Microsoft SC-730 시험

Question No : 1

Why is it essential for business professionals to maintain continuous awareness of evolving cyber threats through organizational training, even if they are not IT staff?

• A.So they can manually configure the corporate firewalls and manage network routing protocols.
• B.Because human resources tracks security training scores to determine annual employee bonuses.
• C.So they can independently write scripts to safely decrypt files after a ransomware infection.
• D.Because non-technical employees are frequent targets for social engineering and phishing attacks.

답을 확인하기

정답:
Explanation:
The SC-730 exam emphasizes that cybersecurity is everyone's responsibility. Threat actors frequently target business professionals (HR, Sales, Finance) because they have access to sensitive data and funds but may lack deep technical knowledge. Continuous awareness ensures employees can recognize modern psychological manipulation tactics and safely handle data.

Question No : 2

While reviewing financial spreadsheets, your screen suddenly flashes, and all your files change to .locked. A window appears demanding a cryptocurrency payment.
What is the critical first step you must take?

• A.Pay the requested ransom amount immediately using a corporate credit card to avoid losing the data.
• B.Disconnect the computer from the network (unplug Ethernet or disable Wi-Fi) to stop the spread.
• C.Restart the computer repeatedly to see if the operating system will automatically fix the locked files.
• D.Forward the locked files to the IT department so they can examine the extent of the network damage.

답을 확인하기

정답:
Explanation:
In the event of a ransomware attack, time is of the essence. Your very first action must be containment. Disconnecting the device from the network entirely prevents the malicious software from communicating with its command server and completely halts its ability to move laterally and infect shared drives or other computers.

Question No : 3

You notice a coworker quietly copying a massive folder of confidential, unreleased product designs onto a personal, unencrypted USB flash drive.
Which reporting channel is most appropriate for this policy violation?

• A.Post a public warning about unauthorized data transfers on the company's internal social network.
• B.Forward copies of the product designs to your personal email account to serve as hard evidence.
• C.Submit a confidential incident report through the organization's designated security or HR portal.
• D.Confront the coworker physically and demand they hand over the unencrypted USB flash drive.

답을 확인하기

정답:
Explanation:
Security policy violations or potential insider threats must be reported through appropriate, secure reporting channels (like a designated incident form, security email, or HR). Confronting the person directly or publicly posting about it can escalate the situation unprofessionally, destroy forensic evidence, or tip off a malicious actor to hide their tracks.

Question No : 4

Under which of the following circumstances is formal "escalation" to senior management or the legal department strictly required during a security event?

• A.Your corporate account is temporarily locked because you typed the incorrect password three times.
• B.A shared office printer experiences a critical hardware failure and stops printing documents.
• C.You discover that a database containing thousands of customer credit card numbers was exposed online.
• D.Your computer requires a mandatory restart to finish installing standard operating system updates.

답을 확인하기

정답:
Explanation:
Most minor issues (like locked accounts or printer jams) can be handled by the standard IT helpdesk. However, incidents involving significant exposure of highly regulated data (such as PII or PCI financial data) carry severe legal and regulatory consequences. These must be immediately escalated to specialized incident response teams, legal counsel, and senior management.

Question No : 5

You realize that a SharePoint folder containing highly sensitive employee medical records has been accidentally configured with an "Anyone with the link can view" permission.
What is the most immediate action you must take?

• A.Revoke the public sharing link immediately to halt access and notify the security team.
• B.Change the file names so unauthorized external users cannot easily guess the contents.
• C.Download all the files to your local hard drive and delete them from the cloud storage.
• D.Wait 24 hours to review the access logs before deciding whether to report the incident.

답을 확인하기

정답:
Explanation:
During a potential data breach, containment is your absolute first priority. By immediately revoking the sharing link (stopping the sharing of data), you halt any further unauthorized access. You must then notify the security team so they can check the audit logs to determine if anyone actually accessed the files while the link was active.

Question No : 6

Why is it highly encouraged to report a "near miss" security event, such as spotting a sophisticated phishing email even if you successfully avoided clicking the malicious link?

• A.The human resources department tracks near misses to evaluate employees for their annual promotions.
• B.It provides valuable threat intelligence, allowing the security team to block the sender and protect other employees.
• C.Failing to report a near miss is strictly classified as a severe international cybercrime by law enforcement.
• D.Because the IT department issues mandatory monetary bonuses to employees for every suspicious email reported.

답을 확인하기

정답:
Explanation:
A near miss provides valuable threat intelligence. If you received a targeted phishing email, it is highly likely that other colleagues received it as well. Reporting it allows the IT team to proactively block the malicious domain and remove the email from your colleagues' inboxes before someone else makes a mistake.

Question No : 7

You witness a stranger without an employee ID badge closely follow an authorized employee through a secure, keycard-access door.
What is the appropriate action?

• A.Hold the door open wider for them to be polite and welcoming to potential new corporate visitors.
• B.Ignore the situation completely, as physical building security is not the responsibility of a business professional.
• C.Immediately report the unauthorized physical entry attempt to the building's security team or reception desk.
• D.Follow the stranger quietly from a distance to observe exactly which department they decide to visit.

답을 확인하기

정답:
Explanation:
This physical social engineering attack is known as "tailgating" or "piggybacking." As a business professional, you share the responsibility for physical security. You must immediately report the breach to security personnel so they can intercept the unauthorized individual.

Question No : 8

Which of the following situations describes an "unauthorized access" incident that you are strictly obligated to report?

• A.You open a publicly available company press release on the internet using your corporate laptop.
• B.A coworker from the sales department asks to borrow your password to access a restricted financial database.
• C.The IT department temporarily disables your account during a scheduled weekend server maintenance window.
• D.You log into the internal corporate HR portal using your own credentials to view your personal pay stub.

답을 확인하기

정답:
Explanation:
Sharing credentials violates fundamental access control and accountability policies. Even if the person asking is a colleague, they are attempting to bypass security controls to access a system they do not have explicit authorization for. This constitutes a severe insider risk that must be reported.

Question No : 9

Under which of the following circumstances is formal "escalation" to senior management, the legal department, or a specialized incident response team strictly required?

• A.You accidentally forget your computer login password after returning from a two-week vacation.
• B.A shared network printer in the marketing department completely runs out of black toner.
• C.Your computer requires a standard, scheduled software update reboot that takes five minutes.
• D.You discover an unencrypted database containing thousands of customer credit card numbers was leaked online.

답을 확인하기

정답:
Explanation:
Escalation is required when an incident has a severe impact, involves significant data exposure (such as PII or PCI financial data), or triggers legal and compliance obligations. The public exposure of customer credit card numbers requires immediate executive and legal involvement.

Question No : 10

You accidentally click a suspicious link in an email, and a strange command window suddenly opens while unknown files begin downloading.
What is the very first step you should take?

• A.Restart your computer, empty the recycling bin, and pretend nothing happened to avoid trouble.
• B.Disconnect your computer from the network immediately to stop the spread, then notify I
• C.Download a free antivirus removal tool from the internet and attempt to clean it yourself.
• D.Forward the email to your direct manager to see if their computer experiences the same issue.

답을 확인하기

정답:
Explanation:
In the event of an active malware or ransomware infection, the absolute primary goal is containment. Disconnecting the device from the network (unplugging the Ethernet cable or disabling Wi-Fi) prevents the malware from communicating with the attacker or spreading laterally to other systems.

Question No : 11

When submitting an incident report to the IT helpdesk about a suspicious email, which specific combination of information is the most critical for their investigation?

• A.Your personal opinion on the effectiveness of the company's annual cybersecurity training.
• B.The exact time the email was received, the sender's address, and whether you clicked any links.
• C.The brand, exact model number, and screen resolution of the computer monitor you are using.
• D.Your employee identification number, home mailing address, and the date you were hired.

답을 확인하기

정답:
Explanation:
An effective incident report needs actionable facts. The security team needs to know the exact timeframe and sender to trace server logs, and most importantly, whether you clicked a link ("blast radius") to determine if your machine needs to be immediately isolated.

Question No : 12

You receive an email that looks like a targeted phishing attempt. You have NOT clicked on any links or attachments.
What is the safest and most appropriate way to report this?

• A.Forward the email to your personal email account to inspect the link safely on your phone.
• B.Use the corporate email system's built-in "Report Phishing" button or security inbox.
• C.Reply directly to the malicious sender and aggressively tell them to stop emailing you.
• D.Take a screenshot of the email and post it in a public company chat room to warn others.

답을 확인하기

정답:
Explanation:
Using the built-in "Report Phishing" button or a dedicated security inbox securely packages the email's hidden headers and metadata. This allows the security operations team to analyze the threat safely and proactively block the sender's domain across the entire organization.

Question No : 13

While traveling home on the subway, you realize your corporate laptop, which has access to the internal network, is missing.
What is your immediate responsibility?

• A.Post a public message on social media offering a cash reward for the laptop's return.
• B.Wait 24 hours to see if someone contacts you or hands it in to the local lost and found.
• C.Purchase a replacement device yourself and do not inform your manager to avoid trouble.
• D.Report the loss to the IT department immediately so they can issue a remote wipe command.

답을 확인하기

정답:
Explanation:
A lost corporate device is a significant security incident that requires immediate reporting. Promptly notifying the IT department allows them to track the device, revoke its access tokens, and issue a "remote wipe" command to permanently destroy the corporate data before an attacker can extract it.

Question No : 14

You need to send a highly sensitive merger document to a specific external partner, but you want to ensure they cannot print, copy, or forward the document to anyone else.
What security feature should you apply?

• A.Add a large red "Confidential" watermark diagonally across every page of the document.
• B.Convert the document to a standard PDF format before attaching it to the email.
• C.Apply a sensitivity label integrated with Information Rights Management (IRM) controls.
• D.Send a standard password to the partner in a separate, follow-up text message.

답을 확인하기

정답:
Explanation:
Information Rights Management (IRM) enforces access policies at the file level. Combined with sensitivity labels, it allows the creator to restrict specific actions such as printing, copying text, or forwarding the document, even after the file has left the organization's network perimeter.

Question No : 15

You are drafting an internal email about the upcoming corporate holiday party schedule. There are no trade secrets or customer data involved.
Which document sensitivity label is most appropriate?

• A.Highly Confidential
• B.General / Internal
• C.Top Secret
• D.Public

답을 확인하기

정답:
Explanation:
Sensitivity labels help apply the correct level of protection based on data classification. A routine holiday party schedule is not highly confidential, but it shouldn't be posted on the public internet either. "Internal" or "General" is the correct classification for standard everyday corporate communications.