SC-900 Practice Test 24 Hard Questions

Correct Answer: The Defender for Identity sensor Explanation: The Defender for Identity sensor is installed directly on domain controllers (or AD FS servers) to monitor Active Directory network traffic and event logs for signs of compromise, without requiring a dedicated hardware appliance.

Correct Answer: Pass-the-hash attack detection Explanation: Pass-the-hash attack detection identifies an attacker attempting to use a stolen password hash to authenticate to a resource without knowing the actual plaintext password, a technique used to move laterally within a compromised network.

Correct Answer: Lateral movement paths Explanation: Lateral movement paths visually map out potential paths an attacker could take to reach a highly sensitive account, such as a Domain Admin, from a compromised low-privilege account, helping security teams proactively harden those paths.

Correct Answer: Reconnaissance detection Explanation: Reconnaissance detection identifies early-stage attacker activity, such as scanning the network or enumerating user accounts, that typically occurs before an attacker attempts an actual compromise or lateral movement within the environment.

Correct Answer: Domain dominance detection Explanation: Domain dominance detection identifies techniques an attacker uses to maintain persistent, high-level control over a compromised domain, such as forging Kerberos tickets (a 'golden ticket' attack) or manipulating AD FS trust configurations.

Correct Answer: App connectors (API-based protection) Explanation: App connectors provide API-based protection by connecting directly to a sanctioned cloud app's API, enabling deep visibility and control, such as retroactively scanning files already stored in that app for sensitive content or malware.

Correct Answer: Conditional Access App Control Explanation: Conditional Access App Control, integrated with Microsoft Entra Conditional Access, provides real-time session control and monitoring for cloud app usage, such as blocking a file download from an unmanaged device, using a reverse-proxy architecture rather than a native API connector.

Correct Answer: Cloud Discovery Explanation: Cloud Discovery analyzes firewall and proxy log data to identify all the cloud applications actually being used within an organization, including unsanctioned shadow IT applications that might otherwise go unnoticed by IT.

Correct Answer: The Cloud app risk score / Cloud app catalog Explanation: The Cloud app risk score, part of the Cloud app catalog within Microsoft Defender for Cloud Apps, assigns a risk score to discovered cloud applications based on factors such as security certifications and data handling practices, helping an organization prioritize which apps to sanction, monitor, or block.

Correct Answer: An anomaly detection policy Explanation: An anomaly detection policy would automatically alert an administrator if a user downloads an unusually large volume of files from a sanctioned cloud storage app within a short period, a pattern that could indicate a compromised account or an insider risk scenario.

Correct Answer: OAuth app governance Explanation: OAuth app governance evaluates third-party OAuth applications that users have granted permissions to access organizational data (such as a third-party app requesting access to a user's mailbox), flagging those with excessive or risky permission scopes for administrator review.

Correct Answer: A golden ticket attack Explanation: A golden ticket attack involves an attacker forging a Kerberos ticket-granting ticket, granting them unrestricted, persistent access to an Active Directory domain, a particularly severe technique specifically detected by Microsoft Defender for Identity's domain dominance detection capabilities.

Correct Answer: User and entity behavior analytics (UEBA) Explanation: User and entity behavior analytics (UEBA) establishes a normal behavioral baseline for a specific user or entity, enabling Microsoft Defender for Cloud Apps to later detect meaningful deviations from that baseline that could indicate a compromised account or insider risk.

Correct Answer: Abnormal behavior/anomaly detection for accounts based on established baselines Explanation: Abnormal behavior and anomaly detection for accounts, based on established baselines of typical activity, would flag a service account that normally only logs in from a single specific server suddenly authenticating interactively from an unusual workstation, a strong indicator of potential compromise or misuse.

Correct Answer: A cloud access security broker (CASB) Explanation: A cloud access security broker (CASB), the overall category of solution that products like Microsoft Defender for Cloud Apps belong to, provides visibility, data security, compliance, and threat protection specifically for an organization's use of cloud applications, sitting as a control point between users and cloud services.