A security team wants to automate the containment of compromised user accounts, but they also need to preserve evidence for legal proceedings. They are concerned that automated actions might destroy evidence. What should they do?

Use a playbook that first collects evidence, then disables the account

Use hunting queries to find evidence

Disable the account immediately without evidence collection

Use a workbook to document the incident

Which statement best describes the role of a SIEM in security operations?

It manages user identities and controls access to cloud resources

It automatically patches vulnerabilities in operating systems and applications

It provides a sandbox environment for executing suspicious files safely

It provides a centralized platform for collecting and correlating security logs to identify potential threats

A security team wants to detect insider threats, such as unusual data exfiltration by employees. They have data from Microsoft 365 and on-premises file servers. They need a solution that can correlate user activity across these sources. What should they use?

Microsoft Sentinel with UEBA analytics

Microsoft Purview Data Loss Prevention only

Azure Active Directory Identity Protection only

Microsoft Defender for Cloud Apps only

A security team wants to automate the response to a malware outbreak by isolating affected devices and blocking malicious domains. They also want to ensure that the response is consistent and auditable. What should they use?

A playbook that uses Microsoft Defender for Endpoint and Azure Firewall connectors

A data connector for malware logs

A workbook that shows the affected devices

A hunting query that identifies the malware

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 3

Describe Capabilities of Microsoft Sentinel SC-900 Practice Questions (Page 1)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

35–40%of the exam

Questions 1–5

1application · medium
A small company wants to replace its on-premises SIEM with a cloud service that can collect security logs from multiple sources, provide real-time analysis, and scale without managing infrastructure. Which solution should they choose?
Select an answer first
2expert · hard
A security team wants to automate the containment of compromised user accounts, but they also need to preserve evidence for legal proceedings. They are concerned that automated actions might destroy evidence. What should they do?
Select an answer first
3foundation · easy
Which statement best describes the role of a SIEM in security operations?
Select an answer first
4expert · hard
A security team wants to detect insider threats, such as unusual data exfiltration by employees. They have data from Microsoft 365 and on-premises file servers. They need a solution that can correlate user activity across these sources. What should they use?
Select an answer first
5expert · hard
A security team wants to automate the response to a malware outbreak by isolating affected devices and blocking malicious domains. They also want to ensure that the response is consistent and auditable. What should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.