Describe the capabilities of Microsoft security solutions
Domain 3 of SC-900 accounts for 35-40% of the exam, the heaviest part of the syllabus. EarnYourCert has 131 original questions for this domain, all with explanations: 79 multiple choice, 17 yes/no and 35 completion or ordering items, like the real exam.
Domain 3 sample questions
8 questions from our 131-question bank for this domain. Try to answer before revealing the solution.
1. What does Azure Private Link allow you to do?
- Encrypt email in transit between Exchange Online and external mail servers
- Reach Azure PaaS services through a private endpoint in your VNet
- Create a public website for a PaaS app with a custom domain and TLS
- Replace Azure Firewall entirely
Show answer
Correct answer: B. A private endpoint assigns a private IP address from your VNet to the service.
2. What is a benefit of Azure Front Door with WAF for a global web application?
- Global load balancing with edge protection against web exploits
- It replaces Microsoft Entra ID for user sign-in to the web application
- It manages user licenses globally
- It stores the web app's secrets and certificates in a global vault
Show answer
Correct answer: A. Front Door is a global entry point; WAF filters malicious requests.
3. Which Defender for Cloud plan provides threat protection for virtual machines and servers, including endpoint detection and response integration?
- Defender for Servers
- Defender for Key Vault
- Defender for Storage
- Defender for DNS only
Show answer
Correct answer: A. Defender for Servers integrates Defender for Endpoint and vulnerability assessment.
4. In Microsoft Sentinel, what groups related alerts into a single actionable item that an analyst can investigate?
- An incident
- A workbook
- A watchlist
- A data connector
Show answer
Correct answer: A. Incidents aggregate alerts and entities so analysts can investigate and respond together.
5. Where can security teams use Microsoft Sentinel together with Defender XDR in a single unified security operations experience?
- The Microsoft 365 admin center
- The Microsoft Defender portal
- The Intune admin center
- The Service Trust Portal compliance reports page
Show answer
Correct answer: B. Sentinel is onboarded to the Defender portal so incidents, hunting and automation work across both.
6. Which Defender product is a cloud access security broker (CASB) that gives visibility and control over cloud apps and shadow IT?
- Microsoft Sentinel
- Microsoft Defender for Office 365
- Microsoft Defender for Cloud Apps
- Microsoft Defender for Endpoint
Show answer
Correct answer: C. Defender for Cloud Apps discovers apps in use, enforces policies and protects data in SaaS apps.
7. Which Defender for Office 365 capability lets security teams run realistic phishing campaigns to train users?
- Threat explorer only
- Attack simulation training
- Access reviews
- Retention labels
Show answer
Correct answer: B. Attack simulation training helps measure and improve user resilience to phishing.
8. An analyst wants context about an IP address seen in an alert, such as related threat actors and infrastructure. Which solution provides this?
- Microsoft Purview Activity explorer reports
- Azure DDoS Protection telemetry dashboards
- Microsoft Entra access reviews history
- Microsoft Defender Threat Intelligence
Show answer
Correct answer: D. Microsoft Defender Threat Intelligence gives analysts curated intelligence about indicators such as IPs and domains, including linked threat actors, infrastructure and articles.