SC-900 Online Practice Questions and Answers

Correct Answer:

Box 1: Triage

New user activities that need investigation automatically generate alerts that are assigned a Needs review status. Reviewers can quickly identify and review, evaluate, and triage these alerts.

Alerts are resolved by opening a new case, assigning the alert to an existing case, or dismissing the alert. Using alert filters, it's easy to quickly identify alerts by status, severity, or time detected. As part of the triage process, reviewers can

view alert details for the activities identified by the policy, view user activity associated with the policy match, see the severity of the alert, and review user profile information.

Box 2: Investigate

Investigate

Quickly investigate all activities for a selected user with User activity reports (preview). These reports allow investigators in your organization to examine activities for specific users for a defined time period without having to assign them

temporarily or explicitly to an insider risk management policy. After examining activities for a user, investigators can dismiss individual activities as benign, share or email a link to the report with other investigators, or choose to assign the user

temporarily or explicitly to an insider risk management policy.

Cases are created for alerts that require deeper review and investigation of the activity details and circumstances around the policy match.

Box 3: Action

After cases are investigated, reviewers can quickly act to resolve the case or collaborate with other risk stakeholders in your organization. If users accidentally or inadvertently violate policy conditions, a simple reminder notice can be sent to

the user from notice templates you can customize for your organization. These notices may serve as simple reminders or may direct the user to refresher training or guidance to help prevent future risky behavior.

Reference:

https://docs.microsoft.com/en-us/microsoft-365/compliance/insider-risk-management

Correct Answer:

Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender/incidents-overview?view=o365-worldwide

Correct Answer:

Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender/threat-analytics?view=o365-worldwide

Correct Answer:

Reference: https://docs.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune https://docs.microsoft.com/en-us/mem/intune/fundamentals/what-is-device-management

Correct Answer:

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook

Correct Answer:

Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa

Correct Answer: D

Network protection helps protect devices from Internet-based events. Network protection is an attack surface reduction capability.

Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/network-protection?view=o365-worldwide

Correct Answer: BC

Security defaults make it easy to protect your organization with the following preconfigured security settings:

1.

Requiring all users to register for Azure AD Multi-Factor Authentication.

2.

Requiring administrators to do multi-factor authentication.

3.

Blocking legacy authentication protocols.

4.

Requiring users to do multi-factor authentication when necessary.

5.

Protecting privileged activities like access to the Azure portal.

Correct Answer: ACE

Reference: https://docs.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps

Correct Answer: C

https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources After you onboard Microsoft Sentinel into your workspace, use data connectors to start ingesting your data into Microsoft Sentinel. Microsoft Sentinel comes with many out of the box connectors for Microsoft services, which integrate in real time. For example, the Microsoft 365 Defender connector is a service-to-service connector that integrates data from Office 365, Azure Active Directory (Azure AD), Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps.