Capabilities of Microsoft Security Solutions

Describe Azure infrastructure security services, security management capabilities, Microsoft Sentinel SIEM/SOAR, and Microsoft Defender XDR threat protection.

5 minutes 5 Questions

Microsoft Security Solutions offer a comprehensive suite of capabilities designed to protect organizations across their entire digital estate. Here's an overview of the key capabilities: **1. Azure Security Solutions:** Microsoft provides robust security through Azure services like Azure DDoS Prot…

Concepts covered

Azure DDoS Protection Web Application Firewall (WAF)Network Security Groups (NSGs)Azure Bastion Azure Key Vault Cloud Security Posture Management (CSPM)Cloud Workload Protection Microsoft Sentinel Threat Detection and Mitigation Microsoft Defender for Office 365 Microsoft Defender for Cloud Apps Microsoft Defender Vulnerability Management Microsoft Defender Portal SIEM and SOAR Concepts Azure Firewall Network Segmentation with Azure Virtual Networks Microsoft Defender for Cloud Security Policies, Standards, and Recommendations Microsoft Defender XDR Services Overview Microsoft Defender for Endpoint Microsoft Defender for Identity Microsoft Defender Threat Intelligence

Test mode:

Exam (Timed)

Practice (With explanations)

Start practice test

SC-900 - Capabilities of Microsoft Security Solutions Example Questions

Test your knowledge of Capabilities of Microsoft Security Solutions

Question 1

A company's security team notices that a domain controller is generating unusual LDAP queries late at night. They suspect an attacker may be performing reconnaissance to map the Active Directory environment. The team wants to detect this type of activity using their existing Microsoft Defender for Identity deployment. Which detection capability would most likely identify this behavior?

Credential theft detection that identifies password spraying attempts against Active Directory using abnormal authentication patterns Lateral movement detection that identifies unusual resource access attempts against Active Directory using abnormal connection patterns Reconnaissance detection that identifies enumeration attempts against Active Directory using abnormal query patterns Privilege escalation detection that identifies permission modification attempts against Active Directory using abnormal group changes

Correct Answer: Reconnaissance detection that identifies enumeration attempts against Active Directory using abnormal query patterns

Microsoft Defender for Identity includes reconnaissance detection capabilities that specifically identify when attackers enumerate Active Directory through abnormal LDAP queries, directory service lookups, and other discovery techniques used to map the AD environment.

Credential theft detection focuses on authentication-based attacks like password spraying or brute force, not LDAP query patterns. Lateral movement detection addresses suspicious connections between systems, not directory enumeration. Privilege escalation detection monitors for unauthorized permission changes or group membership modifications, which is unrelated to querying AD structure.

The key concept tested is understanding that Microsoft Defender for Identity categorizes threats into distinct kill chain phases, and reconnaissance through AD enumeration falls under its reconnaissance detection capability.

Question 2

A small company wants to protect its Windows laptops from cyber threats. An IT administrator hears that Microsoft Defender for Endpoint can help. The administrator asks: 'What does this product mainly do for our devices?' Which answer best explains what Microsoft Defender for Endpoint provides?

It is a platform that encrypts hard drives and controls access permissions on endpoints like laptops and servers It is a platform that helps detect, investigate, and respond to threats on endpoints like laptops and servers It is a platform that monitors network bandwidth and optimizes internet connectivity on endpoints like laptops and servers It is a platform that manages software updates and operating system patches on endpoints like laptops and servers

Correct Answer: It is a platform that helps detect, investigate, and respond to threats on endpoints like laptops and servers

Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help organizations prevent, detect, investigate, and respond to advanced threats on devices such as laptops, desktops, and servers.

Managing software updates and OS patches is the function of tools like Microsoft Intune or Windows Update for Business, not Defender for Endpoint. Encrypting hard drives and controlling access permissions describes functionality provided by BitLocker and access management tools. Monitoring network bandwidth and optimizing connectivity relates to network management tools, not endpoint security.

The key concept tested is understanding the core purpose of Microsoft Defender for Endpoint as a threat detection and response platform for endpoint protection.

Question 3

A company wants to allow administrators to securely connect to Azure virtual machines using only a web browser. They do not want to install any special client software on administrator workstations. Which Azure service should they use to achieve this goal?

Azure Firewall, which provides browser-based RDP and SSH access through its management interface Azure VPN Gateway, which provides browser-based RDP and SSH access through an encrypted tunnel Azure Application Gateway, which provides browser-based RDP and SSH connectivity through its web proxy feature Azure Bastion, which provides browser-based RDP and SSH access through the Azure portal

Correct Answer: Azure Bastion, which provides browser-based RDP and SSH access through the Azure portal

Azure Bastion is a fully managed PaaS service that provides secure RDP and SSH connectivity to virtual machines directly through the Azure portal using a web browser, without requiring any client software or public IP addresses on the VMs.

Azure VPN Gateway creates encrypted site-to-site or point-to-site tunnels but does not offer browser-based RDP or SSH access. Azure Firewall is a network security service for filtering traffic, not for providing remote desktop connectivity. Azure Application Gateway is a web traffic load balancer and does not provide RDP or SSH proxy capabilities.

The key concept tested is understanding Azure Bastion as a secure, browser-based remote access solution for Azure VMs.

Learn Security, Compliance & Identity

SC-900 security, compliance & identity basics

Security Concepts: Zero trust, shared responsibility, and defense in depth
Identity Fundamentals: Azure AD, authentication methods, and access management
Compliance: Microsoft compliance solutions, privacy, and data governance
30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
Risk-Free: 7-day free trial with all premium features!

Start Your Free 7-Day Trial

More Capabilities of Microsoft Security Solutions questions

879 questions (total)

Practice 100 questions

One session at a time, always new questions