SC-900 Capabilities of Microsoft security practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

SC-900 Describe the capabilities of Microsoft security solutions: 405 practice questions

SC-900 405 questions 12 shown free

12 of the 405 Describe the capabilities of Microsoft security solutions questions in the Certsqill SC-900 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for SC-900? Take the free 5-min readiness check →

1. Defender XDR: Which capability best satisfies this cross-domain requirement?

Medium
A research team wants one incident view that correlates suspicious email, endpoint, identity, and cloud-app signals, then supports coordinated investigation. Which capability best satisfies this cross-domain requirement?
  1. Defender for Endpoint
    Defender for Endpoint focuses on endpoint prevention, detection, investigation, and response capabilities.
  2. Defender XDR ✓
    Defender XDR correlates signals across email, endpoints, identities, and cloud apps into incidents.
  3. Microsoft Threat Intelligence
    Microsoft Threat Intelligence supplies actor, indicator, and campaign context rather than correlating organizational security signals.
  4. Defender for Cloud Apps
    Defender for Cloud Apps provides CASB capabilities for cloud-app discovery, activity, and session controls.
The trap
Confuses cloud-app governance with unified XDR incidents. Confuses intelligence context with cross-domain incident management. Confuses endpoint coverage with cross-domain correlation.

Defender XDR correlates signals across multiple security domains into unified incidents.

2. Check protected scope before claiming coverage: Select TWO capabilities or statements that satisfy these requi

Medium
A training provider wants to improve availability for a public service against distributed attacks. The design must address volumetric or protocol floods, and protection applies only within the configured protected scope. Select TWO capabilities or statements that satisfy these requirements.

Select two. More than one option is correct — every correct one is ticked below.

  1. Use Bastion to absorb distributed floods.
    Azure Bastion provides managed RDP and SSH access to virtual machines; it is not distributed-attack mitigation.
  2. Check protected scope before claiming coverage. ✓
    DDoS coverage depends on the configured protected scope and covered resources, so scope must be verified.
  3. Use DDoS Protection for covered public resources. ✓
    DDoS Protection addresses distributed volumetric and protocol attacks against availability for resources within its protected scope.
  4. Use WAF to absorb network-layer floods.
    WAF inspects supported HTTP(S) attack patterns such as SQL injection and cross-site scripting; it is not the primary control for volumetric or protocol floods.
  5. Use an NSG to inspect HTTP attack content.
    NSGs filter traffic using network attributes such as addresses, ports, and protocols; they do not inspect HTTP content as a WAF does.
The trap
Confuses administrative connectivity with availability protection. Confuses network filtering with web request inspection. Confuses application-layer inspection with DDoS mitigation.

DDoS Protection addresses qualifying distributed attacks, but coverage depends on protected scope.

3. CSPM assesses posture and provides recommendations: Which response is accurate?

Medium
A nonprofit reviews Defender for Cloud recommendations and secure score to prioritize improvements. A colleague claims that merely viewing recommendations automatically remediates every misconfiguration and certifies regulatory compliance. Which response is accurate?
  1. Secure score certifies regulatory compliance after review.
    Secure score indicates progress and prioritization; it is not legal certification or proof of regulatory compliance.
  2. CSPM assesses posture and provides recommendations. ✓
    Defender for Cloud CSPM assesses configuration posture and provides recommendations, secure score, and compliance views.
  3. Recommendations automatically remediate every identified misconfiguration.
    Recommendations identify improvement actions but are not automatically remediated simply because administrators view them.
  4. CSPM replaces workload threat protection for supported resources.
    CSPM evaluates posture, while workload protection addresses threats to supported workloads through configured plans.
The trap
Confuses improvement measurement with formal certification. Confuses posture assessment with runtime threat protection. Confuses assessment output with automatic remediation.

CSPM assesses cloud posture and recommends improvements; secure score is progress, not certification.

4. Use analytics rules: Which Sentinel capability is the best fit?

Easy
Evidence summary: A retailer has connected identity, endpoint, and firewall data to Microsoft Sentinel. Analysts need a capability that identifies matching conditions and creates alerts or incidents for investigation. Which Sentinel capability is the best fit?
  1. Use hunting queries for analyst-led investigation.
    Hunting supports proactive, analyst-led querying; it does not primarily create automated detections from configured conditions.
  2. Use playbooks for configured response workflows.
    Playbooks orchestrate configured response actions, commonly through Logic Apps, rather than serving as the detection logic.
  3. Use analytics rules. ✓
    Analytics rules evaluate configured conditions in ingested data and can generate alerts or incidents for investigation.
  4. Use workbooks.
    Workbooks visualize security data and metrics; they do not primarily detect configured matching conditions.
The trap
Confuses visualization with detection. Confuses investigation with automated detection. Confuses response orchestration with detection.

Sentinel analytics rules detect configured conditions and generate alerts or incidents.

5. Defender for Office 365: Which capability should the team evaluate next?

Hard
A consulting firm wants email protection that analyzes attachments and checks links before users open them. The organization has configured the necessary supported email scope and permissions. Which capability should the team evaluate next?
  1. Defender for Endpoint
    Defender for Endpoint protects devices through endpoint prevention, detection, investigation, and response capabilities.
  2. Defender for Identity
    Defender for Identity analyzes identity signals, including on-premises directory activity, for threats such as lateral movement.
  3. Defender for Office 365 ✓
    Defender for Office 365 provides Safe Attachments analysis and Safe Links URL protection for supported email and collaboration scopes.
  4. Microsoft Threat Intelligence
    Microsoft Threat Intelligence provides threat context about actors, indicators, and campaigns rather than attachment analysis.
The trap
Confuses intelligence context with message protection. Confuses device protection with email and collaboration protection. Confuses identity threat detection with email protection.

Defender for Office 365 supplies Safe Attachments and Safe Links protection for supported email environments.

6. Web application firewall: Which capability supplies the required signal?

Medium
A research team hosts a web application and needs a control that can inspect HTTP(S) requests for SQL injection patterns. Network-level filtering is already present, but the team needs application-content inspection. Which capability supplies the required signal?
  1. Network security group
    An NSG filters traffic using addresses, ports, protocols, and direction rather than inspecting HTTP request content.
  2. Azure Firewall
    Azure Firewall applies configurable network and application rules but is not specialized for web attack-pattern inspection.
  3. Web application firewall ✓
    A web application firewall inspects supported HTTP(S) traffic for patterns such as SQL injection and cross-site scripting.
  4. Azure DDoS Protection
    DDoS Protection mitigates distributed availability attacks rather than detecting SQL injection in web requests.
The trap
Confuses transport filtering with application-layer inspection. Confuses availability defense with request-content inspection. Confuses general firewall rules with specialized web inspection.

A web application firewall inspects supported web requests for SQL injection and similar attack patterns.

7. It detects threats to supported workloads: Which interpretation is correct?

Hard
A training provider enables a Defender for Cloud workload protection plan for supported servers. The administrator expects the plan to repair every posture recommendation automatically. Which interpretation is correct?
  1. It detects threats to supported workloads. ✓
    Configured workload protection plans detect and protect supported workloads against relevant threats.
  2. It only visualizes configuration posture.
    Posture visualization describes CSPM, while workload protection addresses threats affecting supported workloads.
  3. It automatically grants least-privilege access.
    Workload protection does not assign identity permissions or automatically establish least-privilege access.
  4. It automatically remediates every posture recommendation across all connected clouds.
    Workload protection does not guarantee universal automatic remediation of posture recommendations across every connected cloud.
The trap
Confuses threat protection with authorization management. Confuses threat detection with universal posture remediation. Confuses workload protection with posture visualization.

Workload protection addresses threats to supported workloads, not automatic remediation of every posture recommendation.

8. Playbook: Which capability best matches both constraints?

Medium
A nonprofit wants Sentinel to start an external Logic Apps workflow when a security incident meets defined conditions. The workflow must orchestrate actions outside basic incident handling. Which capability best matches both constraints?
  1. Workbook
    A workbook visualizes security data and metrics but does not orchestrate external response workflows.
  2. Analytics rule
    An analytics rule detects matching conditions and generates alerts or incidents rather than executing external workflows.
  3. Hunting query
    Hunting queries support proactive investigation but do not execute external response workflows.
  4. Playbook ✓
    A playbook executes configured Logic Apps workflows to orchestrate response actions and external integrations.
The trap
Confuses investigation with orchestration. Confuses reporting with response automation. Confuses detection logic with workflow execution.

Sentinel playbooks use Logic Apps to orchestrate configured response workflows and external integrations.

9. Use Safe Links: Which capability best satisfies this requirement?

Medium
A college wants protection for links in email messages and collaboration content. The requirement is to inspect destinations when users follow links and help prevent access to malicious websites. Which capability best satisfies this requirement?
  1. Use Defender for Endpoint to investigate suspicious device activity.
    Defender for Endpoint protects and investigates endpoint activity, not URLs in email or collaboration messages.
  2. Use Safe Attachments to analyze files delivered through messages.
    Safe Attachments analyzes files, whereas this requirement concerns URLs and their destinations.
  3. Use a web application firewall to inspect HTTP attack patterns.
    A web application firewall inspects supported web requests for application-layer attack patterns; it does not protect links embedded in user messages.
  4. Use Safe Links. ✓
    Safe Links evaluates URLs in supported email and collaboration messages when users follow them and can help block malicious destinations.
The trap
Confuses web-request inspection with message-link protection. Selects endpoint protection instead of message protection. Confuses attachment analysis with URL protection.

Safe Links protects URLs in supported messages; Safe Attachments, WAF, and Endpoint address different surfaces.

10. Use WAF to inspect web requests for XSS patterns: Which capability should the firm use?

Hard
A consulting firm hosts a public web application. It needs to identify cross-site scripting patterns in HTTP requests, while simple port and protocol filtering remains sufficient for other network traffic. Which capability should the firm use?
  1. Use DDoS Protection to mitigate distributed attacks against the application’s availability.
    DDoS Protection addresses distributed availability attacks rather than malicious web-request content such as XSS.
  2. Use Azure Firewall application rules to provide centralized stateful traffic control across network resources.
    Azure Firewall provides broader network and application traffic control, not specialized XSS inspection.
  3. Use an NSG to filter application traffic by addresses, ports, and protocols.
    NSGs filter network attributes but do not inspect HTTP request content for cross-site scripting.
  4. Use WAF to inspect web requests for XSS patterns. ✓
    WAF inspects supported HTTP or HTTPS requests for web attacks such as cross-site scripting.
The trap
Broader firewall policy is not specialized web inspection. Port filtering cannot analyze web request content. Availability mitigation does not detect application-layer injection.

WAF inspects web requests for XSS; NSGs and DDoS protection address network filtering or availability instead.

11. Viewing recommendations does not remediate configurations: What is the misconception?

Easy
A research team reviews Defender for Cloud recommendations from a selected security standard. A member claims that viewing recommendations automatically fixes every identified configuration issue. What is the misconception?
  1. Secure score is legal proof of complete compliance.
    Secure score indicates prioritization and progress; it is not legal certification or proof that every requirement is satisfied.
  2. Recommendations cannot assess cloud posture.
    Defender for Cloud uses recommendations to identify actions that can improve assessed cloud security posture.
  3. Viewing recommendations does not remediate configurations; corrective action is still required. ✓
    Recommendations identify improvement actions, but merely viewing them does not change resource configurations or automatically remediate every issue.
  4. Security standards are unrelated to recommendations.
    Configured security standards can drive assessments that produce relevant recommendations.
The trap
Denies the posture-management role of recommendations. Disconnects assessments from the standards that guide them. Confuses a progress measure with formal compliance evidence.

Recommendations identify posture improvements; viewing them alone does not remediate resources.

12. Configure a Sentinel connector for ingestion: Which Sentinel capability should be configured first?

Easy
A training provider wants Microsoft Sentinel to receive security events from an external service before analysts create detections or investigate incidents. Which Sentinel capability should be configured first?
  1. Create an analytics rule to detect configured conditions.
    Analytics rules detect conditions in available data; they do not themselves connect an external source for ingestion.
  2. Configure a Sentinel connector for ingestion. ✓
    Configured data connectors bring security data from supported sources into Microsoft Sentinel for analysis.
  3. Use a workbook to visualize existing events.
    Workbooks visualize available data but do not supply external security events to Sentinel.
  4. Use a playbook to orchestrate a response workflow after events are available.
    Playbooks automate response workflows after data or incidents exist, rather than supplying the initial event stream.
The trap
Response orchestration is not initial ingestion. Visualization does not perform data ingestion. Detection logic cannot replace source connectivity.

Sentinel data connectors ingest source events; analytics, workbooks, and playbooks use or act on available data.

393 more Describe the capabilities of Microsoft security solutions questions

The remaining 393 questions in this domain are part of the full SC-900 bank — 1080 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your SC-900 readiness — free

Other SC-900 domains

Part of the Certsqill SC-900 question bank · Describe the capabilities of Microsoft security solutions · Every answer, right and wrong, comes with its own explanation.