A company wants to prioritize security fixes on their Windows servers and workstations. They need to identify which devices have critical vulnerabilities, see the associated risk, and track remediation progress. The devices are already onboarded to Microsoft Defender for Endpoint. What should they use?

Microsoft Defender for Identity

Microsoft Defender for Cloud Apps

Microsoft Defender for Office 365

Microsoft Defender Vulnerability Management

Which statement best describes the primary purpose of Microsoft Defender XDR?

It is a suite of threat protection services that share signals across domains to help detect and respond to attacks.

It is a tool for configuring conditional access policies in Microsoft Entra ID.

It is a service that provides secure access to on-premises applications.

It is a single portal for managing all Microsoft 365 compliance settings.

A company has deployed Microsoft Defender for Identity and receives an alert about a suspicious Kerberos request. The analyst wants to determine if this is a real attack or a false positive. What should the analyst do first?

Ignore the alert because Defender for Identity is known to generate false positives

Disable the user account immediately

Review the alert details and related entity timeline in the Microsoft Defender portal

What is the primary purpose of the Microsoft Defender portal?

To manage user licenses and subscriptions

To configure email routing rules

To provide a unified view of security incidents and alerts across Microsoft Defender XDR services

To create and manage Azure virtual machines

A security analyst needs a single console to view and respond to threats across email, endpoints, and identities. They also want to see correlated incidents that span these domains. What should they use?

Microsoft Purview compliance portal

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 4

Describe Threat Protection with Microsoft Defender XDR SC-900 Practice Questions (Page 6)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

8concepts

35–40%of the exam

Questions 26–30

26application · medium
A company wants to prioritize security fixes on their Windows servers and workstations. They need to identify which devices have critical vulnerabilities, see the associated risk, and track remediation progress. The devices are already onboarded to Microsoft Defender for Endpoint. What should they use?
Select an answer first
27foundation · easy
Which statement best describes the primary purpose of Microsoft Defender XDR?
Select an answer first
28expert · hard
A company has deployed Microsoft Defender for Identity and receives an alert about a suspicious Kerberos request. The analyst wants to determine if this is a real attack or a false positive. What should the analyst do first?
Select an answer first
29foundation · easy
What is the primary purpose of the Microsoft Defender portal?
Select an answer first
30application · medium
A security analyst needs a single console to view and respond to threats across email, endpoints, and identities. They also want to see correlated incidents that span these domains. What should they use?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.