Microsoft SC-900 Deutsch Value Pack (Frequently Bought Together)

Correct Answer:

Explanation:

Microsoft describes Identity Protection as a capability that "detects risky users and risky sign-ins using real- time and offline detections and allows you to configure automated responses." Microsoft is explicit that detections aren't limited to after authentication; rather, signals are evaluated during sign-in and also by offline analytics, where "some detections are offline and can take up to 48 hours to appear." Therefore, saying it only
"generates risk detections once a user is authenticated" is incorrect.
For risk scoring, Microsoft states that Identity Protection "assigns a risk level to each detection," and that
"risk levels are Low, Medium, or High," which are then used by user-risk and sign-in-risk policies to drive remediation (for example, requiring password change or MFA).
Microsoft also defines the two core risk concepts: "User risk represents the probability that a given identity or account is compromised," while "Sign-in risk represents the probability that a given authentication request isn' t authorized by the identity owner." These definitions underpin Conditional Access and Identity Protection policies that can require additional verification or block access based on the assessed risk.
Taken together, the documentation confirms: detections are not restricted to post-authentication (No), detections carry Low/Medium/High levels (Yes), and user risk is the probability the identity is compromised (Yes).

Correct Answer: B  🗳️

Correct Answer:

Explanation:

Multi-factor authentication is a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerprint scan.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

Correct Answer:

Explanation:

Microsoft 365 Insider Risk Management follows a clear operational flow: Triage # Investigate # Action.
Microsoft's guidance explains that the Alerts dashboard is used first to review and filter alerts, prioritize by severity, and decide what needs deeper review-this is the Triage stage. The documentation describes triage activities as reviewing alert details, applying filters, and determining whether an alert should be escalated for investigation.
When an alert warrants deeper inquiry, analysts move to Investigate, where they create cases, add relevant alerts and users, and examine activity timelines and related signals. Microsoft states that cases are the vehicle for structured investigations, allowing analysts to group evidence and manage workflow from the Case dashboard.
After investigation, organizations proceed to Action, where insider risk controls allow response steps such as sending user policy reminders, escalating to HR or legal, or taking other governance actions. Microsoft describes that actions can include notifying the user with a policy reminder to reduce future risk or applying stronger controls, all of which are part of the response phase.
Accordingly, the correct matches are: Triage # Review and filter alerts, Investigate # Create cases in the Case dashboard, and Action # Send a reminder of corporate policies to users.

Correct Answer:

Explanation:

In Microsoft's Security, Compliance, and Identity learning content for Microsoft Defender for Cloud, the service is described as providing ongoing posture management and threat protection. The official description states that Defender for Cloud "continuously assesses your resources to identify security misconfigurations and weaknesses" and "continuously discovers and evaluates resources" across your subscriptions. The recommendations and secure-score updates are produced as the platform "continuously analyzes your environment using security policies and analytics," surfacing issues the moment they're detected and mapping them to remediation guidance. This continuous assessment model underpins Defender for Cloud's cloud security posture management (CSPM) capability and ensures that newly created or modified resources are evaluated without waiting for a scheduled job. By design, there is no fixed interval (such as hourly, every 15 minutes, or daily) required to trigger assessments-policy-driven evaluation and data collection run as changes occur and signals are received. Therefore, the sentence "Microsoft Defender for Cloud assesses Azure resources ____ for security issues" is correctly completed with continuously, reflecting Microsoft's emphasis on persistent, real-time security posture evaluation rather than periodic scans.