SC-900 Security Operations & Threat Protection 4

Question 1

Which Microsoft Defender for Endpoint capability prevents malicious processes from running by comparing file hashes against a known-bad database?

Accepted Answer

Next-generation antivirus protection

Answer

Next-generation antivirus (Microsoft Defender Antivirus) uses cloud-delivered protection and hash-based detection to block known malware before execution.

Question 2

What is the MITRE ATT&CK framework primarily used for in a security operations context?

Accepted Answer

Mapping adversary tactics, techniques, and procedures (TTPs)

Answer

MITRE ATT&CK is a knowledge base of adversary TTPs that security teams use to understand, detect, and respond to real-world attack patterns.

Question 3

A Security Operations Center (SOC) analyst needs to visualize trends in security alerts over the past 30 days. Which Microsoft Sentinel feature is best suited for this?

Accepted Answer

Workbooks

Answer

Workbooks in Microsoft Sentinel provide customizable dashboards and visualizations for monitoring trends and KPIs from ingested security data.

Question 4

Which Microsoft Defender for Endpoint feature restricts the actions that Office applications can take, such as preventing them from spawning child processes?

Accepted Answer

Attack Surface Reduction (ASR) rules

Answer

Attack Surface Reduction rules block specific behaviors that are commonly exploited, such as Office apps launching child processes or injecting into other processes.

Question 5

What is the key difference between SIEM and SOAR in a security operations context?

Accepted Answer

SIEM aggregates and analyzes data; SOAR automates response workflows

Answer

SIEM (Security Information and Event Management) collects and analyzes security data, while SOAR (Security Orchestration, Automation and Response) automates responses to detected threats.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Security Operations & Threat Protection 4