaboration tools, including features like Safe Attachments, Safe Links, and anti-phishing policies that directly address advanced cyber threats targeting productivity suites. Microsoft Defender for Endpoint is correct because it delivers endpoint detection and response (EDR), next-generation antivirus, and threat hunting capabilities to protect devices from sophisticated malware and fileless attacks. Microsoft Defender for Cloud Apps is also a core component of Microsoft Defender XDR and provides cloud access security broker (CASB) capabilities, protecting cloud apps and services from threats.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 8

An organization is using Microsoft Purview Compliance Portal to manage data lifecycle. Which FOUR actions can be performed using retention labels?

Accepted Answer

Trigger a disposition review at the end of retention. Retention labels in Microsoft Purview can be configured to: 
- Apply a retention period to content (Option C).
- Trigger a disposition review at the end of the retention period (Option A).
- Automatically delete content after a specified period (Option B).
- Mark content as a regulatory record (Option E), which applies stricter controls to prevent modification or deletion.

Answer

Block sharing of sensitive information via email

Question 9

A security analyst is using Microsoft Sentinel to investigate an incident. Which THREE data sources can be ingested into Sentinel?

Accepted Answer

Azure Active Directory logs. Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) and SOAR solution that ingests data from a wide range of Microsoft and third-party sources. Azure Active Directory logs (Option B) provide sign-in and audit logs, which are critical for identity-based threat detection and investigation in Sentinel. Office 365 logs (Option C) offer audit data from services like Exchange, SharePoint, and Teams, essential for monitoring user activity and data access within Microsoft 365. Windows Security Events (Option D) from servers and workstations provide detailed insights into system activities, login attempts, and process executions, vital for endpoint security monitoring.

Answer

Power BI usage metrics

Answer

Azure DevOps audit logs

Question 10

An organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. Which THREE actions can be taken automatically when a DLP policy matches?

Accepted Answer

Show a policy tip to the user. Microsoft Purview DLP policies can automatically take several actions to protect sensitive data. Displaying a policy tip to the user (C) provides real-time guidance and warnings, informing them of policy violations and offering options to override or justify. Encrypting the sensitive content (D) automatically applies protection to data, such as emails or files, to prevent unauthorized access. Blocking the sharing of sensitive data (E) directly prevents unauthorized disclosure or movement of sensitive information. Deleting sensitive content (B) is not a function of DLP, which focuses on prevention and protection rather than data destruction. While DLP can send notifications, option A ('Automatically notify the legal department') is not considered one of the primary, generic automatic enforcement actions on the data or user interaction; notifications are typically sent to specific policy owners or security administrators for incident management.

Answer

Automatically notify the legal department

Answer

Delete the sensitive content

Question 11

A company uses Microsoft Defender for Cloud to secure its environment. Which TWO plans are available?

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is a foundational plan in Microsoft Defender for Cloud that continuously assesses your Azure, hybrid, and multi-cloud resources against security benchmarks (e.g., CIS, NIST, Azure Security Benchmark) to identify misconfigurations and compliance gaps. It is available as a free, basic plan that provides secure score and recommendations, making it a core offering of Defender for Cloud.

Defender for Servers is one of the many workload protection plans offered by Microsoft Defender for Cloud. These plans provide advanced, dedicated security capabilities for specific resource types, such as virtual machines, SQL databases, storage accounts, and containers, extending beyond the foundational CSPM capabilities. Each workload protection plan, like Defender for Servers, is a distinct paid offering within Defender for Cloud.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Identity

Question 12

A security administrator is configuring Microsoft Entra ID Conditional Access. Which THREE conditions can be included in a policy?

Accepted Answer

User risk. Location is a correct condition because Microsoft Entra ID Conditional Access policies can be configured to evaluate the geographic location or IP subnet from which a sign-in attempt originates. This allows administrators to enforce controls such as requiring multi-factor authentication or blocking access entirely when users attempt to sign in from untrusted or unfamiliar locations. The location condition is defined using named locations, which can be based on IP ranges or country/region.

Answer

Authentication strength

Answer

Application

Question 13

A security administrator is using Microsoft Defender for Cloud to improve the security posture of Azure resources. The administrator wants to view a consolidated assessment of compliance with industry standards such as CIS and NIST. Which feature should be used?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a consolidated view of compliance with industry standards like CIS and NIST. It continuously assesses Azure resources against built-in compliance frameworks and displays the results in a dashboard, showing which controls are passing or failing. This directly meets the administrator's need to view a consolidated assessment of compliance with those specific standards.

Answer

Secure Score

Answer

Azure Policy

Answer

Microsoft Sentinel

Question 14

An organization uses Microsoft 365 Defender. The security team receives an alert about a potential malware outbreak on multiple endpoints, and they need an integrated view that correlates signals from various Microsoft security solutions. Which Microsoft 365 Defender portal component provides this unified view?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com). The Microsoft 365 Defender portal (security.microsoft.com) is the correct answer because it provides a unified view of alerts and incidents across Microsoft 365 Defender components, including Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This integrated correlation enables security teams to see the full scope of a potential malware outbreak across multiple endpoints by combining signals from these solutions into a single incident timeline.

Answer

Microsoft Defender for Cloud

Answer

Azure Sentinel

Answer

Microsoft Defender for Identity

Question 15

A security team is evaluating Microsoft security solutions to monitor user activities across multiple SaaS applications, including Salesforce and Dropbox, for signs of compromised accounts and data exfiltration. Which solution is specifically designed for this purpose?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides deep visibility, data classification, and threat detection across SaaS applications like Salesforce and Dropbox. It uses behavioral analytics and anomaly detection to identify compromised accounts and data exfiltration by monitoring user activities and applying policies such as activity policies and app governance.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft 365 Defender