SC-900 Describe the capabilities of Microsoft security solutions Practice Test 6 — 15 Questions

Question 1

A security team wants to discover all cloud apps being used by employees, including unsanctioned personal apps like unauthorized file-sharing services. They plan to analyze firewall logs to identify traffic patterns and assess each app's risk score. Which feature of Microsoft Defender for Cloud Apps should they enable?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs (e.g., from firewalls or proxies) to identify all cloud apps in use, including unsanctioned personal apps like unauthorized file-sharing services. It then assesses each app's risk score based on over 80 risk factors, such as encryption standards and data residency, enabling the security team to discover and evaluate shadow IT.

Answer

App Governance

Answer

Information Protection

Answer

Conditional Access App Control

Question 2

A security analyst needs to detect and investigate compromised identities in on-premises Active Directory. They want to monitor for lateral movement, reconnaissance, and credential theft using behavioral analytics. Which Microsoft security solution is designed specifically for this purpose?

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender for Identity (MDI) is a cloud-based security solution that leverages on-premises Active Directory signals to identify, detect, and investigate advanced threats like lateral movement, reconnaissance, and credential theft. It uses behavioral analytics and machine learning to profile user and entity behavior, alerting on suspicious activities such as Pass-the-Hash, DCSync, and Kerberoasting without requiring agents on domain controllers.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 3

A company uses Microsoft 365 E5 and is concerned about advanced phishing attacks that use adversary-in-the-middle (AiTM) techniques to steal session cookies and bypass multifactor authentication. Which Microsoft Defender for Office 365 feature should they configure to specifically protect against this type of attack?

Accepted Answer

Anti-Phishing (advanced policies). Advanced anti-phishing policies in Defender for Office 365 include protection against adversary-in-the-middle (AiTM) attacks by using machine learning models and impersonation detection to analyze and block phishing attempts that aim to steal session cookies and bypass multifactor authentication. This feature specifically detects and mitigates sophisticated phishing techniques that traditional anti-spam or link-checking mechanisms might miss, such as real-time credential harvesting and session hijacking via proxy servers.

Answer

Safe Attachments

Answer

Safe Links

Answer

Campaign Views

Question 4

A security operations team uses Microsoft Defender for Cloud and has connected their AWS and GCP accounts. They want to continuously assess the security posture of AWS EC2 instances against the CIS AWS Foundations Benchmark and receive prioritized recommendations. Which feature of Defender for Cloud should they use?

Accepted Answer

Cloud Security Posture Management (CSPM). Option A is correct because Cloud Security Posture Management (CSPM) in Microsoft Defender for Cloud is specifically designed to continuously assess the security posture of multi-cloud resources (including AWS EC2 instances) against industry benchmarks like the CIS AWS Foundations Benchmark. CSPM provides a compliance dashboard, prioritized recommendations, and automated remediation guidance, directly addressing the team's need for ongoing assessment and prioritized recommendations.

Answer

Microsoft Defender for Servers

Answer

Security Alerts

Answer

Workload protections

Question 5

A security team wants to receive a unified security posture assessment for their hybrid workloads including Azure VMs, on-premises SQL servers, and AWS EC2 instances. They need to get actionable recommendations to harden configurations and improve their overall security score. Which Microsoft security solution provides this capability?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a unified security posture assessment across hybrid and multi-cloud workloads, including Azure VMs, on-premises SQL servers, and AWS EC2 instances. It continuously assesses configurations against security baselines (e.g., Azure Security Benchmark, CIS controls) and generates a secure score with actionable recommendations to harden resources. This aligns directly with the requirement for a single dashboard covering all listed workload types.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 6

A security team wants to discover all cloud applications being used by employees, including unsanctioned file sharing and collaboration apps. They plan to analyze traffic logs from their network firewall to identify usage patterns and assess each app's risk level. Which feature of Microsoft Defender for Cloud Apps should they enable?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes traffic logs from network firewalls and proxies to identify all cloud applications in use, including unsanctioned ones. It uses the Microsoft Defender for Cloud Apps catalog to assess each app's risk level based on factors like security posture, compliance certifications, and industry standards. This directly matches the scenario of discovering unsanctioned file sharing and collaboration apps from firewall logs.

Answer

App Connectors

Answer

Conditional Access App Control

Answer

Information Protection

Question 7

A security team wants to discover which cloud applications are being used by employees, including unsanctioned file-sharing and collaboration apps. They plan to upload network traffic logs from their firewall to analyze app usage and risk levels. Which feature of Microsoft Defender for Cloud Apps should they enable?

Accepted Answer

Cloud Discovery. Cloud Discovery is the correct feature because it analyzes network traffic logs (uploaded from firewalls or proxies) to identify which cloud applications are in use, including unsanctioned file-sharing and collaboration apps. It provides a risk score for each discovered app, enabling the security team to assess usage and enforce governance policies.

Answer

App Governance

Answer

Conditional Access App Control

Answer

Information Protection

Question 8

A company uses Microsoft 365 and sanctioned cloud apps like Salesforce and Box. The security team wants to prevent users from downloading sensitive documents from these apps when accessing from unmanaged personal devices, while still allowing read-only access. They need real-time session monitoring and control. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps provides real-time session monitoring and control via its Conditional Access App Control feature. This allows administrators to enforce policies that block downloads or restrict access to sensitive data based on device compliance, such as blocking downloads from unmanaged personal devices while permitting read-only access. The solution integrates with sanctioned cloud apps like Salesforce and Box to apply these controls at the session level.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Endpoint

Question 9

A security team wants to monitor and proactively defend against cyber threats across their entire infrastructure, including Azure virtual machines, on-premises servers, and AWS workloads. They need a unified solution that provides endpoint detection and response (EDR), vulnerability management, and threat hunting capabilities. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (B) is the correct answer because it provides unified endpoint detection and response (EDR), vulnerability management, and threat hunting across heterogeneous environments, including Azure VMs, on-premises servers, and AWS workloads. It extends beyond Windows to support Linux and macOS endpoints, and can be onboarded via Microsoft Defender for Cloud for multi-cloud visibility, making it the single solution that meets all the stated requirements.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 10

A company runs critical applications on Azure virtual machines and on-premises SQL servers. The security team wants to reduce VM attack surface by allowing just-in-time (JIT) access to RDP and SSH ports only when needed. Additionally, they need to monitor changes to important registry keys and system files on the SQL servers. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides just-in-time (JIT) VM access to reduce the attack surface by locking down inbound traffic to RDP (port 3389) and SSH (port 22) until a user requests access. It also includes adaptive application controls and file integrity monitoring (FIM) to track changes to registry keys and system files on both Azure VMs and on-premises SQL servers. This makes it the single solution that addresses both requirements.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Question 11

A security operations center (SOC) wants to enrich their detection capabilities by automatically correlating internal network logs with external threat intelligence feeds containing known malicious IP addresses and domains. They need to ingest, normalize, and prioritize these indicators and generate alerts when matches are found. Which Microsoft security solution provides built-in capabilities for this purpose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM (Security Information and Event Management) solution that provides built-in capabilities to ingest logs from internal network sources, normalize them using common data models, and automatically correlate them with external threat intelligence feeds (e.g., STIX/TAXII). It can prioritize indicators based on severity and generate real-time alerts when matches are found, making it the correct choice for this SOC requirement.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Endpoint

Answer

Microsoft 365 Defender

Question 12

A security analyst needs to investigate a potential malware outbreak that started on an on-premises Windows server several days ago. They want to trace the attack timeline, see which files were modified, and understand how the attacker moved laterally across the network. Which Microsoft solution provides advanced endpoint detection and response (EDR) for on-premises servers?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) provides advanced endpoint detection and response (EDR) capabilities, including behavioral-based detection, automated investigation, and threat analytics. For on-premises Windows servers, MDE can be deployed via Microsoft Defender for Cloud (formerly Azure Security Center) or directly, enabling full attack timeline reconstruction, file modification tracking, and lateral movement path analysis through its rich telemetry and incident graph.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Identity

Question 13

A security operations team needs a solution that can detect and stop ransomware attacks on Windows servers and desktops in real time. They also want the ability to automatically isolate affected devices and, if necessary, roll back files modified by ransomware using a built-in recovery feature. Which Microsoft security solution provides these capabilities?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint (MDE) provides real-time detection and automated response to ransomware attacks on Windows servers and desktops. Its built-in attack surface reduction rules, endpoint detection and response (EDR), and automated investigation and remediation capabilities allow automatic device isolation. Additionally, MDE includes a file recovery feature that leverages Volume Shadow Copy to roll back files modified by ransomware, meeting all stated requirements.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Cloud

Question 14

A healthcare organization runs a mix of workloads on Azure (Azure VMs, SQL Database) and on-premises (Windows Servers). They must continuously assess their compliance against the HIPAA and HITRUST regulatory frameworks. They want a unified dashboard that shows their compliance score against these standards and provides step-by-step recommendations to remediate violations. Which Microsoft Defender for Cloud capability should they use?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Microsoft Defender for Cloud provides a unified view of an organization's compliance posture against specific regulatory standards like HIPAA and HITRUST. It displays a compliance score for each selected framework and offers step-by-step remediation recommendations for identified violations, directly meeting the requirement for continuous assessment and guided remediation.

Answer

Secure score

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Servers

Question 15

A security team manages a hybrid environment with Azure VMs and on-premises Windows servers. They want a single dashboard that provides continuous assessment of security posture, actionable recommendations to harden configurations, and integration with Microsoft Defender for Cloud to detect threats. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (MDC) is the correct solution because it provides a unified dashboard for continuous security posture assessment, actionable hardening recommendations based on the Secure Score, and native integration with Microsoft Defender for Cloud's threat detection capabilities. It supports hybrid environments, covering both Azure VMs and on-premises Windows servers via Azure Arc, and delivers the specific requirements of posture assessment, recommendations, and threat detection in a single pane of glass.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Endpoint