Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

```json
{
  "properties": {
    "policyType": "Detection",
    "displayName": "Suspicious sign-in after MFA bypass",
    "severity": "High",
    "tactics": ["InitialAccess", "LateralMovement"],
    "alertDetails": {
      "description": "A user bypassed MFA and signed in from an unusual location."
    }
  }
}
```

Refer to the exhibit. A security analyst is reviewing a Microsoft Defender XDR alert. Which two tactics identified are most relevant? (This is a multiple-choice question asking which two tactics are shown, but the format is single answer. We need to adjust: The question asks: 'Which two tactics are identified?' The correct answer is the option listing both 'InitialAccess and LateralMovement'.)

⚠ Common exam trap

A common mix-up: candidates confuse LateralMovement with PrivilegeEscalation or Exfiltration, but the alert's focus on moving between systems (not escalating privileges or stealing data) clearly points to InitialAccess and LateralMovement as the two most relevant tactics.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

InitialAccess and LateralMovement

The exhibit shows a Microsoft Defender XDR alert indicating that an attacker gained initial access (e.g., via a phishing link or compromised credential) and then moved laterally within the network (e.g., using remote desktop or SMB). These two stages correspond directly to the InitialAccess and LateralMovement tactics in the MITRE ATT&CK framework, which are the most relevant based on the alert details.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
LateralMovement and PrivilegeEscalation
Why it's wrong here
This option is incorrect because the alert details, as presented in the exhibit, do not include any indicators or activities corresponding to the Privilege Escalation tactic. While Lateral Movement might be present, the inclusion of Privilege Escalation, which involves an adversary attempting to gain higher-level permissions on a system or network, makes this combination an inaccurate representation of the observed alert. The exhibit specifically highlights different tactical objectives.
✗
LateralMovement and Exfiltration
Why it's wrong here
This option is incorrect because the Exfiltration tactic is not identified within the security alert's details. Exfiltration involves the adversary stealing data from the network, typically by compressing, encrypting, or otherwise packaging it for removal. Although Lateral Movement might be a component of the alert, the absence of any evidence suggesting data theft means this option does not accurately reflect the complete set of tactics observed.
✗
InitialAccess and Persistence
Why it's wrong here
This option is incorrect because the alert does not indicate any activities related to the Persistence tactic. Persistence describes techniques adversaries use to maintain their foothold in an environment across reboots, credential changes, or other interruptions, such as installing backdoors or creating new accounts. While Initial Access is correctly identified as a tactic, the lack of evidence for maintaining long-term access makes the inclusion of Persistence inaccurate for this specific alert.
✓
InitialAccess and LateralMovement
Why this is correct
This option is correct because the security alert explicitly details activities consistent with both the Initial Access and Lateral Movement tactics. Initial Access refers to the methods adversaries use to gain their first foothold in a network, such as through phishing or exploiting a public-facing application. Lateral Movement then describes the techniques used to navigate and expand control within the compromised environment, often involving remote services or internal spearphishing, directly aligning with the observed alert indicators.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question