SC-100 Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR to detect and respond to threats. The SOC team wants to automatically isolate a device when a high-severity incident is confirmed. Which automation feature should you configure?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender XDR is designed to automatically respond to confirmed high-severity incidents, including isolating devices, without manual intervention. This feature leverages playbooks and machine learning to contain threats rapidly, aligning with the SOC's requirement for automatic isolation upon incident confirmation.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Manual device isolation from Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint's endpoint detection and response (EDR)

Question 2

Your organization is implementing a privileged access strategy using Microsoft Entra ID. You need to provide just-in-time (JIT) access to Azure resources for administrators. Which TWO features should you use?

Accepted Answer

Privileged Identity Management (PIM) for Azure AD roles. Privileged Identity Management (PIM) for Azure AD roles enables just-in-time (JIT) activation of Azure AD roles, providing time-bound approval-based elevated access to Azure resources. Privileged Access Groups (PAG) extend JIT capabilities by allowing Azure AD roles and Azure RBAC roles to be assigned to groups, enabling JIT membership activation for granular resource access.

Answer

Identity Protection user risk policy

Answer

Azure RBAC roles

Answer

Access reviews

Question 3

Your organization wants to implement a zero-trust security model for on-premises and cloud resources. As part of this strategy, you need to ensure that all access requests are authenticated and authorized based on dynamic risk signals. Which Microsoft security solution should you use to enforce conditional access policies based on real-time risk?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access enables you to enforce access controls based on conditions such as user risk, sign-in risk, device compliance, and location. This aligns with zero-trust principles of verifying explicitly and using least privilege. Microsoft Defender for Cloud is for cloud security posture management, not conditional access. Microsoft Intune manages devices, and Microsoft Sentinel is a SIEM.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 4

Refer to the exhibit. You are an Azure security engineer reviewing a custom Azure Policy definition. The policy is intended to audit virtual machines to ensure they have the Azure Security extension installed. However, the policy is not triggering on any resources. What is the most likely reason?

Accepted Answer

The policy condition requires a managed disk, but the VMs might have unmanaged disks.. Option A is correct because the policy condition uses `field` to check for `Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.id`, which requires the VM to have a managed disk. If the VMs use unmanaged disks (i.e., the `managedDisk` property is absent), the condition evaluates to false, and the `auditIfNotExists` effect never triggers the existence check for the Azure Security extension.

Answer

The 'existenceCondition' field path is incorrect; it should be 'Microsoft.Compute/virtualMachines/extensions/publisher'.

Answer

The policy is assigned to a management group, but the VMs are in a subscription under a different management group.

Answer

The policy effect should be 'Deny' instead of 'auditIfNotExists'.

Question 5

Your company uses Microsoft Sentinel as a SIEM. You need to create an analytics rule that detects when a user account is created outside of business hours. The rule should trigger an incident for investigation. Which type of analytics rule should you use?

Accepted Answer

Scheduled query rule. A scheduled query rule is the correct choice because it allows you to define a KQL query that checks for user account creation events (e.g., from the SecurityEvent or AuditLogs table) and then use the query scheduling settings to run the query at a specific interval. You can then add a condition in the rule logic to filter for events occurring outside business hours (e.g., using the `datetime_part` function to check the hour of the event). When the query returns results, Sentinel automatically generates an incident for investigation.

Answer

Anomaly rule

Answer

Fusion rule

Answer

NRT query rule

Question 6

Which THREE Microsoft security solutions can be used to detect and respond to threats across hybrid cloud environments? (Choose three.)

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is correct because it provides unified security management and threat protection across hybrid cloud workloads, including Azure, on-premises, and other cloud platforms like AWS and GCP. It uses integrated vulnerability assessment, just-in-time access, and adaptive application controls to detect and respond to threats in real time, leveraging Microsoft Defender plans for servers, SQL, storage, and containers.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Intune

Question 7

Refer to the exhibit. Your organization is required to comply with PCI DSS. You need to prioritize remediation efforts to meet PCI DSS requirements. Based on the exhibit, which recommendation should you address first?

Accepted Answer

Enable MFA on accounts with owner permissions. PCI DSS requires strong access control, including multi-factor authentication for remote access and for all accounts with administrative access. The recommendation 'MFA should be enabled on accounts with owner permissions' directly impacts PCI DSS requirements for authentication. While vulnerability assessment is important, MFA is a key control for PCI DSS. The other recommendations are less directly related to PCI DSS.

Answer

Migrate VMs from classic to ARM

Answer

Enable vulnerability assessment on SQL databases

Answer

Enable diagnostic logs in Key Vault

Question 8

Your security team needs to receive alerts when a user is assigned a privileged role in Microsoft Entra ID. Which service should you use to create an alert for privileged role assignments?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) is the correct service because it provides built-in alerting capabilities specifically for privileged role assignments in Microsoft Entra ID. PIM can generate alerts when a user is assigned a privileged role, such as Global Administrator, without requiring additional configuration or external data sources. This aligns directly with the requirement to receive alerts for privileged role assignments within the identity platform.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 9

Your company is deploying Microsoft Defender XDR and wants to use automated investigation and response (AIR) to remediate confirmed threats. However, you need to ensure that high-impact actions like deleting email messages or isolating devices require manual approval from the security operations team. Which configuration should you set?

Accepted Answer

Set the automation level to 'Semi - require approval for high-severity remediations'. Option B is correct because the 'Semi - require approval for high-severity remediations' automation level in Microsoft Defender XDR ensures that high-impact actions (e.g., deleting email messages or isolating devices) require manual approval from the security operations team before execution. This setting balances automated efficiency with human oversight, specifically targeting high-severity threats while allowing lower-severity actions to proceed automatically.

Answer

Set the automation level to 'Full - automatically remediate all threats'

Answer

Set the automation level to 'No automated remediation'

Answer

Create a custom automation rule in Microsoft Sentinel

Question 10

Your organization is designing a security strategy for Microsoft 365 Copilot. You need to ensure that Copilot does not generate responses based on sensitive data that users are not authorized to access. Which TWO configurations should you implement?

Accepted Answer

Implement Conditional Access policies to restrict Copilot access based on user, device, and location.. Conditional Access policies (C) are correct because they enforce access controls at the authentication layer, ensuring that only authorized users from compliant devices and trusted locations can interact with Copilot. Sensitivity labels (E) are correct because Microsoft 365 Copilot respects sensitivity labels on documents and emails, preventing it from generating responses that include content from labeled sensitive data unless the user has the appropriate permissions. Together, these two controls address both who can access Copilot and what data Copilot can use in its responses.

Answer

Set up Information Barriers to prevent Copilot from accessing data across departments.

Answer

Configure Data Loss Prevention (DLP) policies to block sensitive data from being used in prompts.

Answer

Enable Purview Audit to monitor Copilot interactions.

Question 11

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. The policy is enabled but users with the Global Administrator role are not being prompted for MFA. What is the most likely reason?

Accepted Answer

The policy does not include any users except by role.. Option A is correct because the policy is scoped to 'All users' but the 'Include' filter is set to 'All users' while the 'Exclude' filter includes 'Global Administrator' role. Since the policy excludes Global Administrators, they are not subject to the MFA grant control, even though the policy is enabled. The JSON snippet shows the policy is enabled and includes all users by default, but the exclusion of the Global Administrator role overrides the inclusion, so they are never evaluated for MFA.

Answer

The policy does not include any applications.

Answer

The grant control requires a compliant device instead of MFA.

Answer

The policy state is disabled.

Question 12

A company uses Microsoft Sentinel with a workspace in the East US region. They want to ingest logs from Azure resources in West Europe. To minimize data transfer costs, what should they do?

Accepted Answer

Create a new Sentinel workspace in West Europe and ingest logs there. To minimize costs, the best practice is to create a Sentinel workspace in the same region as the data sources. Since West Europe resources are in West Europe, a workspace there is optimal. However, the question states the workspace is already in East US. To minimize transfer costs, they could create a new workspace in West Europe and ingest logs there, then use cross-workspace queries. But that adds complexity. Alternatively, they could continue to use the East US workspace and accept the costs. The best answer is to create a new workspace in West Europe.

Answer

Use Azure ExpressRoute to connect West Europe to East US

Answer

Configure data collection rules to filter logs at source

Answer

Use the existing workspace; inter-region costs are negligible

Question 13

Your organization uses Microsoft Sentinel as its SIEM. The security team needs to detect brute-force attacks against Azure VMs by analyzing Windows Security Event logs. Which data connector should you enable?

Accepted Answer

Windows Security Events via AMA connector. The Windows Security Events via AMA connector (D) is correct because it ingests Windows Event Logs (specifically Security logs with Event ID 4625 for failed logons) from Azure VMs into Microsoft Sentinel, enabling detection of brute-force patterns. This connector uses the Azure Monitor Agent (AMA) to collect events, which is the recommended method for modern Windows event collection in Sentinel.

Answer

Office 365 connector

Answer

Azure Activity log connector

Answer

Microsoft Defender for Cloud connector

Question 14

Refer to the exhibit. You are analyzing an Azure PowerShell script that checks a blob property. The output of the last command returns 'False'. What does this indicate about the blob storage configuration?

Accepted Answer

Access time tracking is disabled for the storage account.. The property 'IsAccessTimeTrackingEnabled' is a blob storage setting that, when enabled, tracks the last access time of blobs for lifecycle management. A value of 'False' means access time tracking is disabled. Option A is wrong because access time tracking is not related to encryption. Option B is wrong because it is not about immutability. Option D is wrong because it is not about logging.

Answer

Diagnostic logging is not configured for the container.

Answer

The blob has an immutability policy applied.

Answer

Server-side encryption is disabled for the blob.

Question 15

Your company uses Microsoft Sentinel as its SIEM. You need to design a solution that automatically responds to high-severity incidents by creating a ticket in ServiceNow and notifying the security team via Teams. Which Sentinel feature should you configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel are designed to trigger automated responses to incidents based on conditions like severity. They can integrate with external systems via playbooks (Azure Logic Apps) to create ServiceNow tickets and send Teams notifications, making them the correct choice for this requirement.

Answer

Workbooks

Answer

Analytics rules

Answer

Hunting queries