SC-900 Describe the capabilities of Microsoft security solutions Practice Test 9 — 15 Questions

Question 1

A security analyst wants to create a custom detection rule that tracks a specific multi-stage attack pattern: a user receives a phishing email, clicks a link, and then a script is executed on their device. The analyst needs to write a Kusto Query Language (KQL) query to detect this pattern and schedule it to run automatically, generating alerts. Which Microsoft 365 Defender capability should they use?

Accepted Answer

Custom detection rules. Custom detection rules in Microsoft 365 Defender allow security analysts to write KQL queries that run on a schedule and automatically generate alerts when the query returns results. This capability is specifically designed to detect multi-stage attack patterns, such as the phishing email → link click → script execution chain described, by querying advanced hunting data and triggering incident creation.

Answer

Advanced hunting

Answer

Automation

Answer

Threat analytics

Question 2

An organization wants to protect against spear-phishing attacks where attackers impersonate the company's CEO or other trusted domains to trick employees into transferring funds. They need a security solution that uses machine learning to detect and prevent such impersonation attempts in incoming emails. Which Microsoft 365 protection feature should they enable?

Accepted Answer

Anti-phishing policy (impersonation protection). Anti-phishing policy with impersonation protection uses machine learning models to detect and block attempts to impersonate specific users (like the CEO) or trusted domains in incoming emails. This directly addresses the scenario of spear-phishing attacks that trick employees into transferring funds by mimicking trusted senders.

Answer

Anti-spam policy

Answer

Safe Links

Answer

Safe Attachments

Question 3

A company uses Microsoft 365 and Microsoft Azure. The security team wants a single portal that provides a unified view of alerts and incidents from their endpoints, email, and cloud applications to accelerate threat investigation and response. Which Microsoft security solution should they use?

Accepted Answer

Microsoft 365 Defender portal. Microsoft 365 Defender portal (now part of the Microsoft 365 Defender unified security operations platform) is designed to aggregate alerts and incidents from endpoints (Microsoft Defender for Endpoint), email (Microsoft Defender for Office 365), and cloud applications (Microsoft Defender for Cloud Apps) into a single queue. This unified view enables security teams to triage and investigate threats across these domains without switching between separate consoles, directly accelerating response times.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Purview Compliance Manager

Question 4

Sequence the steps to enable Microsoft Defender for Cloud Apps for an organization.

Question 5

Arrange the steps to configure multi-factor authentication (MFA) for a user in Azure AD.

Question 6

Match each Microsoft identity service to its description.

Question 7

Match each authentication method to its description.

Question 8

Your organization wants to automatically investigate and remediate email-based threats in Microsoft 365. Which security solution should you use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 is the correct solution because it is specifically designed to protect against email-based threats such as phishing, malware, and business email compromise (BEC). It provides automated investigation and remediation capabilities through features like Automated Investigation and Response (AIR) and Threat Explorer, which can automatically analyze and remediate malicious emails, attachments, and URLs in Exchange Online.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 9

A company must ensure that sensitive data in SharePoint Online is automatically classified and protected. They want to use built-in Microsoft Purview capabilities. Which feature should they implement?

Accepted Answer

Data Loss Prevention policies. Option C is correct because Microsoft Purview Data Loss Prevention (DLP) policies can automatically detect and protect sensitive data. Option A is wrong because sensitivity labels require manual or conditional application. Option B is wrong because retention policies focus on data lifecycle. Option D is wrong because audit logs track activity but don't protect.

Answer

Audit logs

Answer

Sensitivity labels

Answer

Retention policies

Question 10

An organization uses Microsoft Entra ID for identity management. They want to implement a risk-based conditional access policy that requires multi-factor authentication (MFA) when sign-in risk is medium or high. Which policy settings should they configure?

Accepted Answer

Assign 'Sign-in risk' condition to 'Medium and above' and grant 'Require MFA'. Option D is correct because the scenario explicitly requires a risk-based conditional access policy that triggers MFA based on sign-in risk level. In Microsoft Entra ID, the 'Sign-in risk' condition evaluates the likelihood that the authentication attempt is not legitimate, using signals such as anonymous IP addresses, atypical travel, or malware-linked IPs. By setting this condition to 'Medium and above' and granting 'Require MFA', the policy enforces MFA only when the sign-in risk is assessed as medium or high, directly matching the requirement.

Answer

Assign 'User risk' condition to 'Medium and above' and grant 'Require MFA'

Answer

Assign 'Device compliance' condition to 'Compliant' and grant 'Require MFA'

Answer

Assign 'Location' condition to 'All trusted locations' and grant 'Require MFA'

Question 11

Your company wants to use Microsoft Security Copilot to help analysts investigate security incidents. Which data source can Security Copilot ingest to provide contextual insights?

Accepted Answer

Alerts from Microsoft Defender XDR. Option C is correct because Microsoft Security Copilot can ingest alerts from Microsoft Defender XDR. Option A is wrong because Security Copilot does not directly ingest on-premises syslog. Option B is wrong because custom logs from IoT devices require a SIEM. Option D is wrong because third-party threat feeds are not a primary ingestion source for Security Copilot.

Answer

Custom IoT device logs

Answer

Third-party threat intelligence feeds

Answer

On-premises firewall syslog

Question 12

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices with a minimum OS version can access corporate email. What should they configure?

Accepted Answer

Compliance policy and conditional access. Option C is correct because combining a compliance policy (which checks the device OS version against a minimum requirement) with a Conditional Access policy (which blocks access if the device is non-compliant) is the standard Microsoft approach to enforce OS version requirements for accessing corporate email. The compliance policy marks devices below the minimum OS version as non-compliant, and the Conditional Access policy then denies access to Exchange Online or other corporate resources for those non-compliant devices.

Answer

App protection policy

Answer

Device enrollment restriction

Answer

Device configuration profile

Question 13

Your company is deploying Microsoft Entra ID Governance. They want to automate the review of guest user access to Microsoft Teams and remove access when guests leave the partner organization. Which feature should they implement?

Accepted Answer

Access reviews and connected organizations. Access reviews in Microsoft Entra ID Governance allow you to create recurring reviews of guest user access to resources like Microsoft Teams. By configuring the review to include connected organizations, you can automatically remove guest access when the guest's identity is no longer associated with a partner organization, such as when they leave the partner company. This automation is achieved through the integration of access reviews with the connected organization's lifecycle, ensuring that guest access is revoked without manual intervention.

Answer

Entitlement management

Answer

Terms of use

Answer

Password policies

Question 14

A security analyst needs to query Microsoft 365 audit logs to find all activities where a user deleted a file from SharePoint Online in the last 24 hours. Which tool should they use?

Accepted Answer

Microsoft Purview compliance portal audit search. Microsoft Purview compliance portal audit search is the correct tool because it provides a dedicated, searchable interface for querying the Microsoft 365 unified audit log. This log records all user and admin activities, including file deletions from SharePoint Online, and supports time-based filters (e.g., last 24 hours) to retrieve specific events. It is purpose-built for compliance and security investigations without requiring additional licensing or complex scripting.

Answer

Microsoft Sentinel

Answer

Microsoft Graph PowerShell

Answer

Microsoft Defender for Cloud Apps

Question 15

Your organization wants to use Microsoft Defender for Cloud to secure Azure virtual machines. Which feature should they enable to get vulnerability assessment without additional agents?

Accepted Answer

Vulnerability assessment. Microsoft Defender for Cloud includes a built-in vulnerability assessment solution for Azure virtual machines that does not require any additional agents. When enabled, it uses the Qualys scanner integrated directly into the platform to continuously scan for vulnerabilities, providing findings without the need to deploy or manage separate agents on the VMs.

Answer

File integrity monitoring

Answer

Just-in-time VM access

Answer

Adaptive application controls