SC-900 Practice Question: Describe the capabilities of Microsoft compliance solutions

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Preventive: Firewall rules blocking unauthorized traffic

  Why this is correct

  Firewall rules blocking unauthorized traffic are a classic example of a preventive security control. These rules are configured to inspect incoming and outgoing network packets, dropping any traffic that violates predefined security policies, such as specific IP addresses, ports, or protocols. By actively denying malicious or unauthorized connections before they can establish, firewalls effectively stop incidents from occurring in the first place, safeguarding network perimeters.

• ✓

  Detective: Intrusion detection system monitoring network traffic

  Why this is correct

  An Intrusion Detection System (IDS) monitoring network traffic exemplifies a detective security control. An IDS passively observes network activity or system logs, comparing patterns against known attack signatures or behavioral baselines to identify suspicious or malicious actions. Its primary function is to detect ongoing threats or anomalies after they have begun but before significant damage is inflicted, subsequently generating alerts for security personnel to investigate.

• ✓

  Corrective: Backup and restore procedures

  Why this is correct

  Backup and restore procedures are a fundamental corrective security control. In the event of data corruption, accidental deletion, system failure, or a successful cyberattack like ransomware, these procedures enable an organization to revert systems and data to a previous, uncompromised state. This capability is crucial for remediating the impact of an incident, minimizing downtime, and restoring operational continuity after a security breach.

• ✗

  Preventive: Intrusion detection system monitoring network traffic

  Why it's wrong here

  Categorizing an Intrusion Detection System (IDS) as a preventive control is incorrect because an IDS primarily functions by observing and alerting on suspicious activities *after* they have occurred or are in progress. While an IDS is vital for identifying threats, it does not actively block or stop an attack from happening in the first place. Its role is to detect and notify, rather than to prevent initial access or execution.

• ✗

  Detective: Backup and restore procedures

  Why it's wrong here

  Classifying backup and restore procedures as a detective control is incorrect because their purpose is not to identify or monitor for suspicious activities. Backup and restore mechanisms are implemented to recover from an incident *after* it has been detected and caused damage, such as data loss or system compromise. They serve as a post-incident remediation tool, rather than a real-time threat identification system.

• ✗

  Corrective: Firewall rules blocking unauthorized traffic

  Why it's wrong here

  Labeling firewall rules blocking unauthorized traffic as a corrective control is inaccurate because firewalls are designed to prevent incidents, not to remediate them. Firewall rules proactively inspect and block malicious or unauthorized traffic from entering or leaving a network *before* an attack can occur or cause harm. Their function is proactive defense and access control, not reactive recovery or damage repair after a security event.