SC-900 - Microsoft Security, Compliance, and Identity Fundamentals Microsoft Defender Threat Protection Questions and Answers

Question 1

An employee receives an email with a link to a new file-sharing website.
Which Microsoft Defender for Office 365 feature is specifically designed to protect the user by scanning the URL at the time of click to block malicious sites?

Accepted Answer

Safe Links

Answer

Safe Attachments

Answer

Anti-phishing policies

Answer

Threat Explorer

Question 2

A security analyst is investigating a potential breach. They suspect an attacker has compromised a user's on-premises Active Directory credentials and is attempting to move laterally across the network. Which Microsoft Defender component specializes in detecting and investigating such identity-based threats by analyzing signals from on-premises domain controllers?

Accepted Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender Vulnerability Management

Question 3

An organization wants to prevent users from accidentally running malicious code hidden in email attachments. They need a solution that opens attachments in a virtual environment to observe their behavior before they are delivered to the recipient. Which Microsoft Defender for Office 365 feature provides this 'detonation' capability?

Accepted Answer

Safe Attachments

Answer

Safe Links

Answer

Anti-spam policies

Answer

Attack simulation training

Question 4

A company is concerned about the use of unsanctioned cloud applications (Shadow IT) and wants to gain visibility into the cloud apps being used by employees. They also need to enforce security policies and protect data within these apps. Which Microsoft Defender service is designed to address these requirements as a Cloud Access Security Broker (CASB)?

Accepted Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud

Question 5

Which of the following capabilities is a core function of Microsoft Defender for Endpoint?

Accepted Answer

Providing endpoint detection and response (EDR) and attack surface reduction.

Answer

Rewriting URLs in emails to scan for malicious content at time-of-click.

Answer

Using sensors on domain controllers to detect compromised identities.

Answer

Discovering and controlling the use of unapproved SaaS applications.

Question 6

A security operations team uses the Microsoft Defender portal as their primary interface for incident response. What is the primary benefit of this unified portal?

Accepted Answer

It aggregates signals from multiple Defender services into single, correlated incidents.

Answer

It provides a way to purchase additional Microsoft security licenses.

Answer

It is used exclusively for managing on-premises Active Directory security.

Answer

It only displays alerts related to email and phishing threats.