Describe the capabilities of Microsoft security solutions →hardMultiple ChoiceObjective-mapped

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Refer to the exhibit.

{
  "AlertRule": {
    "DisplayName": "Sensitive file shared externally",
    "Query": "AlertInfo | where AlertName == \"Sensitive file shared externally\" | extend Entities = parse_json(Entities) | mv-expand Entities | where Entities.Type == \"file\" and Entities.SensitivityLabel == \"Highly Confidential\" | project Entities.FileName, Entities.Owner"
  }

Refer to the exhibit. The KQL query is used in a Microsoft Sentinel analytics rule. What is the primary purpose of this rule?

⚠ Common exam trap

Many exam-takers confuse detection rules with automated remediation actions, assuming that a rule that detects external sharing of sensitive files also blocks it, whereas Sentinel rules only generate alerts unless explicitly configured with an automated response (e.g., via a playbook).

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To detect when a file labeled 'Highly Confidential' is shared externally

The KQL query filters for activities where a file labeled 'Highly Confidential' is shared externally, using the `SensitivityLabel` property and the `SharingType` field set to 'ExternalUser'. The rule's primary purpose is to detect such sharing events, not to block them or list all alerts. Option C correctly identifies this detection goal.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To identify all files shared externally regardless of sensitivity
Why it's wrong here
The KQL query explicitly includes a filter for `SensitivityLabel == 'Highly Confidential'`. This condition narrows the scope to only files possessing that specific label, thereby excluding any files shared externally that have different sensitivity labels or no label at all. Therefore, it does not identify *all* externally shared files, but only a subset based on their classification.
✗
To automatically block external sharing of sensitive files
Why it's wrong here
KQL queries are primarily used for data retrieval, analysis, and detection within Microsoft Sentinel or other security platforms. While a KQL query can be part of an alert rule, the query itself does not contain commands or functions to enforce preventative actions like automatically blocking file sharing. Such blocking capabilities are typically configured through Data Loss Prevention (DLP) policies or Conditional Access policies, which are separate enforcement mechanisms.
✓
To detect when a file labeled 'Highly Confidential' is shared externally
Why this is correct
The KQL query is designed to identify specific security events by combining multiple filters. It targets events where files are shared externally (implied by the alert name or event type) and explicitly includes a condition to match `SensitivityLabel == 'Highly Confidential'`. This precise combination ensures that the query effectively detects and flags only those instances where highly confidential data is exposed outside the organization.
✗
To list all alerts generated by the rule
Why it's wrong here
The KQL query is highly specific, filtering not only by a particular `SensitivityLabel` but also by a distinct `AlertName` (or similar event identifier related to external sharing). This granular filtering means the query will only return alerts that precisely match both the specified alert type *and* the 'Highly Confidential' label, rather than providing a comprehensive list of *all* alerts that the underlying rule might generate for various other conditions or labels.

Go deeper

SC-900 Practice Question: Describe the capabilities of Microsoft security solutions

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question