A company wants to detect unusual behavior such as a user logging in from a new country and then downloading a large volume of data, which may indicate account compromise. They need a solution that automatically flags this pattern without writing custom detection rules. What should they use?

Microsoft Defender for Cloud's regulatory compliance dashboard

Microsoft Sentinel analytics rules with built-in anomaly detection

A security analyst wants to manually investigate a suspicious alert and then take a specific action, such as resetting a user's password. What should they use in Microsoft Sentinel?

Automation rules without playbooks

Incident investigation with playbooks

A security analyst wants to manually investigate a suspicious incident and then take a specific action, such as isolating a compromised device. They also want to document the steps taken. What should they use in Microsoft Sentinel?

Incident investigation and manual playbook execution

A company has security logs spread across Microsoft 365 Defender, Azure AD, and on-premises firewalls. The security team wants a single dashboard to correlate alerts and detect attacks that span these sources. What should you implement?

Microsoft Purview compliance portal

An organization has a mature security operations center that wants to use Microsoft Sentinel to detect threats that are unique to their environment. They have a team of analysts who can write KQL queries. What should they do to maximize detection coverage while minimizing false positives?

Use only custom analytics rules

Use only built-in analytics rules

Create custom analytics rules and use built-in rules

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 3

Describe Capabilities of Microsoft Sentinel SC-900 Practice Questions (Page 3)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

35–40%of the exam

Questions 11–15

11application · medium
A company wants to detect unusual behavior such as a user logging in from a new country and then downloading a large volume of data, which may indicate account compromise. They need a solution that automatically flags this pattern without writing custom detection rules. What should they use?
Select an answer first
12application · medium
A security analyst wants to manually investigate a suspicious alert and then take a specific action, such as resetting a user's password. What should they use in Microsoft Sentinel?
Select an answer first
13application · medium
A security analyst wants to manually investigate a suspicious incident and then take a specific action, such as isolating a compromised device. They also want to document the steps taken. What should they use in Microsoft Sentinel?
Select an answer first
14application · medium
A company has security logs spread across Microsoft 365 Defender, Azure AD, and on-premises firewalls. The security team wants a single dashboard to correlate alerts and detect attacks that span these sources. What should you implement?
Select an answer first
15expert · hard
An organization has a mature security operations center that wants to use Microsoft Sentinel to detect threats that are unique to their environment. They have a team of analysts who can write KQL queries. What should they do to maximize detection coverage while minimizing false positives?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.