SkillTestPro | SC-900 Practice Test 22 Hard Questions

SC-900 Exam Practice Test 22 (Hard) - Microsoft Defender for Endpoint Deep-Dive

SC-900 Exam Practice Tests

1 / 15

Which Microsoft Defender for Endpoint capability continuously monitors endpoint behavior, detecting and alerting on suspicious activity such as an unusual process execution chain?

Threat and vulnerability management alone

Attack surface reduction alone

Endpoint detection and response (EDR)

Automated investigation and remediation alone

Microsoft Defender Antivirus alone, which focuses on known malware signatures rather than broader behavioral detection

Cloud Discovery alone

2 / 15

Which Microsoft Defender for Endpoint component provides built-in, real-time protection against known malware based on signatures and heuristics?

Endpoint detection and response alone

Threat and vulnerability management alone

Microsoft Defender Antivirus

Attack surface reduction alone

Automated investigation and remediation alone

Cloud Discovery alone

3 / 15

Which Microsoft Defender for Endpoint feature allows a security analyst to isolate a compromised device from the network to prevent further spread of an attack, while retaining remote investigation capability?

Threat and vulnerability management alone

Attack surface reduction alone, which prevents certain behaviors rather than isolating an already-compromised device

Device isolation

Cloud Discovery alone

Safe Links alone

Safe Attachments alone

4 / 15

Which Microsoft Defender for Endpoint feature provides a chronological view of observed behaviors and events on a specific device, aiding forensic investigation?

Threat and vulnerability management alone

Attack surface reduction rules alone

The device timeline

Automated investigation and remediation alone

Cloud Discovery alone

Safe Attachments alone

5 / 15

Which Microsoft Defender for Endpoint capability assigns a numerical score to a discovered vulnerability, helping security teams prioritize which vulnerabilities to remediate first?

Attack surface reduction rules alone, which reduce exposure rather than score existing vulnerabilities

Device isolation alone

Vulnerability severity/risk scoring within Threat and Vulnerability Management

Automated investigation and remediation alone

Cloud Discovery alone

Safe Links alone

6 / 15

Which Microsoft Defender for Endpoint feature allows security teams to view software inventory across all managed devices, identifying outdated or vulnerable software versions?

Attack surface reduction rules alone

Device isolation alone

Software inventory (within Threat and Vulnerability Management)

Automated investigation and remediation alone

Cloud Discovery alone

Safe Attachments alone

7 / 15

Which attack surface reduction rule category specifically targets blocking behaviors commonly associated with Office application exploitation, such as creating child processes?

Network protection rules, which focus on blocking malicious network connections rather than Office-specific behaviors

Device control rules, which focus on removable media rather than Office-specific behaviors

Office-related attack surface reduction rules

Controlled folder access, which protects specific folders from unauthorized changes rather than targeting Office exploitation behaviors specifically

Web protection rules, which focus on browser-based threats rather than Office-specific behaviors

Application control rules, which focus on allow-listing applications rather than specific Office exploitation behaviors

8 / 15

Which Microsoft Defender for Endpoint feature protects specific, designated folders from unauthorized changes, such as those attempted by ransomware attempting to encrypt files?

Network protection, which focuses on blocking malicious network connections rather than folder-level file protection

Device control, which focuses on removable media rather than folder-level file protection

Controlled folder access

Application control, which focuses on allow-listing applications rather than folder-level file protection

Web protection, which focuses on browser-based threats rather than folder-level file protection

Exploit protection, which focuses on mitigating exploitation techniques rather than folder-level file protection specifically

9 / 15

Which Microsoft Defender for Endpoint feature blocks access to known malicious websites and phishing sites at the network level, regardless of which browser is being used?

Controlled folder access, which protects specific folders rather than blocking malicious web destinations

Device control, which focuses on removable media rather than web-based threats

Network protection

Application control, which focuses on allow-listing applications rather than blocking malicious web destinations

Attack surface reduction rules alone, without specific reference to network-level web protection

Automated investigation and remediation alone

10 / 15

Which Microsoft Defender for Endpoint feature allows an organization to restrict or block the use of USB drives and other removable storage media on managed devices?

Network protection, which focuses on web-based threats rather than removable media

Controlled folder access, which focuses on folder-level file protection rather than removable media

Device control

Application control, which focuses on allow-listing applications rather than removable media

Attack surface reduction rules alone, without specific reference to removable media control

Automated investigation and remediation alone

11 / 15

Which Microsoft Defender for Endpoint automated investigation outcome level requires manual analyst approval before a suggested remediation action is actually applied?

Full automation, which applies remediation actions without requiring manual approval

No automation at all, requiring entirely manual investigation with no automated suggestions whatsoever

Semi-automatic remediation (approval required)

A setting that only applies to low-severity alerts and never to high-severity incidents

A setting that automatically deletes the device from management with no other remediation option

A setting that disables all future alerts for that device permanently

12 / 15

Which Microsoft Defender for Endpoint feature evaluates a device's exposure level based on unpatched vulnerabilities, misconfigurations, and other risk factors, contributing to an overall organizational exposure score?

Device isolation alone

The device timeline alone

Exposure score (within Threat and Vulnerability Management)

Attack surface reduction rules alone

Automated investigation and remediation alone

Network protection alone

13 / 15

Which Microsoft Defender for Endpoint feature provides recommended security configuration baselines and tracks an organization's adherence to those baselines across managed devices?

Device isolation alone

The device timeline alone

Security recommendations (within Threat and Vulnerability Management)

Automated investigation and remediation alone

Network protection alone

Controlled folder access alone

14 / 15

Which term describes a simulated, controlled attack scenario that an organization can run within Microsoft Defender for Endpoint to validate detection and response capabilities without causing actual harm?

A live, uncontrolled production incident with no simulation involved

A device isolation action alone, unrelated to a controlled testing exercise

An attack simulation (tutorial/simulation exercise)

A software inventory report alone

An exposure score value alone

A network protection block event alone

15 / 15

Which Microsoft Defender for Endpoint capability provides threat intelligence context about a detected file or IP address, such as whether it is associated with a known threat actor group?

Device isolation alone

Attack surface reduction rules alone

Threat intelligence integration

Controlled folder access alone

Device control alone

Network protection alone, without the added context of specific threat actor attribution

Your score is

The average score is 0%