SC-900 Security Operations & Threat Protection 5

Question 1

Which Microsoft 365 Defender feature provides a visual representation of an attack's timeline and the entities involved to help analysts understand scope?

Accepted Answer

Attack story / incident graph

Answer

The incident graph (attack story) in Microsoft 365 Defender visually maps relationships between alerts, entities, and timelines within a single incident.

Question 2

What does 'Controlled Folder Access' in Microsoft Defender for Endpoint protect against?

Accepted Answer

Ransomware encrypting files in protected folders

Answer

Controlled Folder Access prevents untrusted applications from making changes to protected folders, blocking ransomware from encrypting user files.

Question 3

A SOC team wants to measure how their current security controls map against the MITRE ATT&CK framework. Which Microsoft Sentinel feature helps with this?

Accepted Answer

MITRE ATT&CK coverage view in Sentinel

Answer

Microsoft Sentinel's MITRE ATT&CK framework coverage view shows which TTPs are covered by active analytics rules, revealing detection gaps.

Question 4

Which Microsoft service is specifically designed to protect identities by detecting risks like leaked credentials and atypical sign-in behavior for Azure AD accounts?

Accepted Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra ID Protection monitors cloud identity signals and detects risks such as anonymous IP usage, leaked credentials, and password spray attacks.

Question 5

What is the role of 'threat intelligence' in a security operations workflow?

Accepted Answer

It provides context about known threats, attackers, and indicators of compromise to improve detection

Answer

Threat intelligence enriches security data with context about known malicious IPs, domains, file hashes, and attacker TTPs to help analysts detect and prioritize threats.

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

(SC-900) Microsoft Security, Compliance, and Identity Fundamentals Exam Practice Test

SC-900 Security Operations & Threat Protection 5