SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Defender Threat Protection 3

Question 1

Which Microsoft Defender for Endpoint capability allows security teams to remotely isolate a compromised device while maintaining communication with the Defender portal?

Accepted Answer

Device Isolation

Answer

Device Isolation in Defender for Endpoint cuts off a compromised machine from the network while keeping the management channel to the Defender portal open for investigation.

Question 2

In the context of SC-900, what is 'Threat Intelligence' as provided by Microsoft Defender Threat Protection?

Accepted Answer

Information about known threat actors, tactics, and indicators of compromise used to improve defenses

Answer

Threat Intelligence provides contextual information about threat actors, their TTPs (tactics, techniques, and procedures), and indicators of compromise to help security teams proactively defend against known threats.

Question 3

Which plan of Microsoft Defender for Office 365 adds threat hunting, attack simulation training, and campaign views?

Accepted Answer

Microsoft Defender for Office 365 Plan 2

Answer

Defender for Office 365 Plan 2 adds advanced capabilities including Threat Explorer, attack simulation training, automated investigation, and campaign views on top of Plan 1 features.

Question 4

What is the role of Microsoft Sentinel in relation to Microsoft Defender products?

Accepted Answer

It acts as a cloud-native SIEM/SOAR that ingests alerts from Defender products for broader correlation

Answer

Microsoft Sentinel is a cloud-native SIEM and SOAR that ingests security data from Defender products and other sources, providing broader threat correlation, hunting, and automated response.

Question 5

Which feature in Microsoft Defender for Endpoint provides a timeline of all observed behaviors and events on a device during an investigation?

Accepted Answer

Device Timeline

Answer

The Device Timeline in Defender for Endpoint shows a chronological view of all recorded events, processes, network connections, and file changes on an endpoint to support forensic investigation.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Defender Threat Protection 3