Microsoft Security Compliance and Identity Fundamentals (SC-900)

Statement 1: Microsoft Intune can be used to manage Android devices.

✔️ Yes

Reasoning: Microsoft Intune is a cross-platform Mobile Device Management (MDM) and Mobile Application Management (MAM) service. It natively supports Android device management, offering various enrollment options such as Android Enterprise work profiles for personal devices and fully managed modes for corporate-owned devices.

Statement 2: Microsoft Intune can be used to provision Azure subscriptions.

❌ No

Reasoning: Microsoft Intune's scope is limited to endpoint management (devices, users, and apps). Provisioning and managing Azure subscriptions are administrative tasks handled through dedicated Azure management tools like the Azure portal, Azure PowerShell, or the Azure CLI, not through Intune.

Statement 3: Microsoft Intune can be used to manage organization-owned devices and personal devices.

✔️ Yes

Reasoning: Intune is designed to manage diverse device ownership models. It supports both organization-owned devices through robust enrollment and control policies (like Windows Autopilot) and personal devices in Bring-Your-Own-Device (BYOD) scenarios using features like app protection policies to secure corporate data.

✅ You can create one Azure Bastion per virtual network: Yes

Azure Bastion is deployed into a dedicated subnet (AzureBastionSubnet) within a virtual network. The service architecture enforces a limit of one Bastion host per VNet. This single host acts as a centralized secure gateway for all VMs in that VNet and any peered VNets.

While the user's browser connection to the Bastion service is over HTTPS/TLS, Bastion itself connects to the target Windows VM using the native RDP protocol. It functions as a secure RDP gateway, proxying the session to the browser without exposing RDP ports to the public internet.

This describes Bastion's primary use case. It enables seamless RDP/SSH connections to VMs directly from the Azure portal in a web browser. This method eliminates the need for public IPs on VMs and local RDP/SSH clients on the user's machine.

✅ Option D (Correct)
Reasoning: Network protection in Microsoft Defender for Endpoint is a key component of Attack Surface Reduction (ASR) rules. ASR rules are designed to prevent actions and behaviors that malware often uses to compromise devices or networks, thereby significantly reducing the attack surface. Network protection specifically helps protect devices from web-based threats by blocking access to malicious domains, IP addresses, and URLs, acting as a crucial first line of defense.

❌ Why the other choices are incorrect:

• Option A is incorrect: Automated remediation focuses on taking action to remove or mitigate detected threats post-detection, rather than preventing the initial attack surface exposure.
• Option B is incorrect: Automated investigation is part of the detection and response phase, automatically investigating alerts to resolve threats, not primarily reducing the attack surface.
• Option C is incorrect: Advanced hunting is a proactive threat hunting tool for security analysts to search for threats and suspicious activities using Kusto Query Language (KQL). It's a post-detection/prevention activity, not a feature for attack surface reduction.

✅ playbooks.

Reasoning: In Microsoft Sentinel, playbooks are the primary mechanism for automation and orchestration. Based on Azure Logic Apps, playbooks are collections of procedures that run in response to alerts or incidents. This enables Security Orchestration, Automation, and Response (SOAR) capabilities, automating common tasks like blocking an IP address or creating a service ticket.

Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It is deployed within a virtual network or a hub virtual network and provides stateful inspection of network traffic.

• ✅ Azure virtual machines (A) can be protected by Azure Firewall because VMs reside within Azure virtual networks. The firewall can filter inbound and outbound traffic to and from these VMs, enforcing network security policies.
• ✅ Azure virtual networks (D) themselves are protected by Azure Firewall. The firewall is typically deployed to secure traffic flowing into, out of, and between virtual networks, thereby safeguarding all resources within them.

✅ Option C (Correct)

Reasoning: Defense in depth is a security strategy that employs multiple layers of security controls throughout an IT infrastructure. The goal is to provide redundancy and ensure that if one layer of defense is breached, subsequent layers can still protect the system or data. This directly aligns with the question's description of placing multiple layers of defense throughout a network infrastructure.

❌ Why the other choices are incorrect:

• Option A is incorrect: Threat modeling is a process used to identify potential threats and vulnerabilities in a system or application, not a methodology for implementing layered defenses.
• Option B is incorrect: "Identity as the security perimeter" is a core tenet of the Zero Trust security model, where identity is the primary control plane. While a crucial aspect of modern security, it doesn't encompass the broader concept of multiple, diverse defense layers across an entire infrastructure as described.
• Option D is incorrect: The shared responsibility model defines the security obligations between a cloud service provider and its customer. It clarifies who is responsible for what aspects of security, rather than describing a specific strategy for layered security within an organization's network.

✅ Microsoft Defender for Endpoint can protect Android devices. [Yes]

Reasoning: Microsoft Defender for Endpoint is a cross-platform solution that provides threat and vulnerability management, attack surface reduction, and endpoint detection and response (EDR) for various operating systems, including Android, Windows, macOS, Linux, and iOS.

Reasoning: An Azure VM running a client OS like Windows 10 is treated as an endpoint. It can be onboarded and managed by Microsoft Defender for Endpoint, receiving the same comprehensive security protections as a physical device against advanced threats.

Reasoning: Microsoft Defender for Endpoint is designed to secure endpoints (devices), not SaaS applications like SharePoint Online. Content scanning and protection for SharePoint are features of Microsoft Defender for Office 365, a separate product for collaboration tools.

✅ Option A (Correct)
Reasoning: Microsoft Defender for Office 365 provides advanced protection against phishing, spam, and malware, specifically through features like Safe Attachments. Safe Attachments scans email attachments in a virtual sandbox environment before they reach the user's inbox, ensuring only clean attachments are delivered. This directly addresses the requirement to scan email attachments for malware and only forward them if they are clean.

❌ Why the other choices are incorrect:

• Option B is incorrect: Microsoft Defender Antivirus is an endpoint protection solution for devices, providing real-time protection against malware on the local machine. It does not primarily scan email attachments at the email gateway level before delivery to a mailbox.
• Option C is incorrect: Microsoft Defender for Identity is a cloud-based security solution that leverages Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions. It is not designed for scanning email attachments.
• Option D is incorrect: Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help organizations prevent, detect, investigate, and respond to advanced threats on endpoints (devices). It does not perform email attachment scanning at the mail flow level.

✅ Option C (Correct)
Reasoning: Microsoft Sentinel functions as a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution. Its XDR (Extended Detection and Response) capability is significantly enhanced through deep integration with Microsoft 365 Defender. Microsoft 365 Defender is Microsoft's unified XDR solution that encompasses Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps. By integrating with Microsoft 365 Defender, Sentinel ingests high-fidelity alerts, incidents, and raw data across these domains, enabling comprehensive threat detection, investigation, and automated response capabilities that span an organization's entire digital estate.

❌ Why the other choices are incorrect:

• Option A is incorrect: Integration with the Microsoft 365 compliance center is primarily for governance, risk, and compliance management, not for providing XDR capabilities for active threat detection and response.
• Option B is incorrect: Support for threat hunting is a core capability of a SIEM/XDR platform like Sentinel, but it is not the feature that provides the XDR capability itself. XDR integrations enable more effective threat hunting.
• Option D is incorrect: Azure Monitor Workbooks are used for creating interactive reports and dashboards, aiding in data visualization and analysis within Azure Monitor and Sentinel. They do not constitute an XDR capability; rather, they are a tool for presenting the insights derived from XDR data.

✅ Option C (Correct)
Reasoning: Azure Defender, now part of Microsoft Defender for Cloud, provides advanced threat protection for Azure SQL Managed Instance. Specifically, 'Microsoft Defender for SQL' detects and alerts on unusual and potentially harmful attempts to access or exploit SQL databases and Managed Instances, including SQL injection attacks, brute-force attacks, and anomalous database activities.

❌ Why the other choices are incorrect:

• Option A is incorrect: Microsoft Secure Score is a measurement of an organization's security posture, providing recommendations to improve security, rather than directly offering threat detection for specific resources like SQL Managed Instance.
• Option B is incorrect: Application security groups (ASGs) are used to group virtual machines and define network security policies based on these groups, primarily for network segmentation and access control, not threat detection.
• Option D is incorrect: Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over SSL. Its purpose is secure access, not threat detection for databases.