SC-900 Practice Test

Sample SC-900 Practice Questions

10 real questions from the free SC-900bank. Pick an answer in your head, then open “Show answer” for the explanation.

1. 1. A security incident involves a phishing email that led to credential theft, followed by suspicious sign-ins and lateral movement to multiple endpoints. How does Microsoft Defender XDR's automated investigation help respond to this multi-stage attack?

   • A. It investigates just the email in Defender for Office 365 and ignores endpoint activity and lateral movement
   • B. It sends separate alerts for each Defender product and requires an analyst to investigate each component manually
   • C. It generates individual alerts per affected product but performs no automatic investigation or remediation guidance
   • D. It correlates evidence across Defender products, investigates the full attack chain, and recommends remediation
   Show answer

   Correct answer: D

   Microsoft Defender XDR's automated investigation and response (AIR) analyzes the incident across Defender for Office 365, Identity, Endpoint, and Cloud Apps, correlates the evidence, reconstructs the full attack chain, and recommends or takes coordinated remediation such as quarantining the email, resetting credentials, and isolating endpoints (D). Investigating only email (A), requiring fully manual per-product investigation (B), and alerting without investigation or remediation (C) all describe non-XDR behavior.

2. 2. What is the Microsoft cloud security benchmark in the context of Microsoft Defender for Cloud?

   • A. A compliance scoring tool that tracks an organization's adherence to regulatory requirements such as HIPAA and ISO 27001
   • B. A Microsoft-proprietary security framework that is independent of industry standards such as CIS Controls and NIST
   • C. A set of high-impact security recommendations based on common compliance frameworks like CIS Controls and NIST to help secure Azure resources
   • D. A set of security controls that organizations must implement entirely manually, without automated guidance or scoring from Defender for Cloud
   Show answer

   Correct answer: C

   The Microsoft cloud security benchmark (MCSB) is a set of high-impact security recommendations created by Microsoft that are based on common compliance frameworks like CIS Controls and NIST. It serves as the default security initiative in Defender for Cloud and provides prescriptive best practices for securing Azure resources. Compliance Manager (A) is a separate tool for tracking regulatory compliance posture. The MCSB is explicitly aligned to industry standards - it is not proprietary (B is false). Defender for Cloud automates and scores recommendations, so manual-only implementation is incorrect (D is false).

3. 3. Your security team needs to investigate a sophisticated phishing campaign and identify which users clicked malicious links. Which Microsoft Defender for Office 365 Plan 2 feature provides this capability?

   • A. Safe Links basic reports in Plan 1
   • B. Threat Explorer
   • C. Anti-spam policies
   • D. Cloud app discovery
   Show answer

   Correct answer: B

   Threat Explorer (also called Explorer) is a real-time threat hunting and investigation tool available exclusively in Microsoft Defender for Office 365 Plan 2. It allows security teams to investigate threats, track malicious email campaigns, identify affected users, see which users clicked malicious links, view malware families, and understand the full scope of email-based attacks with detailed forensic information.

4. 4. An organization wants to delegate group management to a dedicated administrator without granting full user management permissions. Which Microsoft Entra ID built-in role provides the ability to create and manage both security groups and Microsoft 365 groups?

   • A. User Administrator
   • B. Groups Administrator
   • C. Security Administrator
   • D. Global Administrator
   Show answer

   Correct answer: B

   The Groups Administrator role is the appropriate built-in role for delegating group management. It can create and manage security groups and Microsoft 365 groups without granting full user management rights. User Administrator (A) has broader permissions including user lifecycle management. Security Administrator (C) manages security features and policies, not group creation. Global Administrator (D) is excessive for this delegation.

5. 5. Which statement best describes how Microsoft Sentinel collects and stores security data?

   • A. Sentinel stores data in a proprietary database managed separately from Azure Monitor and Log Analytics
   • B. Sentinel collects data from Azure-native services but cannot ingest third-party or non-Microsoft sources
   • C. Sentinel needs a dedicated on-premises hardware appliance to collect logs before sending them to the cloud
   • D. Sentinel stores data in Log Analytics workspaces and ingests via connectors for Microsoft and non-Microsoft sources
   Show answer

   Correct answer: D

   Sentinel is built on Azure Log Analytics, using workspaces as its data store and KQL engine, and ingests data through connectors for Microsoft 365, Azure, Defender, and many third-party sources (D). It is not a separate proprietary database (A), it supports non-Microsoft sources (B), and it needs no on-premises appliance since it is fully cloud-native (C).