How many Troubleshooting Scenario Questions questions are on this page?

This page has 15 Troubleshooting Scenario Questions scenario questions for the SC-900 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SC-900 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft Security, Compliance, and Identity Fundamentals SC-900 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Microsoft Security, Compliance, and Identity Fundamentals SC-900 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SC-900

exam code

Microsoft

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummultiple choice

Read the full NAT/PAT explanation →

A company uses Microsoft Entra ID and wants to automatically detect potential security risks such as leaked credentials and suspicious sign-in patterns. They also need the ability to investigate these risks and configure automated responses based on risk levels. Which Microsoft Entra capability should they use?

A
Microsoft Entra ID Governance
Why wrong: Entra ID Governance focuses on identity lifecycle, access certifications, and entitlement management, not on risk detection and automated responses.
B
Microsoft Entra Identity Protection
Identity Protection is the correct service for detecting identity risks and enabling automated risk-based policies such as requiring MFA or password changes.
C
Microsoft Entra Privileged Identity Management (PIM)
Why wrong: PIM manages time-bound access to privileged roles and monitors role activations, but does not detect general identity risks like leaked credentials.
D
Microsoft Entra Domain Services
Why wrong: Entra Domain Services provides domain services (join, group policy) for Azure VMs without a domain controller, not identity risk detection.

Full breakdown with real-world context →

Question 2hardmultiple choice

Full question →

A security operations team uses Microsoft 365 Defender and wants to detect, investigate, and automatically respond to advanced identity-based attacks targeting on-premises Active Directory, such as Pass-the-Hash (PtH) and Golden Ticket attacks. They also need to integrate these alerts into Microsoft Sentinel for central incident management. Which Microsoft security solution provides these capabilities?

A
Microsoft Defender for Identity
Defender for Identity is specifically designed to protect on-premises Active Directory from advanced identity attacks and provides automated investigation and response.
B
Microsoft Defender for Cloud Apps
Why wrong: Defender for Cloud Apps focuses on monitoring and controlling cloud application usage, not on-premises Active Directory attacks.
C
Microsoft Defender for Endpoint
Why wrong: Defender for Endpoint provides endpoint detection and response (EDR) for devices, not specialized protection for on-premises AD identity attacks.
D
Microsoft Defender for Office 365
Why wrong: Defender for Office 365 protects against threats in email and Office applications, not against on-premises Active Directory attacks.

Full breakdown with real-world context →

Question 3mediumdrag order

Full question →

Arrange the steps to investigate a user compromise using Azure AD Identity Protection.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 4mediummultiple choice

Full question →

A security operations team investigates a multi-stage attack that began with a phishing email, then moved to credential compromise, and finally to lateral movement on endpoints. They need a single pane of glass to view the entire attack story, including the initial email, the compromised user's sign-in activities, and processes on affected devices. Which Microsoft security solution provides this unified investigation experience?

A
Microsoft Sentinel
Why wrong: Sentinel is a cloud-native SIEM that can ingest logs from various sources, but it does not provide native, pre-built correlation across all M365 workloads like Microsoft 365 Defender does.
B
Microsoft Defender for Cloud
Why wrong: Defender for Cloud protects cloud workloads but does not unify email and identity threat data.
C
Microsoft 365 Defender
Microsoft 365 Defender unifies alerts and incidents from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps into a single view.
D
Microsoft Defender for Identity
Why wrong: Defender for Identity focuses on on-premises Active Directory threats; it does not provide the full cross-domain investigation.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A security operations team needs to protect their organization's Windows 10 and Windows 11 devices from advanced persistent threats (APTs), ransomware, and fileless malware. They also require a centralized dashboard to view device security posture, investigate incidents, and perform proactive threat hunting using advanced queries. Which Microsoft security solution should they deploy?

A
Microsoft Defender for Endpoint
Defender for Endpoint provides comprehensive endpoint protection, including EDR, threat hunting, and a centralized security operations console for Windows devices.
B
Microsoft Defender for Office 365
Why wrong: Defender for Office 365 protects email and collaboration tools from phishing and malware, but does not manage endpoint security or provide threat hunting on devices.
C
Microsoft Defender for Identity
Why wrong: Defender for Identity monitors on-premises Active Directory for identity-based attacks, not endpoint device security.
D
Microsoft Defender for Cloud Apps
Why wrong: Defender for Cloud Apps is a CASB that provides visibility and control over cloud app usage, but it does not secure endpoints directly.

Full breakdown with real-world context →

Question 6easymultiple choice

Full question →

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

A
Self-Service Password Reset (SSPR)
SSPR enables users to reset their own passwords if configured.
B
Password reset admin portal
Why wrong: The admin portal is for administrators to reset passwords, not self-service.
C
Identity Protection
Why wrong: Identity Protection detects risks but does not reset passwords.
D
Privileged Identity Management
Why wrong: PIM manages privileged role activation, not password reset.

Full breakdown with real-world context →

Question 7easymultiple choice

Full question →

Your company wants to use Microsoft Security Copilot to help analysts investigate security incidents. Which data source can Security Copilot ingest to provide contextual insights?

A
Alerts from Microsoft Defender XDR
Security Copilot integrates with Microsoft 365 Defender.
B
Custom IoT device logs
Why wrong: Not a standard data source for Security Copilot.
C
Third-party threat intelligence feeds
Why wrong: Not directly ingested; requires integration via Sentinel.
D
On-premises firewall syslog
Why wrong: Not directly ingested by Security Copilot.

Full breakdown with real-world context →

Question 8easymultiple choice

Full question →

Your organization uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on several endpoints. Which feature allows you to search for indicators of compromise (IOCs) across all endpoints?

A
Incidents and alerts
Why wrong: Incidents and alerts show triggered events, not search for custom IOCs.
B
Advanced hunting
Advanced hunting uses KQL to search for IOCs across endpoints in Defender for Endpoint.
C
Threat analytics
Why wrong: Threat analytics provides overview of threats but not interactive search across endpoints.
D
Device inventory
Why wrong: Device inventory lists devices but does not allow searching for IOCs.

Full breakdown with real-world context →

Question 9mediummultiple choice

Full question →

A security analyst needs to investigate a phishing campaign that targeted multiple users. They want to correlate email threat data with user actions and device signals. Which Microsoft security solution should they use as the primary investigation console?

A
Microsoft Defender for Endpoint
Why wrong: It covers endpoints but not email or identity comprehensively.
B
Microsoft Defender for Office 365
Why wrong: It covers email but not devices or identities.
C
Microsoft 365 Defender
It provides cross-domain incident correlation and investigation across email, endpoints, identities, and cloud apps.
D
Microsoft Sentinel
Why wrong: Sentinel can correlate data but is not the native investigation console for Defender incidents.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

Refer to the exhibit. A security analyst is reviewing an alert from Microsoft 365 Defender. The alert is associated with an incident. What is the best first step to investigate this alert?

Exhibit

{
  "alerts": [
    {
      "id": "alert-123",
      "title": "Suspicious inbound email with malware",
      "category": "Malware",
      "severity": "High",
      "incidentId": "inc-456"
    }
  ]
}

A
Open the associated incident to view all related alerts and entities.
Investigating the incident provides a holistic view of the attack.
B
Isolate the affected user's device immediately.
Why wrong: Isolation may be necessary but should be done after understanding the full incident context.
C
Mark the alert as resolved.
Why wrong: Resolving without investigation could miss related threats.
D
Run an automated simulation to test the alert.
Why wrong: Simulations are for testing detection, not for live investigation.

Full breakdown with real-world context →

Question 11easymultiple choice

Full question →

You are the security administrator for a company using Microsoft Defender XDR. A user reports receiving a suspicious email with a link. What Microsoft Defender XDR feature should you use to investigate the email's threat level?

A
Email & collaboration in Microsoft Defender XDR
This provides email threat investigation.
B
Microsoft Defender for Endpoint
Why wrong: This is for endpoint threats, not email.
C
Microsoft Defender for Cloud Apps
Why wrong: This is for cloud app security, not email.
D
Microsoft Defender for Identity
Why wrong: This is for identity threats, not email.

Full breakdown with real-world context →

Question 12hardmultiple choice

Full question →

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to investigate ransomware alerts. The query returns: AlertSeverity High: 5, Medium: 3, Low: 2. The security team wants to automate a response for all high-severity ransomware alerts. What should you configure?

Exhibit

Refer to the exhibit.

```kql
SecurityAlerts
| where Timestamp > ago(7d)
| where AlertName has "ransomware"
| summarize Count=count() by AlertSeverity
| order by Count desc
```

A
Create an analytics rule for ransomware
Why wrong: Analytics rules generate alerts, not automate responses.
B
Create a hunting query for ransomware
Why wrong: Hunting is for manual investigation.
C
Create a workbook to display ransomware alerts
Why wrong: Workbooks visualize data.
D
Create an automation rule that triggers a playbook for high-severity ransomware incidents
Automation rules enable automated response.

Full breakdown with real-world context →

Question 13hardmultiple choice

Full question →

You are troubleshooting a Conditional Access policy in Microsoft Entra ID. The policy in the exhibit is not blocking some sign-ins that you expected to block. What is the most likely reason?

Exhibit

Refer to the exhibit.
```json
{
  "displayName": "Block high-risk sign-ins",
  "conditions": {
    "userRiskLevels": ["high"],
    "signInRiskLevels": []
  },
  "grantControls": {
    "builtInControls": ["block"]
  }
}
```

A
The policy only blocks based on user risk, not sign-in risk
The conditions only include userRiskLevels, not signInRiskLevels.
B
The policy is not assigned to any users
Why wrong: No assignment info is shown, but that is not indicated as issue.
C
The grant control is set to allow access
Why wrong: Grant control is set to block.
D
The policy excludes certain users
Why wrong: No exclude clause is shown.

Full breakdown with real-world context →

Question 14hardmultiple choice

Full question →

You are troubleshooting a Windows device that is reporting as non-compliant in Microsoft Intune. The exhibit shows the output of a PowerShell command run on the device. Based on the output, which component is likely misconfigured?

Exhibit

Refer to the exhibit.

```powershell
Get-MpComputerStatus | Select-Object AMProductVersion, AMServiceEnabled, AntispywareEnabled, AntivirusEnabled
AMProductVersion    : 4.18.2401.10
AMServiceEnabled    : True
AntispywareEnabled  : True
AntivirusEnabled    : True
```

A
Microsoft Defender for Endpoint sensor onboarding
The sensor onboarding status is not shown; the device may not be fully onboarded.
B
Antivirus protection
Why wrong: AntivirusEnabled is True.
C
Antispyware protection
Why wrong: AntispywareEnabled is True.
D
Microsoft Defender Antivirus real-time protection
Why wrong: AMServiceEnabled is True, so real-time protection is on.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full NAT/PAT explanation →

Your organization uses Microsoft Defender XDR. You need to investigate a potential lateral movement attack where a compromised user account is used to access multiple workstations. Which feature should you use to visualize the attack path?

A
Attack graph
Attack graph visualizes lateral movement paths.
B
Microsoft Sentinel workbooks
Why wrong: Workbooks are custom but not the primary feature for attack paths.
C
Threat analytics in Microsoft 365 Defender
Why wrong: Threat analytics provides threat intelligence, not attack paths.
D
Incident queue
Why wrong: Incident queue lists incidents, not attack paths.

Full breakdown with real-world context →

These SC-900 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style SC-900 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SC-900 topic practice pages

Describe the capabilities of Microsoft Entra practice questions

Describe the capabilities of Microsoft security solutions practice questions

Describe the capabilities of Microsoft compliance solutions practice questions

Describe the concepts of security, compliance, and identity practice questions

SC-900 fundamentals practice questions

SC-900 scenario practice questions

SC-900 troubleshooting practice questions

Practice scenarios

Arrange the steps to investigate a user compromise using Azure AD Identity Protection.

Your organization uses Microsoft Entra ID. A user reports that they are unable to access any Microsoft 365 services because they forgot their password. Which self-service tool should they use?

Your company wants to use Microsoft Security Copilot to help analysts investigate security incidents. Which data source can Security Copilot ingest to provide contextual insights?

Your organization uses Microsoft Defender for Endpoint. You need to investigate a potential malware outbreak on several endpoints. Which feature allows you to search for indicators of compromise (IOCs) across all endpoints?

A security analyst needs to investigate a phishing campaign that targeted multiple users. They want to correlate email threat data with user actions and device signals. Which Microsoft security solution should they use as the primary investigation console?

Refer to the exhibit. A security analyst is reviewing an alert from Microsoft 365 Defender. The alert is associated with an incident. What is the best first step to investigate this alert?

Exhibit

You are the security administrator for a company using Microsoft Defender XDR. A user reports receiving a suspicious email with a link. What Microsoft Defender XDR feature should you use to investigate the email's threat level?

Refer to the exhibit. You run a KQL query in Microsoft Sentinel to investigate ransomware alerts. The query returns: AlertSeverity High: 5, Medium: 3, Low: 2. The security team wants to automate a response for all high-severity ransomware alerts. What should you configure?

Exhibit

You are troubleshooting a Conditional Access policy in Microsoft Entra ID. The policy in the exhibit is not blocking some sign-ins that you expected to block. What is the most likely reason?

Exhibit

You are troubleshooting a Windows device that is reporting as non-compliant in Microsoft Intune. The exhibit shows the output of a PowerShell command run on the device. Based on the output, which component is likely misconfigured?

Exhibit

Your organization uses Microsoft Defender XDR. You need to investigate a potential lateral movement attack where a compromised user account is used to access multiple workstations. Which feature should you use to visualize the attack path?