Quiz
SC-900
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (193)
1Yes or No
- AAll Azure Active Directory (Azure AD) license editions include the same features
- BYou can manage an Azure AD tenant by using the Azure portal
- CYou must deploy Azure virtual machines to host an Azure AD tenant
2Provides best practices from MS employees, partners, and customers, including tools and guidance assist in an Azure deployment
- AAzure Blueprints
- BAzure Policy
- CThe MS Cloud Adoption Framework for Azure
- DA resource lock
3Is used to indentify, hold and export electronic information that might be used in an investigation
- ACustomer Lockbox
- BData loss prevention (DLP)
- CeDiscovery
- DA resource lock
4You can manage MS Intune by using the
- AAzure Active Directory admin center
- BMS 365 compliance center
- CMS 365 defender portal
- DMS Endpoint Manager admin center
5Federation is used to stablish () between organizations
- Amulti-factor authentication (MFA)
- Ba trust relationship
- Cuser account synchronization
- Da VPN connection
6Yes or No
- AApplying system updates increases an organization's secure score in MS defender for cloud
- BThe secure score in MS defender for cloud can evaluate resources across multiple Azure subscription
- CEnabling MFA increases an organization's secure score in MS defender for Cloud
7Which score measures an organization's progress in completing actions that help reduce risk associated to data protection and regulatory standards
- AMS Secure Score
- BProductivity Score
- CSecure score in Azure Security Center
- DCompliance Score
8What do you use to provide real-time integration between Azure Sentinel and another security source?
- AAzure AD Connect
- Ba Log Analytics workspace
- CAzure Information Protection
- Da connector
9Which MS portal provides information about how MS cloud services comply with regulatory standard, such as International Organizations for Standardization (ISO)?
- AThe MS Endpoint Manager Admin center
- BAzure Cost Management + Billing
- CMS Service Trust Portal
- Dthe Azure Active Directory admin center
10In the shared responsibility model for an Azure deployment , what is MS solely responsible for managing?
- Athe management of mobile devices
- Bthe permissions for the user data stored in Azure
- Cthe creation and management of users accounts
- Dthe management of the physical hardware
11Yes or No
- AVerify explicitly is one of the guiding principles of Zero Trust
- BAssume Breach is one of the guiding principles of Zero Trust
- CThe Zero Trust security model assumes that a firewall secures the internal network from external threats
12Yes or No
- AControl is a Key privacy principle of MS
- BTransparency is a key privacy principle of MS
- CShared responsibility is a key privacy principle of MS
13a file makes the data in the file readable and usable to viewers that have the appropriate key
- AArchiving
- BCompressing
- CDeduplicating
- DEncrypting
14Yes or No
- ADigitally signing a document required a private key
- BVerifying the authenticity of a digitally signed document requires the public key of the signer
- CVerifying the authenticity of a digitally signed document requires the private key of the signer
15When users sign in to the Azure portal, they are first
- Aassigned permissions
- Bauthenticated
- Cauthorized
- Dresolved
16is the process of identifying whether a signed-in user can access a specific resource
- AAuthentication
- BAuthorization
- CFederation
- DSingle sign-on (SSO)
17enables collaboration with business partners from external organizations such as suppliers, partners and vendors. External users appear as guest users in the directory
- AActive Directory Domain Services (AD DS)
- BActive Directory forest trusts
- CAzure Active Directory (Azure AD) business-to-business (B2B)
- DAzure Active Directory business-to-consumer B2C (Azure AD B2C)
18In the MS Cloud adoption framework for Azure, which two phases are addressed before the Ready phase?
- APlan, Define Strategy
- BManage
- CAdopt
- DGovern
19Yes or No
- AIn software as services (SaaS), applying service packs to applications is the responsibility of the organization
- BIn infraestructure as a service (IaaS), managing the physical network is the responsiblity of the cloud provider
- CIn all azure cloud deployment types, managing the security of information and data is the responsibility of the organization
20Yes or No
- AAzure AD Connect can be used to implement hybrid identity
- BHybrid identity requires the implementation of two MS 365 tenants
- CAuthentication of Hybrid identifies required the synchronization of Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD)
21Provides benchmark recommendations and guidance for protecting Azure services
- AAzure Application Insigths
- BAzure Network Watcher
- CLog Analytics workspaces
- DSecurity baselines for Azure
22What is an example of encryption at rest?
- Aencrypting communications by using a site-to-site VPN
- Bencrypting a virtual machine disk
- Caccessing a website by using an encrypted HTTPS connection
- Dsending an encrypted email
23Which three statements accurately describe the guiding of Zero trust?
- ADefine the perimeter by physical locations
- BUse identity as the primary security boundary
- CAlways verify the permissions of a user explicity
- DAlways assume that the user system ca be breached
- EUse the network as the primary security boundary
24Which service should you use to view your azure secure score?
- ASecurity Center
- Ball of them
25Match the compliance:
Corrective - Detective - Preventative
1. Encrypt data at rest
2. Perform a system access audit
3. Make configuration changes in response to a security incident- APreventative - Encrypt data at rest
- BDetective - Perform a system access audit
- CCorrective - Make configuration changes in response to a security incident
26Compliance Manager can be directly accessed from the
- AMS 365 admin center
- BMS 365 Defender portal
- CMS 365 Compliance center (Purview)
- DMS Support portal
27Yes or No
- AEnabling MFA increases the MS Secure Score
- BA higher MS Secure Score means a lower identified risk level in the MS 365 tenant
- CMS Secure Score measures progress in completing actions based on controls that include key regulations and standards for data protection and governance
28What can you use to provide a user with a two-hour window to complete an administrative task in azure
- AAzure Active Directory (Azure AD) privileged identity Management (PIM)
- BAzure Multi-Factor Authentication (MFA)
- CAzure Active Directory (Azure AD) Identity Protection
- Dconditional access policies
29In a hybrid identity model, what can you use to sync identities between AD DS (domain services) and Azure AD?
- AActive Directory Federation Services (AD FS)
- BMS Sentinel
- CAzure AD Connect
- DAzure AD Privileged Identity Management (PIM)
30Yes or No
- AYou can created custom roles in Azure AD
- BGlobal administrator is a role in Azure AD
- CAn Azure AD user can be assigned only one role
31Yes or No
- AAzure AD is deployed to an on-premises environment
- BAzure AD is provided as part of a MS 365 subscription
- CAzure AD is an identity and access management service
32With Windows Hello for Business, a user's biometric data used for authentication
- Ais stored on an external device
- Bis stored on a local device only
- Cis stored in Azure AD
- Dis replicated to all devices designated by the user
33What is the purpose of Azure AD Password Protection?
- Ato control how often users must change their password
- Bto identify devices to which users can sign in without using MFA
- Cto encrypt a password by using globally recognized encryption standards
- Dto prevent users from using specific words in their password
34Which Azure AD feature can you use to evaluate group membership and automatically remove users that no longer require membership in a group?
- Aaccess reviews
- Bmanaged identities
- Cconditional access policies
- DAzure AD identity protection
35Requires additional verification, such as a verification code sent to a mobile phone
- AMFA
- BPass-through authentication
- CPassword writeback
- DSingle sign-on (SSO)
36Yes or No
- AConditional access policies can use the device state as a signal
- BConditional access policies apply before first-factor authentication is complete
- CConditional access policies can trigger multi-factor authentication (MFA) if a user attempts to access a specific application
37is a cloud-based solution that leverages on-premises AD signals to identify, detect, and investigate advanced threats
- AMS Defender for cloud apps
- BMS Defender for endpoint
- CMS Defender for identity
- DMS Defender for Office 365
38MS Defender for identity can identify advanced threats from () signals
- AAzure AD
- BAzure AD Connect
- Con-premises AD DS
39Azure AD is used for authentication and authorization
- Aan extended detection and responde (XDR) system
- Ban identity provider
- Ca management group
- Da security information and event management (SIEM) system
40Which Azure AD feature can you use to provide just-in-time (JIT) access to manage Azure resources
- Aconditionals access policies
- BAzure AD identity protection
- CAzure AD privileged identity management (PIM)
- Dauthentication method policies
41Which three authentication methods can be used by Azure Multi-Factor Authentication (MFA)?
- Atest message (SMS)
- BMS Authenticator app
- Cemail verification
- Dphone call
- Esecurity question
42Which Microsoft 365 feature can you use to restrict communication and the sharing of information between members of two departments at your organization?
- Asensitivity label policies
- BCustomer Lockbox
- CInformation barriers
- DPrivileged Access Management (PAM)
43Yes or No
- AConditional access policies always enforce the use of MFA
- BConditional access policies can be used to block access to an application based on the location of the user
- CConditional access policies only affect users who have Azure AD joined devices
44Yes or No
- AConditional access policies can be applied to global administrators
- BConditional access policies are evaluated before a user is authenticated
- CConditional access policies can use a device platform, such as Android or iOS, as a signal
45Applications registered in Azure AD are associated automatically to a:
- Aguest account
- Bmanaged identity
- Cservice pricipal
- Duser account
46Which three authentication methods does Windows Hello for Business support?
- Afigerprint
- Bfacial recognition
- CPIN
- Demail verification
- Esecurity question
47When you enable security defaults in Azure AD () will be enabled for all Azure AD users
- AAzure AD Identity protection
- BAzure AD Privileged Identity Management (PIM)
- CMFA
48You have an Azure subscription.
You need to implement approval-based, time-bound role activation.
What should you use?- AWindows Hello for Business
- BAzure Active Directory (Azure AD) Identity Protection
- Caccess reviews in Azure Active Directory (Azure AD)
- DAzure Active Directory (Azure AD) Privileged Identity Management (PIM)
49Yes or No
- AGlobal administrators are exempt from conditional access policies
- BA conditional access policy can add users to Azure AD roles
- CConditional access policies can force the use of MFA to access cloud apps
50When security defaults are enabled for an Azure Active Directory (Azure AD) tenant, which two requirements are enforced?
- AAll users must authenticate from a registered device.
- BAdministrators must always use Azure Multi-Factor Authentication (MFA).
- CAzure Multi-Factor Authentication (MFA) registration is required for all users.
- DAll users must authenticate by using passwordless sign-in.
- EAll users must authenticate by using Windows Hello.
51Which type of identity is created when you register an application with Azure AD
- Aa user account
- Ba user-assigned managed identity
- Ca system-assigned managed identity
- Da service principal
52three tasks can be performed by using Azure AD identity protection?
- AConfigure external access for partner organizations
- BExport risk detection to third-party utilities
- CAutomate the detection and remediation of identity based-risks
- DInvestigate risks that relate to user authentication
- ECreate and automatically assign sensitivity labels to data
53When using MFA, a password is considered something you
- Aare
- Bhave
- Cknow
- Dshare
54Yes or No
- AWindows Hello for business can use the MS authenticator app as an authentication method
- BWindows Hello for business can use a PIN code as an authentication method
- CWindows Hello for business authentication information syncs across all the devices registered by a user
55An Azure resource can use a system-assigned () to access Azure services
- AAzure AD joined device
- Bmanaged identity
- Cservice principal
- Duser identity
56You can use () in the MS 365 defender portal to identify devices that are affected by an alert
- Aclassifications
- Bincidents
- Cpolicies
- Dsecure score
57What are two capabilities of MS defender for endpoint?
- Aautomated investigation and remediation
- Btransport encryption
- Cshadow IT detection
- Dattack surface reduction
58Order
- AAzure Firewall - Provides Network address translation (NAT) services
- BAzure Bastion - Provides secure and seamless remote desktop connectivity to azure virtual machines
- CNetwork security group (NSG) - Provides traffic filtering that can be applied to specific network interfaces on a virtual network
59Is a cloud-native security information and event management (SIEM) and security orchestration automated response (SOAR) solution used to provide a single solution for alert detection, threat, visibility, proactive hunting and threat response
- AAzure Advisor
- BAzure Bastion
- CAzure Monitor
- DAzure Sentinel
60Yes or No
- AAzure Defender can detect vulnerabilities and threats for Azure storage
- BCloud security posture management (CSPM) is available for all azure subscriptions
- CAzure security center can evaluate the security of workloads deployed to Azure or on-premises
61You can use () in the MS 365 security center to view an aggregation of alerts that relate to the same attack
- AReports
- BHunting
- CAttack simulator
- DIncidents
62Yes or No
- ANetwork Security Groups (NSG) can deny inbound traffic from the internet
- BNetwork Security Groups (NSG) can deny outbound traffic to the internet
- CNetwork Security Groups (NSG) can filter traffic based on IP address, protocol and port
63Yes or No
- AMS Intune can be used to manage Android devices
- BMS Intune can be used to provision Azure subscriptions
- CMS Intune can be used to manage organization-owned devices and personal devices
64Yes or No
- AYou can create one Azure Bastion per virtual Network
- BAzure Bastion provides secure user connections by using RDP
- CAzure Bastion provides a secure connection to an Azure virtual machine by using Azure portal
65What feature in MS defender for endpoint provides the first line of defense against cyberthreats by reducing the attack surface?
- Aautomated remediation
- Bautomated investigation
- Cadvanced hunting
- Dnetwork protection
66In MS Sentinel, you can automate common task by using
- Adeep investigation tools
- Bhunting search-and-query tools
- Cplaybooks
- Dworkbooks
67Which two types of resources can be protected by using Azure Firewall?
- AAzure virtual machines
- BAzure AD users
- CMS Exchange Online inboxes
- DAzure virtual networks
- EMS Sharepoint online sites
68You plan to implement a security strategy and place multiple layers of defense throughout a network infrastructure. Which security methodology does this represent?
- AThreat modeling
- Bidentity as the security permiter
- Cdefense in depth
- Dthe shared responsibility model
69Yes or No
- AMS Defender for endpoint can protect Android devices
- BMS Defender for endpoint can protect Azure virtual machines that run Windows 10
- CMS Defender for endpoint can protect MS Sharepoint online sites and content from viruses
70What can you use to scan email attachments and forward the attachments to recipients only if the attachments are free from malware?
- AMS Defender for Office 365
- BMS Defender Antivirus
- CMS Defender for Identity
- DMS Defender for Endpoint
71Which feature provides the extended detection and response (XDR) capability of Azure sentinel?
- AIntegration with the MS 365 compliance center
- Bsupport for threat hunting
- CIntegration with MS 365 defender
- Dsupport for Azure monitor workbooks
72What can you use to provide threat detection for Azure SQL Managed Instance?
- AMS Secure Score
- Bapplication security groups
- CMS Defender for clouds
- DAzure Bastion
73Yes or No
- AMS Secure score in the MS 365 security center can provide recommendations for MS cloud app security
- BFrom the MS 365 defender portal, you can view how your MS secure score compares to the score of organizations like yours
- CMS Secure score in the MS 365 Defender portal gives you points if you address the improvement action by using a third-party application or software.
74Which Azure AD feature can you use to restrict MS Intune-managed devices from accessing corporate resources?
- ANetwork security groups (NSGs)
- BAzure AD privileged identity management (PIM)
- Cconditional access policies
- Dresource locks
75Can use conditional access policies to control sessions in real time
- AAzure AD privileged identity management (PIM)
- BAzure defender
- CAzure Sentinel
- DMS Cloud app security
76Azure DDoS protection standard can be used to protect
- AAzure AD applications
- BAzure AD users
- CResources group
- DVirtual Networks
77What should you use in the MS 365 defender portal to view security trends and track the protection status of identities
- Aattack simulator
- Breports
- Chunting
- Dincidents
78You have a MS 365 E3 subscription.
You plan to audit user activity by using the unified audit log and Basic Audit.
For how long will the audit records be retained?- A15 days
- B30 days
- C90 days
- D180 days
79To which type of resource can Azure Bastion provide secure access
- AAzure Files
- BAzure SQL Managed Instances
- CAzure virtual machines
- DAzure App service
80What are three uses of MS Cloud app security? Each correct answer presents a complete solution.
- Ato discover and control the use of shadow IT
- Bto provide secure connections to Azure virtual machines
- Cto protect sensitive information hosted anywhere in the cloud
- Dto provide pass-through authentication to on-premises applications
- Eto prevent data leaks to noncompliant apps and limit access to regulated data
81In the MS 365 defender portal, an incident is a collection of correlated
- AAlerts
- Bevents
- Cvulnerabilities
- DMS Secure Score improvement actions
82You need to connect to an Azure virtual machine by using Azure Bastion. What should you use?
- APoweShell remoting
- Bto Azure portal
- CThe remote desktop connection client
- Dan SSH client
83Which service includes the attack simulation training feature?
- AMS defender for clouds apps
- BMS defender for identity
- CMS defender for SQL
- DMS defender for office 365
84Which type of alert can you manage from the MS 365 defender portal?
- AMS defender for storage
- BMS defender for SQL
- CMS defender for endpoint
- DMS defender for IoT
85Yes or No
- AMS Sentinel data connectors support only MS services
- BYou can use Azure monitor workbooks to monitor data collected by MS Sentinel
- CHunting provides you with the ability to identify security threats before an alert is triggered
86Which two Azure resources can a network security group (NSG) be associated with?
- Aa virtual network subnet
- Ba network interface
- Ca resource group
- Da virtual network
- Ean azure app service web app
87What is a use case for implementing information barrier policies in MS 365
- Ato restrict unauthenticated access to MS 365
- Bto restrict MS teams chat between certain groups within an organization
- Cto restrict MS exchange online email between certain groups within an organization
- Dto restrict data sharing to external email recipients
88What can you use the deploy Azure resources across multiple subscriptions in a consistent manner?
- AMS defender for Cloud
- BAzure Blueprints
- CMS Sentinel
- DAzure Policy
89Yes or No
- AWith advanced audit in MS 365, you can identify when email items were accessed
- BAdvanced audit in MS 365 supports the same retention period of audit logs as core auditing
- CAdvanced audit in MS 365 allocates customer-dedicated bandwidth for accessing audit data
90Yes or No
- AAzure AD identity protection can add users to groups based on the user's risk level
- BAzure AD identity protection can detect whether user credentials were leaked to the public
- CAzure AD identity protection can be used to invoke MFA based on a user's risk level
91Which MS 365 compliance center feature can you use to identify all the documents on a MS sharepoint online site that contain a specific key word?
- AAudit
- BCompliance Manager
- CContent Search
- DAlerts
92Provides a central location for managing information protection information governance, and data loss prevention (DLP) policies
- AAzure Defender
- BThe MS 365 compliance center
- CThe MS defender portal
- DMS Endpoint manager
93Which MS 365 feature can you use to restrict users from sending email messages that contains lists of customers and their associated credit card numbers?
- Aretention policies
- Bdata loss prevention (DLP) policies
- Cconditional access policies
- Dinformation barriers
94Can be used to provide MS support engineers with access to an organization's data stores in MS exchange online, sharepoint online, and OneDrive for business
- Acustomer lockbox
- Binformation barriers
- CPrivileged access management (PAM)
- DSensitivity labels
95In a core eDiscovery workflow, what should you do before you can search for content?
- ACreate an eDiscovery hold
- BRun express Analysis
- CConfigure attorney-client privilege detection
- DExport and download result
96Which MS portal provides information about how MS manages privacy, compliance and security?
- AMS service trust portal
- BCompliance manager
- CMS 365 compliance center
- DMS Support
97What can you protect by using the information protection solution in the MS 365 compliance center?
- Acomputers from zero-day exploit
- Busers from phishing attempts
- Cfiles from malware and viruses
- Dsensitive data from being exposed to unauthorized users
98What can you specify in MS 365 sensitivity labels
- Ahow long files must be preserved
- Bwhen to archive an email message
- Cwhich watermark to add to files
- Dwhere to store files
99Yes or No
- AYou can use advanced audit in MS 365 to view billing details
- BYou can use advanced audit in Ms 365 to view the contests of an email message
- CYou can use advanced audit in MS 365 to identify when a user uses the search bar in Outlook on the web to search for items in a mailbox
100Yes or No
- AYou can add a resource lock to an Azure subscription
- BYou can add only one resource lock to an Azure resource
- CYou can delete a resource group containing resources that have resources locks
101Yes or No
- AUsers can apply sensitivity labels manually
- BMultiple sensitivity labels can be applied to the same file
- CA sensitivity label can apply a watermark to a MS work document
102Which two tasks can you implement by using data loss prevention (DLP) policies in MS 365?
- ADisplay policy tips to users who are about to violate your organization's policies
- BEnable disk encryption on endpoints
- CProtect documents in MS OneDrive that contains sensitive information
- DApply security baselines to devices
103Compliance manager assesses compliance data ( ) for an organization
- AContinually
- BMonthly
- Con-demand
- Dquarterly
104Yes or No
- ASensitivity labels can be used to encrypt documets
- BSensitivity labels can add headers and footers to documents
- CSensitivity labels can apply watermarks to emails
105Which MS 365 compliance feature can you use to encrypt content automatically based on specific conditions?
- AContent search
- Bsensitivity labels
- Cretention policies
- DeDiscovery
106Yes or No
- ACompliance Manager tracks only customer-managed controls
- BCompliance manager provides predefined templates for creating assessments
- CCompliance manager can help you assess whether data adheres to specific data protection standards
107Yes or No
- AYou can use the insider risk management solution to detect phishing scams
- BYou can access the insider risk management solution from the MS 365 compliance center
- CYou can use the insider risk management solution to detect data leaks by unhappy employees
108Yes or No
- AAzure policy supports automatic remediation
- BAzure Policy can be used to ensure that new resources adhere to corporate standards
- CCompliance evaluation in Azure Policy occurs only when a target resource is created or modified
109Unir
- ATriage - Review and filter alerts
- BInvestigate - Create cases in the case dashboard
- CAction - Send a reminder of corporate policies to user
110Which two cards are available in the MS 365 defender portal?
- ADevices at risk
- BCompliance Score
- CService Health
- DUser Management
- EUsers at risk
111What should you use to ensure that the members of an Azure Active Directory group use MFA when they sign in?
- AAzure role-based access control (Azure RBAC)
- BAzure AD privileged identity management (PIM)
- CAzure AD identity protection
- Da conditional access policy
112Yes or No
- AAzure AD identity protection generates risk detections once a user is authenticated
- BAzure AD identity protection assigns a risk level of low, medium, or high to each risk event
- CA user risk in Azure AD identity protection represents the probability that a given identity or accounts is compromised
113You need to keep a copy of all files in a MS SharePoint site for one year, even if users delete the files from the site. What should you apply to the site?
- Aa retention policy
- Ban insider risk policy
- Ca data loss prevention (DLP) policy
- Da sensitivity label policy
114You need to create a data loss prevention (DLP) policy. What should you use?
- AThe MS 365 compliance center
- BThe MS Endpoint Manager admin center
- CThe MS 365 admin center
- DThe MS 365 defender portal
115What is an assessment in Compliance Manager?
- AA policy initiative that includes multiple policies
- BA dictionary of words that are not allowed in company documents
- CA grouping of controls from a specific regulation, standard or policy
- DRecommended guidance to help organizations align with their corporate standards
116What can you use to view the MS Secure Score for Devices?
- AMS Defender for Cloud Apps
- BMS Defender for Endpoints
- CMS Defender for Identity
- DMS Defender for Office 365
117Ordenar
- AThreat Trackers - Provides intelligence on prevailing cybersecurity issues
- BThreat Explorer - Provides real-time reports to identify and analyze recent threats
- CAnti-Phishing protection - Detects impersonation attempts
118Yes or No
- AEach NSG rule must have a unique name
- BNSG default rules can be deleted
- CNSG rules can be configured to check TCP, UDP or ICMP network protocol types
119When users attempt to access an application or a service ( ) controls their level of access
- Aadministration
- Bauditing
- Cauthentication
- Dauthorization
120What are customers responsible for when evaluating security in SaaS cloud services model?
- Aoperating systems
- Bnetwork protocol
- Capplications
- Daccounts and identities
121Provides single sign-on (SSO) capabilities across multiple identity providers
- AA domain controller
- BActive Directory Domain Services (AD DS)
- CAzure AD Privilege identity Management (PIM)
- DFederation
122In an environment that has on-premises resources and cloud resources, should be the primary security perimeter
- AThe cloud
- Ba firewall
- Cidentity
- DMS defender for cloud
123What does conditional access evaluate azure AD identity protection
- Auser actions
- Bgroup membership
- Cdevice compliance
- Duser risk
124Which statement represents a MS privacy principle
- AMS manages privacy settings for its customer
- BMS respects the local privacy laws that are applicable to its customers
- CMS uses hosted customer email and chat data for targeted advertising
- DMS does not collect any customer data
125System is a tool that collects data from multiple systems, identifies correlations or anomalies and generates alerts and incidents
- AA security information and event management (SIEM)
- BA security orchestration automated response (SOAR)
- CA trusted automated eXchange of indicator information (TAXII)
- Dan attack surface reduction (ASR)
126MS Sentinel ( ) use Azure Logic Apps to automate and orchestrate responses to alerts
- Aanalytic rules
- Bhunting queries
- Cplaybooks
- Dworkbooks
127Which compliance feature should you use to identify documents that are employee resumes?
- Apre-trained classifiers
- BActivity explorer
- CeDiscovery
- DContent explorer
128Order
- ANetworks - Must be segmented
- BIdentities - Must be verified by using strong authentication
- CData - Must be classified, labeled, and encrypted based on its attributes
129Order
- APreventative - Use encryption to protect data at rest
- BDetective - Actively monitor systems to identify irregularities that might represent risks
130Which pillar of identity relates to tracking the resources accessed by a user?
- Aauthorization
- Bauditing
- Cadministration
- Dauthentication
131What can be created in AD DS
- ALine-of-business (LOB) apps that require modern authentication
- Bcomputers account
- CSaaS applications that require modern authentication
- Dmobile devices
132When users sign in ( ) verifies their credentials to prove their identity
- Aadministration
- Bauditing
- Cauthentication
- Dauthorization
133Yes or No
- AAuthorization is used to identify the level of access to a resource
- BAuthentication is proving that users are who they say they are
- CAuthentication identifies whether you can read and write to a file
134What is a function of Conditional access session controls?
- Aenforcing device compliance
- Benforcing client app compliance
- Cenable limited experiences, such as blocking download of sensitive information
- Dprompting MFA
135Yes or No
- AAzure AD identity protection can add users to groups based on the user's risk lvl
- BUser AD identity protection can detect whether user credentials were leaked to the public
- CUser AD identity protection can be used to invoke MFA based on a user's risk lvl
136What can you use to ensure that all the users in a specific gorup must use MFA to sign to Azure AD
- AAzure policy
- Ba communication compliance policy
- Ca conditional access policy
- Da user risk policy
137Yes or No
- AYou can create a hybrid identity in an on-premises AD that syncs to Azure AD
- BUser accounts created in Azure AD sync automatically to an on-premises AD
- CWhen using a hybrid model, authentication can either be done by Azure AD or by another identity provider
138 Which three authentication methods can Azure AD users use to reset their password?
- AMobile app notification
- Btext message to a phone
- Csecurity questions
- Dcertificate
- Epicture password
139Yes or No
- AAzure AD B2C enables external users to sign in by using their preferred social or enterprise account identities
- BExternal Azure AD B2C users are managed in the same directory as users in the Azure AD organization
- CCustomer branding can be applied to Azure AD B2C authentication
140Yes or No
- ASoftware tokens are an example of passwordless authentication
- BWindows Hello is an example of passwordless authentication
- CFIDO2 security keys are an example of passwordless authentication
141Which Security feature is available in the free mode of MS defender for cloud?
- Athreat protection alerts
- BJust-in-time (JIT) VM access to Azure virutal machines
- Cvulnerability scanning of virtual machines
- Dsecure score
142MS 365 Endpoint data loss prevention (DLP) can be used on which operating system
- AWindos 10 and newer only
- BWindows 10 and newer and android only
- CWindows 10 and newer and iOS only
- DWindows 10 and newer, android and iOS
143Yes or No
- AMS defender for cloud can detect vulnerabilities and threats for azure storage
- Bcloud security posture management (CSPM) is available for all azure subscriptions
- CMS defender for cloud can evaluate the security of workloads deployed to azure or on-premises
144is a cloud service for storing application secrets
- AAzure AD password protection
- BAzure bastion
- CAzure information protection (AIP)
- DAzure Key Vault
145provides cloud workload protection for azure and hybrid cloud resources
- AMS defender for cloud
- Bazure monitor
- Cazure security benchmark
- DMS secure score
146What is the maximum number of resources that azure DDoS protection standard can protect without additional costs
- A50
- B100
- C500
- D1000
147What are two reasons to deploy multiple virtual networks instead of using just one virtual network?
- Ato meet governance policies
- Bto connect multiple types of resources
- Cto separate the resources for budgeting
- Dto isolate the resources
148MS sentinel provides quick insights into data by using
- AAzure logics apps
- BAzure monitor workbook templates
- CAzure resources graph explorer
- Dplaybooks
149You have an Azure subscription that contains multiple resources
You need to assess compliance and enforce standards for the existing resources, what should you use?- AAzure Blueprints
- Bthe anomaly detector service
- CMS Sentinel
- DAzure Policy
150Which MS defender for Cloud metric displays the overall security health of an Azure subscription?
- Asecure score
- Bresource health
- Ccompleted controls
- Dthe status of recommendations
151Yes or No
- AYou can use information barriers with Ms exchange
- BYou can use information barriers with MS SharePoint
- CYou can use information barriers with Ms Teams
152Inside risk management is configured from the
- AMS 365 admin center
- BMs 365 compliance center (Purview)
- CMs 365 defender portal
- DMS defender for Cloud apps portal
153You need to ensure repeatability when creating new resources in an Azure subscription, what should you use?
- AMS Sentinel
- BAzure Policy
- CAzure Batch
- DAzure Blueprints
154What is a characteristic of a sensitivity label in MS 365
- Aencrypted
- Brestricted to predefined categories
- Cpersistent
155Order
- ATriage - Review and filter alerts
- BInvestigate - Create cases in the case dashboard
- CAction - Send a reminder of corporate policies to users
156Yes or No
- AMS Purview provides sensitive data classification
- BMS Sentinel is a data lifecycle management solution
- CMS Purview can only discover data that is stored in Azure
157Measures a company's progress in completing actions that help reduce risks around data protection and regulatory standards
- ACompliance score
- BMS 365 compliance center reports
- Cthe trust center
- Dtrust documents
158Yes or No
- AAsymmetric encryption uses a public key and private key pair
- BSymmetric encryption uses a public key and private key pair
- CYou can use decryption to retrieve original content from a content hash
159Ensuring that the data you retrieve is the same as the data you stored in an example of maintaining
- Aavailability
- Bconfidentiality
- Cintegrity
- Dtransparency
160Track compliance with groupings of controls from a specific regulation or requirement
- Aassessments
- Bimprovement actions
- Csolutions
- Dtemplates
161Yes or No
- AIn SaaS, applying application updates is the responsibility of the organization
- BIn IaaS, managing the physical network is the responsibility of the cloud provider
- Cin all Azure cloud deployment types, managing the security of information and data is the responsibility of the organization
162What should you use to associate the same identity to more than one Azure virtual machine?
- Aan Azure AD user account
- Ba user-assigned managed identity
- Ca system-assigned managed identity
- Dan Azure AD security group
163Yes or No
- ASecurity defaults require an Azure AD premium license
- BSecurity defaults can be enabled for a single Azure AD user
- CWhen security defaults are enabled, all administrators must use MFA
164Which three forms of verification can be used with Azure AD MFA?
- Asecurity quesitons
- Bthe MS authenticator app
- CSMS messages
- Da smart card
- EWindows Hello for business
165Yes or No
- AAn external email address can be used to authenticate self-service password reset (SSPR)
- BA notification to the MS authenticator app can be used to authenticate self-service password reset (SSPR)
- Cto perform self-service password reset (SSPR), a user must already be signed in and authenticated to Azure AD
166MS 365 Endpoint data loss prevention (DLP) can be used on which operating systems?
- AWindows 10 and newer only
- BWindows 10 and newer and Android only
- CWindows 10 and newer and MacOS only
- DWindows 10 and newer, and and MacOS
167You have an Azure subscription that contains a Log analytics workspace.
You need to onboard MS Sentinel, what should you do first?- ACreate a hunting query
- BCorrelate alerts into incidents
- CConnect to your security sources
- DCreate a custom detection rule
168Yes or No
- AAzure DDoS protection standard protects against man-in-the-middle (MITM) attacks
- BAzure DDoS protection standard is enabled by default in an Azure subscription
- CAzure DDoS protection standard protects against protocol attacks
169Features of MS defender for cloud block malware and other unwanted applications, while reducing the network attack surface on Azure virtual machines
- Aaccess and application control
- BCloud security posture management (CSPM)
- Ccontainer security
- Dvulnerability assessment
170Yes or No
- AYou can use MS purview information barriers to detect messages that contain inappropriate language
- BYou can use Ms Purview communication compliance to scan files stored in MS SharePoint online
- CYou can use MS Purview communication compliance to scan internal and external emails in MS Exchange online
171Single sign-on (SSO) configured between multiple identity providers is an example of
- Afederation
- Bintegration
- Cpassword hash synchronization
- Dpass-through authentication
172You plan to move resources to the cloud.
You plan to manage only the data, user accounts and user devices for a cloud-based App- ASaaS
- BPaaS
- CIaaS
173Enabling a system-assigned managed identity creates a service principal that
- Acan be shared with multiple azure resources
- Bis managed separately from the resource that uses it
- Cis tied to the lifecycle of the resource that uses it
- Dmust be registered manually with Azure AD
174Yes or No
- ADevice identity can be stores in Azure AD
- BA single system-assigned managed identity can be used by multiple Azure resources
- CIf you delete an Azure resources that has a user-assigned managed identity, the managed identity is deleted automatically
175Which score measures an organization's progress in completing actions that help reduce risks associated to data protection and regulatory standards?
- AAdoption score
- BMS Secure Score
- CSecure score in MS defender for Cloud
- DCompliance Score
176Yes or No
- AGitHub is a cloud-based identity provider
- BFederation provides SSO with multiple services providers
- CA central identity providers manages all modern authentication services, such as authentication, authorization and auditing
177In which order should you list the service models from the most customer responsibility to the least?
- AOn-premises datacenter
IaaS
PaaS
SaaS - Bnone
- AOn-premises datacenter
178You can assign ( ) to an Azure AD role
- Aa management group
- Ba resource group
- Ca security principal
- Dan administrative unit
179You have an Azure subscription
You need to implement approval-based, time-bound role activation- AAccess review in Azure AD
- BAzure AD Privileged identity management (PIM)
- CAzure AD identity protection
- DConditional access in Azure AD
180What should you use in the MS 365 defender portal to view security trends and track the protection status of identities
- AReports
- Bincidents
- Chunting
- Dsecure score
181Provides baseline recommedations and guidance for protecting Azure services
- AAzure Apps Insights
- BAzure Network Watcher
- CLog Analytics workspaces
- DMS Cloud security benchmark
182Yes or No
- AMS Sentinel uses logic apps to identify anomalies across resources
- BMS Sentinel uses workbooks to correlate alerts into incidents
- CThe hunting search-and-query tools of MS Sentinel are based on the MITRE ATT&CK framework
183Yes or No
- AYou can restrict communication between users in Exchange Online by using information barriers
- BYou can restrict accessing a SharePoint Online site by using information barriers
- CYou can prevent sharing a file with another user in MS Teams by using
184Which portal contains the solution catalog?
- AMS Purview compliance portal
- BMS 365 defender portal
- CMS 365 admin center
- DMS 365 apps admin center
185In the MS Purview compliance portal, you can use ( ) to remove features from the navigation pane
- ACompliance manager
- BCustomize navigation
- CPolicies
- DSettings
186Yes or No
- ACommunication compliance is configured by using the MS 365 admin center
- BMS SharePoint online supports communication compliance
- CCommunication compliance can remediate compliance issues
187This question requires that you evaluate the underlined text to determine if it is correct.
A company requires that service representatives schedule customer visits every six months. Each service representative is required to enter a scheduled task for the next checkup as they are leaving a client site. A service representative wants to automate task entry by creating a business process flow that can be initiated from the service call screen on a phone.
Review the underlined text. If it makes the statement correct, select `No change is needed.` If the statement is incorrect, select the answer choice that makes the statement correct.- ANo change is needed.
- Ba scheduled
- Can instant
- Dan action
188You are a Microsoft 365 administrator for a company.
A customer submits a data subject request (DSR) to delete customer information in compliance with General Data Protection Regulation (GDPR). You must place legal holds on related data whenever possible.
You need to respond to the request by searching for the customer's data in various Microsoft 365 tools.
How should you search for the data? To answer, drag the appropriate search methods to the correct Microsoft 365 applications. Each search method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.- A
- BNone
- A
189Yes or No
- ARetention policies assign the same retention settings to all the files in a MS SharePoint Online library
- BRetention labels can be assigned to individual files and email messages
- CYou can assign multiple retention labels to an email message or a document
190Is used when Azure web apps must use the same identity
- AA certificate
- BA service principal
- CA system-assigned managed identity
- DA user-assigned managed identity
191Conditional access policies are enforced ( ) first-factor authentication
- Aafter
- Bbefore
- Cduring
- Dinstead of
192You need to implement a pre-built solution that will identify well-known brands in digital photographs.
Which Azure cognitive services service should you use?- ACustom Vision
- BForm Recognizer
- CFace
- DComputer Vision
193Yes or No
- AConditional Access is implemented by using policies in MS Entra ID
- BA conditional Access policy can block or allow MS Entra ID connections based upon the specific platform of a user's device
- CA conditional access policy can be applied to a MS 365 group
Information
- Description
- Quiz on SC-900, created by gong roca on 26/04/2024.
- Author
- gong roca
- Language
- English
- Views
- 88
- Tags
- Rating
- No ratings yet Rate this quiz