SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Defender Threat Protection 4

Question 1

What is 'Advanced Hunting' in Microsoft 365 Defender?

Accepted Answer

A query-based threat hunting tool using Kusto Query Language (KQL) to search across security data

Answer

Advanced Hunting is a proactive threat hunting tool in Microsoft 365 Defender that uses KQL to query up to 30 days of raw security data across endpoints, identities, email, and cloud apps.

Question 2

Which Microsoft Defender for Identity alert indicates that an attacker may be attempting to enumerate all users and groups in Active Directory?

Accepted Answer

LDAP reconnaissance

Answer

LDAP reconnaissance alerts in Defender for Identity signal that an attacker is querying Active Directory via LDAP to map out users, groups, and organizational structure.

Question 3

What is the 'Zero Trust' principle that Microsoft Defender Threat Protection products help enforce by continuously validating signals?

Accepted Answer

Assume breach

Answer

The 'Assume breach' Zero Trust principle drives Microsoft Defender products to continuously monitor and validate signals, minimizing blast radius by assuming attackers may already be inside.

Question 4

Which component of Microsoft Defender for Cloud provides a regulatory compliance dashboard to track adherence to standards like PCI DSS and ISO 27001?

Accepted Answer

Regulatory Compliance

Answer

The Regulatory Compliance dashboard in Defender for Cloud maps your resource configurations against controls in compliance frameworks like PCI DSS, ISO 27001, and NIST.

Question 5

What is the primary purpose of Microsoft Defender for Endpoint's 'Endpoint Detection and Response' (EDR) capability?

Accepted Answer

Detecting and investigating advanced threats that bypassed preventive controls

Answer

EDR provides advanced detection and investigation capabilities for threats that evade preventive controls, offering behavioral analytics, threat hunting, and response actions.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Defender Threat Protection 4