Which built-in capability of Microsoft Sentinel helps identify unusual user behavior?

Machine learning-based anomaly detection

Data loss prevention for email attachments

Automated patch management for endpoints

Network address translation for outbound traffic

A multinational company has security data in Azure, AWS, and on-premises. They need to correlate sign-in logs from all sources to detect a coordinated attack. They also have a limited budget and want to minimize the number of tools to manage. What should they do?

Deploy Microsoft Sentinel and connect all sources using available data connectors

Use Microsoft Defender for Cloud only

Use Azure Monitor only and export all logs to it

Use separate SIEM tools for each cloud provider

During a security incident, an analyst needs to isolate an infected virtual machine and collect forensic evidence. The response must be repeatable and require minimal manual steps. What should the analyst use in Microsoft Sentinel?

A hunting query that finds related events

A playbook that runs automated actions

A workbook that displays the incident timeline

An analytics rule that creates an alert

What is an example of a manual response action that can be performed in Microsoft Sentinel?

Running a playbook to automatically isolate a machine

Automatically disabling a user account when a threat is detected

Creating a new analytics rule to detect future threats

Using the investigation graph to explore related entities and alerts

Which method does Microsoft Sentinel use to mitigate threats?

Patching operating systems and applications automatically

Blocking all incoming network traffic by default

Automated response actions through playbooks and manual investigation tools

Encrypting all data stored in the cloud

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 3

Describe Capabilities of Microsoft Sentinel SC-900 Practice Questions (Page 2)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

35–40%of the exam

Questions 6–10

6foundation · easy
Which built-in capability of Microsoft Sentinel helps identify unusual user behavior?
Select an answer first
7expert · hard
A multinational company has security data in Azure, AWS, and on-premises. They need to correlate sign-in logs from all sources to detect a coordinated attack. They also have a limited budget and want to minimize the number of tools to manage. What should they do?
Select an answer first
8application · medium
During a security incident, an analyst needs to isolate an infected virtual machine and collect forensic evidence. The response must be repeatable and require minimal manual steps. What should the analyst use in Microsoft Sentinel?
Select an answer first
9foundation · easy
What is an example of a manual response action that can be performed in Microsoft Sentinel?
Select an answer first
10foundation · easy
Which method does Microsoft Sentinel use to mitigate threats?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.