SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Defender Threat Protection 5

Question 1

What type of attack does Microsoft Defender for Identity specifically detect when an attacker uses a stolen Kerberos ticket-granting ticket to impersonate any user?

Accepted Answer

Golden Ticket attack

Answer

A Golden Ticket attack uses a forged Kerberos TGT (often created using the KRBTGT account hash) to impersonate any user, and Defender for Identity is designed to detect this lateral movement technique.

Question 2

Which Defender for Cloud feature assigns a numeric score to a subscription to reflect its overall security health?

Accepted Answer

Secure score

Answer

The Secure Score in Defender for Cloud quantifies an organization's security posture, with higher scores indicating that more security recommendations have been implemented.

Question 3

What is 'Automated Investigation and Response' (AIR) in Microsoft Defender for Endpoint designed to do?

Accepted Answer

Automatically investigate alerts and take remediation actions to reduce analyst workload

Answer

AIR automatically investigates triggered alerts using the same logic a security analyst would apply and can take approved remediation actions, dramatically reducing alert fatigue and response time.

Question 4

Which Microsoft Defender product would BEST protect against a business email compromise (BEC) attack where an attacker impersonates a CEO?

Accepted Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Office 365 includes anti-phishing policies with impersonation protection specifically designed to detect and block BEC and executive impersonation attacks in email.

Question 5

In SC-900 terms, what does 'SIEM' stand for and which Microsoft product fulfills this role?

Accepted Answer

Security Information and Event Management; Microsoft Sentinel

Answer

SIEM stands for Security Information and Event Management, and Microsoft Sentinel is Microsoft's cloud-native SIEM solution that collects, analyzes, and responds to security events across the environment.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Microsoft Security, Compliance, and Identity Fundamentals Microsoft Defender Threat Protection 5