Microsoft Security, Compliance, and Identity Fundamentals (SC-900 Deutsch Version) : SC-900 Deutsch

Correct Answer:

Explanation:

Microsoft's Identity Protection provides risk-based detections and automated policies-not group management. Microsoft Learn explains that Identity Protection "uses detections to identify potential vulnerabilities affecting your organization's identities" and exposes user risk and sign-in risk for policy decisions. It does not support adding users to groups by "risk level"; group membership is handled by static or dynamic rules based on directory attributes, while risk is a transient signal surfaced to policies.
Identity Protection includes specific detections such as "Leaked credentials", where Microsoft's threat intelligence finds credentials "on the dark web or other dumps," and flags the affected account as risky. This directly confirms the ability to detect whether credentials have been exposed publicly.
For enforcement, Identity Protection policies and Conditional Access can require stronger authentication when risk is present. The documentation states that you can configure policies to "require multi-factor authentication for sign-ins assessed as risky" and use Conditional Access conditions like User risk or Sign-in risk with the grant control Require multi-factor authentication. Thus, Identity Protection signals can invoke MFA based on risk, but they do not place users into groups.

Correct Answer:

Explanation:
access and application control
In Microsoft Defender for Cloud, the capabilities grouped as access and application control are designed to harden Azure virtual machines by limiting both what can access a VM and what can run on it. Microsoft's documentation explains that Adaptive application controls "help you control which applications can run on your VMs by allowing only known-safe applications," which directly helps block malware and other unwanted applications. In the same family, Just-in-time (JIT) VM access "reduces exposure to attacks by locking down inbound traffic to your VMs and opening only the required ports, for approved users, for a limited time," thereby reducing the network attack surface. These capabilities are surfaced in Defender for Cloud recommendations and policies to enforce least privilege at the network edge and on the endpoint execution layer.
By contrast, Cloud Security Posture Management (CSPM) provides continuous assessment and secure-score- driven recommendations but isn't the control that actively blocks applications or time-bounds inbound access.
Container security targets container images and runtimes, and vulnerability assessment identifies software vulnerabilities but doesn't enforce allow-listing or time-bound access. Therefore, the correct completion is access and application control, which encompasses Adaptive application controls and JIT VM access to protect VMs from unwanted apps and minimize exposed network surface.

Correct Answer: A,B  🗳️

Explanation: Only visible for VCETorrent members. You can sign-up / login (it's free).

Correct Answer: D  🗳️

Correct Answer:

Explanation:

In Azure networking, each Network Security Group (NSG) is created with a built-in set of default security rules. Microsoft's documentation for NSGs explains: "Azure creates several default security rules within each network security group. You can't remove the default security rules, but you can override them by creating rules with a higher priority." The rule processing model is priority-based: "Security rules are processed in priority order, with lower numbers processed before higher numbers. Once a rule matches traffic, processing stops." Because the defaults have relatively low precedence (high priority numbers), an administrator can create an explicit allow or deny rule with a lower priority number to supersede the default behavior.
This is why the correct completion is override rather than copy or delete. You cannot delete the default rules; they remain present to provide baseline behavior (such as denying inbound traffic from the internet by default and allowing virtual network traffic). Instead, you override the defaults by adding your own NSG rules- using lower priority numbers-to achieve the desired access control outcome while preserving Azure's baseline protections and evaluation logic.