Describe Threat Protection with Microsoft Defender XDR SC-900 Practice Questions (Page 7)

Questions 31–33

1. 31application · medium

   A security operations center (SOC) analyst receives an alert about a phishing email that led to a malware infection on a user's device. The analyst wants to see the full attack chain, including the email, the device, and the user account, in one place. What should they use?

   • AThe user risk report in Microsoft Entra ID
   • BThe alert queue in Microsoft Defender for Office 365
   • CThe device inventory in Microsoft Defender for Endpoint
   • DThe incident view in the Microsoft Defender portal
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A company uses Microsoft Defender for Cloud Apps to monitor cloud app usage. They want to block downloads of sensitive files from a sanctioned cloud app when a user's sign-in risk is medium or high. However, they also want to allow the user to continue using the app for non-sensitive operations. What should they configure?

   • AA conditional access app control policy that blocks download actions based on risk
   • BAn app discovery policy that identifies risky users
   • CA session policy that blocks all access to the app for risky users
   • DA file policy that quarantines all files downloaded by risky users
   Reveal Solution Discussion Select an answer first
3. 33expert · hard

   A company uses Microsoft Defender Vulnerability Management and wants to prioritize remediation efforts. They have a limited security team and need to focus on the most critical vulnerabilities that are actively exploited. What should they use to prioritize?

   • AThe age of the vulnerability
   • BThe number of affected devices only
   • CThe threat insights and exploit maturity level in Defender Vulnerability Management
   • DThe severity score from the vendor
   Reveal Solution Discussion Select an answer first