SC-100 Practice Test 10 — 10 Questions

Question 1

A company uses Microsoft Entra ID and wants to enable passwordless authentication for all users to reduce phishing risks. Users are already using Microsoft Authenticator for MFA. Which passwordless method should you prioritize?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Authenticator passwordless sign-in. The organization already uses Microsoft Authenticator for MFA, making the transition to passwordless sign-in via Authenticator the most seamless and cost-effective path. This method leverages the existing app registration and push notification infrastructure, allowing users to authenticate with a biometric or PIN gesture without deploying additional hardware or certificates.

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Answer

Certificate-based authentication

Question 2

Your company uses Microsoft Sentinel for security information and event management (SIEM). You need to design a solution that reduces alert fatigue by correlating low-fidelity alerts from multiple sources into a single high-fidelity incident. Which Microsoft Sentinel feature should you use?

Accepted Answer

Analytics rules with alert grouping enabled. Analytics rules with alert grouping enabled allow you to configure a rule that correlates multiple low-fidelity alerts (e.g., from different data sources or detection types) into a single high-fidelity incident. When alert grouping is enabled, the rule groups alerts that occur within a specified time window and share common entities (such as IP addresses or user accounts), reducing alert fatigue by presenting one consolidated incident instead of many individual alerts.

Answer

Workbooks

Answer

Playbooks

Answer

Hunting queries

Question 3

An organization uses Microsoft Purview Information Protection. They want to automatically apply a sensitivity label to documents containing credit card numbers. Which policy should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview Information Protection automatically apply sensitivity labels to documents and emails that match specified conditions, such as the presence of credit card numbers. This policy uses sensitive information types (e.g., Credit Card Number) to scan content and apply the label without user intervention, meeting the requirement for automatic labeling.

Answer

Retention policy

Answer

Sensitivity label policy

Answer

Data loss prevention policy

Question 4

The exhibit shows a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Identify the most frequent high-severity alerts over the past week. The query uses `summarize` with `count()` and `top 5 by count_ desc` to rank alert names by frequency, filtered to `AlertSeverity == 'High'` and `TimeGenerated > ago(7d)`. This directly identifies the most common high-severity alerts over the past week, making option C correct.

Answer

Find alerts that were not investigated

Answer

Analyze entities associated with alerts

Answer

Correlate alerts by time and alert name

Question 5

A company uses Microsoft Purview to classify and label sensitive data. They want to automatically apply a sensitivity label to documents containing a specific custom sensitive information type. Which TWO components are required for this?

Accepted Answer

Custom sensitive information type. Option C (Custom sensitive information type) is required because the scenario specifically calls for detecting a custom-defined pattern of sensitive data, and a custom SIT (defined via regex, function, or keyword list) is what identifies that unique content. Option D (Auto-labeling policy) is required because it is the client-side or service-side policy that automatically applies a sensitivity label to items matching a condition, and that condition can reference the custom SIT. Together, the custom SIT supplies the detection logic and the auto-labeling policy supplies the automatic label application. Option A (DLP policy) is incorrect because DLP enforces protective actions like blocking or warning on data in motion or use, not the automatic application of sensitivity labels. Option B (Retention label) is incorrect because retention labels govern how long content is kept or deleted, not classification or labeling for sensitivity. Option E (Trainable classifier) is incorrect because trainable classifiers are used for content that is hard to define by pattern (e.g., resumes, contracts), whereas this scenario calls for a specific custom SIT.

Answer

Data loss prevention (DLP) policy

Answer

Retention label

Answer

Trainable classifier

Question 6

Which THREE Microsoft security solutions can be used to detect and respond to threats across hybrid cloud environments? (Choose three.)

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (A) is correct because it provides Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) capabilities that continuously assess and protect Azure, AWS, GCP, and on-premises resources, generating security alerts and recommendations across hybrid environments. Microsoft Sentinel (B) is correct because it is a cloud-native SIEM and SOAR solution that ingests data from hybrid sources via connectors, correlates it with analytics rules, and enables automated threat detection and response through playbooks. Microsoft Defender for Identity (E) is correct because it monitors on-premises Active Directory Domain Services signals and integrates with Defender for Cloud Apps and Sentinel to detect identity-based attacks such as lateral movement and credential theft in hybrid identity scenarios. Microsoft Defender for Office 365 (C) is not correct because it focuses on protecting email, collaboration, and Office apps from phishing and malware, not on broad hybrid cloud threat detection and response. Microsoft Intune (D) is not correct because it is a mobile device and endpoint management (MDM/MAM) service for configuration and compliance, not a threat detection and response solution for hybrid cloud workloads.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Intune

Question 7

Which THREE are security best practices for Microsoft Entra ID? (Select three.)

Accepted Answer

Block legacy authentication protocols. Option A is correct because blocking legacy authentication protocols (such as IMAP, POP3, SMTP AUTH, and older Office clients that cannot enforce MFA) closes a common bypass that attackers use to conduct password-spray and credential-stuffing attacks against Microsoft Entra ID. Option B is correct because enabling multifactor authentication for all administrators adds a strong second factor to privileged sign-ins, directly mitigating the risk of compromised admin credentials, and Microsoft recommends MFA for all users with privileged roles. Option E is correct because Privileged Identity Management enforces just-in-time role activation with approval, justification, and time-bound assignments, reducing standing privileged access that attackers could abuse. Option C is not a best practice because self-service password reset improves security and reduces helpdesk burden when combined with MFA and strong authentication methods. Option D is not inherently a security best practice because synchronizing all on-premises accounts can propagate stale, unnecessary, or compromised identities into Entra ID; synchronization should be scoped to required accounts with proper governance.

Answer

Disable self-service password reset for users

Answer

Synchronize all on-premises user accounts to Microsoft Entra ID

Question 8

Which TWO of the following are valid methods to secure traffic between on-premises and Azure?

Accepted Answer

ExpressRoute with MACsec. ExpressRoute with MACsec provides encryption at Layer 2 using the IEEE 802.1AE standard, securing traffic between on-premises and Azure over a private connection without traversing the public internet. Site-to-Site VPN uses IPsec (IKEv1/IKEv2) to encrypt traffic over the public internet, establishing a secure tunnel between the on-premises VPN device and Azure VPN Gateway. Both are valid methods for securing traffic, with ExpressRoute+MACsec offering lower latency and higher throughput for private connectivity.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure CDN

Question 9

Your company uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a confirmed ransomware incident by isolating affected devices and blocking malicious IPs. What should you use?

Accepted Answer

Sentinel automation rules with playbooks. Sentinel automation rules with playbooks (option B) is correct because automation rules in Microsoft Sentinel trigger Logic App playbooks in response to analytics rule alerts, and those playbooks can call Microsoft Defender for Endpoint APIs to isolate devices and update firewall/blocklist mechanisms to block malicious IPs. This directly matches the requirement for automated incident response to a confirmed ransomware incident. Azure Policy (A) is for enforcing governance and compliance on Azure resources, not for orchestrating incident response actions. Microsoft Defender for Cloud Apps (C) is a CASB for discovering and controlling cloud app usage, not for device isolation or IP blocking. Microsoft Intune (D) is for device management and compliance, not for automated security incident response workflows.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 10

A company uses Microsoft Purview Data Lifecycle Management. They need to retain financial records for 7 years and then delete them. Which TWO actions should they configure?

Accepted Answer

Create a retention label with a 7-year retention period. Option C is correct because a retention label in Microsoft Purview Data Lifecycle Management is the mechanism that defines how long content is retained (here, 7 years) and what happens at the end of that period, such as deletion. Option E is correct because a disposition review can be attached to a retention label so that when the 7-year retention period expires, designated reviewers must approve the deletion before the records are permanently removed, which is a common compliance requirement for financial records. Option A is incorrect because DLP policies are designed to prevent data loss or leakage, not to enforce retention or deletion schedules. Option B is incorrect because sensitivity labels classify and protect content (for example, encryption and access restrictions) but do not by themselves define retention or deletion periods. Option D is incorrect because trainable classifiers identify content types for classification or auto-labeling; they do not enforce a 7-year retention-then-delete lifecycle.

Answer

Create a DLP policy that blocks deletion

Answer

Apply a sensitivity label to the records

Answer

Use a trainable classifier to identify records