A company's IT team needs to reduce the attack surface on Windows endpoints. They want to block common exploit techniques, prevent unauthorized applications from running, and receive vulnerability assessments for their devices. All endpoints are managed by Microsoft Intune. What should they implement?

Microsoft Defender for Identity with entity behavior analytics

Microsoft Defender for Endpoint with attack surface reduction rules and vulnerability management

Microsoft Defender for Office 365 with Safe Attachments

Microsoft Defender for Cloud Apps with app discovery

What is the primary focus of Microsoft Defender for Endpoint?

Protecting on-premises identity infrastructure

Protecting email and collaboration workloads

Protecting devices such as desktops, laptops, and mobile devices from threats

Protecting cloud applications and data

A company has deployed Microsoft Defender XDR workloads: Defender for Office 365, Defender for Endpoint, and Defender for Identity. The security team receives an alert about a phishing email that was delivered to a user. The user clicked a link and entered credentials. The team wants to understand the full scope of the attack, including whether the compromised credentials were used on other devices. What should they do first in the Microsoft Defender portal?

Run a custom hunting query to search for the user's sign-in logs across all workloads

Check the email trace in Defender for Office 365 to see if the email was delivered

Open the incident page for the alert and review the attack story, including related alerts and affected entities

Review the device timeline in Defender for Endpoint for the user's device

A company has an on-premises Active Directory environment and uses Azure AD Connect to sync identities to Microsoft Entra ID. The security team suspects that attackers are using compromised credentials to perform reconnaissance and lateral movement. They want a solution that monitors on-premises identity signals and detects these activities. What should they deploy?

Microsoft Defender for Endpoint

Microsoft Defender for Cloud Apps

Microsoft Defender for Identity

Microsoft Defender for Office 365

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 4

Describe Threat Protection with Microsoft Defender XDR SC-900 Practice Questions (Page 5)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

35–40%of the exam

Questions 21–25

21application · medium
A company's IT team needs to reduce the attack surface on Windows endpoints. They want to block common exploit techniques, prevent unauthorized applications from running, and receive vulnerability assessments for their devices. All endpoints are managed by Microsoft Intune. What should they implement?
Select an answer first
22foundation · easy
Which area of the Microsoft Defender portal would a security analyst use to investigate a suspected attack that affected multiple devices?
Select an answer first
23foundation · easy
What is the primary focus of Microsoft Defender for Endpoint?
Select an answer first
24expert · hard
A company has deployed Microsoft Defender XDR workloads: Defender for Office 365, Defender for Endpoint, and Defender for Identity. The security team receives an alert about a phishing email that was delivered to a user. The user clicked a link and entered credentials. The team wants to understand the full scope of the attack, including whether the compromised credentials were used on other devices. What should they do first in the Microsoft Defender portal?
Select an answer first
25application · medium
A company has an on-premises Active Directory environment and uses Azure AD Connect to sync identities to Microsoft Entra ID. The security team suspects that attackers are using compromised credentials to perform reconnaissance and lateral movement. They want a solution that monitors on-premises identity signals and detects these activities. What should they deploy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.

Describe Threat Protection with Microsoft Defender XDR SC-900 Practice Questions (Page 5)

Questions 21–25

Which area of the Microsoft Defender portal would a security analyst use to investigate a suspected attack that affected multiple devices?

What is the primary focus of Microsoft Defender for Endpoint?

Keep studying — Describe the capabilities of Microsoft security solutions