A security team wants to automate responses to common alerts, but they are concerned about accidentally blocking legitimate user activity. They need a solution that requires human approval for high-impact actions. What should they configure in Microsoft Sentinel?

Automation rules that run immediately

Hunting queries to find threats

Playbooks with manual approval steps

A security operations team wants to automatically disable a user account when Sentinel detects a brute-force attack on that account. They also want to log the action for audit. Which feature should they use?

A hunting query that identifies the attack

A workbook that shows the attack details

A playbook that runs an action to disable the user and logs the action

A data connector that ingests authentication logs

A security operations team receives hundreds of low-severity alerts daily. They want to automatically close known false positives and create incidents for only genuine threats, without manual intervention. What should you configure in Microsoft Sentinel?

Automation rules with playbooks

Analytics rules with alert details

Data connectors for all sources

An organization wants to detect advanced threats that may go unnoticed by simple rule-based detection, such as multi-stage attacks that combine phishing emails and lateral movement. What should they rely on in Microsoft Sentinel?

Machine learning analytics rules

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 3

Describe Capabilities of Microsoft Sentinel SC-900 Practice Questions (Page 6)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

6concepts

35–40%of the exam

Questions 26–30

26expert · hard
A security team wants to automate responses to common alerts, but they are concerned about accidentally blocking legitimate user activity. They need a solution that requires human approval for high-impact actions. What should they configure in Microsoft Sentinel?
Select an answer first
27application · medium
A security operations team wants to automatically disable a user account when Sentinel detects a brute-force attack on that account. They also want to log the action for audit. Which feature should they use?
Select an answer first
28application · medium
A security operations team receives hundreds of low-severity alerts daily. They want to automatically close known false positives and create incidents for only genuine threats, without manual intervention. What should you configure in Microsoft Sentinel?
Select an answer first
29application · medium
A company wants to centralize security logs from its on-premises servers, cloud workloads, and SaaS applications into one place for analysis. Which Microsoft Sentinel feature should they configure first?
Select an answer first
30application · medium
An organization wants to detect advanced threats that may go unnoticed by simple rule-based detection, such as multi-stage attacks that combine phishing emails and lateral movement. What should they rely on in Microsoft Sentinel?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.