SC-900 Security Operations & Threat Protection 3

Question 1

What type of signal does Microsoft Defender for Identity primarily analyze to detect suspicious activity?

Accepted Answer

Active Directory Domain Services logs and traffic

Answer

Microsoft Defender for Identity monitors Active Directory Domain Services traffic and logs to detect identity-based attacks such as pass-the-hash and lateral movement.

Question 2

Which Microsoft 365 Defender portal feature provides a unified view of incidents across endpoints, email, identities, and apps?

Accepted Answer

Incidents queue

Answer

The Incidents queue in the Microsoft 365 Defender portal aggregates correlated alerts from across all Microsoft 365 Defender products into unified incidents.

Question 3

What does the 'Kill Chain' framework help security analysts understand?

Accepted Answer

The stages an attacker follows from initial access to achieving their goal

Answer

The Cyber Kill Chain describes the sequential stages of a cyberattack, helping analysts understand attacker progression and identify where to intervene.

Question 4

A security analyst notices an alert that a user's credentials were used to sign in from two countries within 30 minutes. Which Microsoft service most likely generated this alert?

Accepted Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra ID Protection (formerly Azure AD Identity Protection) detects risky sign-ins such as impossible travel and generates risk alerts.

Question 5

Which SIEM capability allows Microsoft Sentinel to ingest logs from non-Microsoft sources such as firewalls and Linux servers?

Accepted Answer

Data connectors

Answer

Data connectors in Microsoft Sentinel enable log ingestion from hundreds of sources including non-Microsoft devices, services, and platforms.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Security Operations & Threat Protection 3