SC-100 Practice Test 2 — 10 Questions

Question 1

A company has a Microsoft Sentinel workspace that ingests data from multiple sources. The SOC team wants to improve the efficiency of investigating incidents by using UEBA capabilities. Which two actions should the team take to enable and configure UEBA in Sentinel?

Accepted Answer

Set the entity behavior analytics to 'Active' in the Sentinel configuration.. Options B and D are correct. Enabling UEBA is done per workspace (B). Setting the entity behavior analytics to 'Active' enables the feature (D). Option A is incorrect because UEBA is not a data connector; it's a feature enabled in the workspace settings. Option C is incorrect because the analytics rule for UEBA is not a separate rule; UEBA is enabled at the workspace level. Option E is incorrect because time range selection is not part of enabling UEBA; it's part of analytics rule configuration.

Answer

Install the UEBA data connector from the Sentinel content hub.

Answer

Create an analytics rule that uses the UEBA template.

Answer

Define a time range for entity behavior baselines.

Question 2

A company uses Azure Policy to audit storage accounts for secure transfer (HTTPS) enforcement. The policy is set to 'AuditIfNotExists' but compliance shows 0% non-compliant storage accounts even though some accounts have secure transfer disabled. What is the most likely cause?

Accepted Answer

The policy should use 'Audit' or 'Deny' effect instead of 'AuditIfNotExists'. The 'AuditIfNotExists' effect is designed to audit resources that do not have a specific extension or sub-resource (e.g., a diagnostic setting or an agent). For a policy that needs to check a property of the storage account itself (like secure transfer enabled), the correct effect is 'Audit' (or 'Deny'). 'AuditIfNotExists' will never flag a storage account as non-compliant for missing the secure transfer property because it is looking for the absence of a child resource, not a property misconfiguration.

Answer

The policy is in 'audit' mode and does not evaluate

Answer

The storage accounts are in a different region

Answer

The policy assignment scope does not include the non-compliant accounts

Question 3

A company stores sensitive data in Azure Blob Storage. They want to prevent data exfiltration by blocking public access and restricting network access to only their on-premises data center via VPN. Which two features should they use?

Accepted Answer

Disable public access and configure a service endpoint with a firewall rule for the VPN subnet. Option C is correct because disabling public access ensures the storage account is not reachable from the internet, and configuring a service endpoint with a firewall rule for the VPN subnet restricts traffic to only the on-premises data center traffic arriving via the VPN. Service endpoints provide an optimized route over the Azure backbone, and the firewall rule explicitly allows the VPN subnet's IP range, preventing data exfiltration from unauthorized networks.

Answer

Enable firewall and add on-premises IP range

Answer

Disable public access and use RBAC

Question 4

A company is designing a defense-in-depth strategy for their Azure environment. They want to ensure that if a virtual machine is compromised, the attacker cannot move laterally to other VMs in the same virtual network. Which security control should they prioritize?

Accepted Answer

Implement network segmentation using NSGs and application security groups. Network segmentation using NSGs and application security groups is the correct priority because it directly controls east-west traffic between VMs within the same virtual network. By defining explicit inbound and outbound rules that restrict communication to only necessary ports and protocols (e.g., TCP 443 for HTTPS), an attacker who compromises one VM cannot initiate lateral movement to other VMs, as the NSG will drop unauthorized traffic at the subnet or NIC level.

Answer

Enable Azure DDoS Protection on the virtual network

Answer

Enable multi-factor authentication (MFA) for all admin accounts

Answer

Deploy Azure Bastion for secure remote access

Question 5

You are designing a security strategy for a hybrid identity infrastructure that uses Microsoft Entra ID. The company requires that all administrative access to on-premises servers be secured using least-privilege principles and just-in-time (JIT) access. You plan to implement Microsoft Entra Privileged Identity Management (PIM) for Azure resources, but on-premises servers are not Azure resources. Which solution should you use to provide JIT access to on-premises servers?

Accepted Answer

Use Microsoft Entra Privileged Identity Management (PIM) for Groups to manage membership of an on-premises Active Directory group that has administrative privileges on the servers.. Option D is correct because Microsoft Entra PIM for Groups allows you to manage just-in-time membership of an on-premises Active Directory group that is synced via Microsoft Entra Connect. When a user activates their membership in PIM, the group membership change is written back to on-premises AD via group writeback, granting temporary administrative privileges on the target servers. This extends PIM's JIT capabilities to non-Azure resources without requiring the servers to be Azure Arc-enabled.

Answer

Install Azure Arc agents on the on-premises servers and use Azure Policy to enforce JIT access.

Answer

Deploy Windows Admin Center and integrate with Microsoft Entra ID for authentication.

Answer

Configure Azure Bastion to connect to on-premises servers via a site-to-site VPN.

Question 6

A global organization uses Microsoft Sentinel for SIEM and Microsoft Defender for Cloud for cloud security posture management. The security team notices that critical alerts from Azure Active Directory Identity Protection are not triggering automated response playbooks in Sentinel. The team needs to ensure that all high-severity Identity Protection risk detections automatically create incidents in Sentinel and trigger a playbook to block the user. What should the team configure?

Accepted Answer

Enable the Identity Protection data connector and create a Microsoft Security incident creation rule for Identity Protection.. Option A is correct because to have Identity Protection risk detections automatically create incidents in Microsoft Sentinel and trigger a playbook, you must first enable the Identity Protection data connector (which brings the alerts into Sentinel) and then create a Microsoft Security incident creation rule specifically for Identity Protection. This rule ingests the alerts as security incidents, and you can attach an automation rule to run a playbook (e.g., to block the user) when a high-severity incident is created. Without the incident creation rule, the alerts would be ingested as raw events but not automatically turned into incidents.

Answer

Enable the Azure Active Directory Identity Protection data connector in Sentinel.

Answer

Configure diagnostic settings on Azure AD to stream logs to Sentinel and create a playbook automation rule.

Answer

Configure the Identity Protection connector with the 'Create incidents' toggle enabled.

Question 7

A company is designing a security operations strategy using Microsoft Sentinel. They want to prioritize triage of incidents that involve critical assets. The SOC manager suggests using the entity behavior analytics feature. Which capability of entity behavior analytics helps achieve this goal?

Accepted Answer

It profiles entities and assigns an anomaly score based on deviations from baseline behaviors.. Entity behavior analytics (UEBA) in Microsoft Sentinel profiles entities such as users, hosts, or applications by establishing baseline behaviors over time. It then assigns an anomaly score to deviations from that baseline, enabling SOC analysts to prioritize incidents involving critical assets based on unusual activity rather than static rules. This directly supports the goal of triaging incidents by highlighting anomalous behavior on high-value targets.

Answer

It combines multiple alerts into a single incident using Fusion.

Answer

It uses threat intelligence to correlate with known bad actors.

Answer

It automatically groups incidents by severity and asset criticality.

Question 8

A SOC team uses Microsoft Sentinel for incident management. They need to ensure that when a high-severity incident is created, a Teams message is sent to the security team and an email is sent to the IT manager. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Sentinel that triggers a playbook to send the notifications.. Option B is correct because automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created, allowing you to send a Teams message and an email simultaneously. This is the most efficient, automated approach without manual intervention or modifying the analytics rule itself.

Answer

Configure the analytics rule to send notifications when an incident is created.

Answer

Use a workbook to display incidents and have a manual process to send notifications.

Answer

Enable incident creation in the data connector settings.

Question 9

A company has a hybrid identity infrastructure with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. The security team wants to use Microsoft Defender for Identity (MDI) to detect on-premises attacks. They have installed the MDI sensor on all domain controllers. However, they notice that some alerts are missing. What is the most likely cause?

Accepted Answer

The necessary Windows event logs are not being forwarded to the MDI sensor.. Microsoft Defender for Identity relies on Windows Event Logs (specifically Event ID 4776, 4624, 4648, and others) to detect on-premises attacks such as Pass-the-Hash, Golden Ticket, and DCSync. If these logs are not being forwarded to the MDI sensor (e.g., due to disabled audit policies or log size limits), the sensor cannot analyze the events, resulting in missing alerts. The sensor itself is installed on domain controllers, but it must have access to the relevant security logs to function correctly.

Answer

MDI is not integrated with Microsoft Sentinel.

Answer

Azure AD Connect is not syncing frequently enough.

Answer

The sensor is not licensed for all detection types.

Question 10

A company uses Azure Front Door to load balance traffic across two origin servers in different Azure regions. They notice that failover is not working when one origin becomes unhealthy. What is the most likely cause?

Accepted Answer

The health probe path is set to an incorrect endpoint on the origin servers.. The most likely cause is that the health probe path is set to an incorrect endpoint on the origin servers. Azure Front Door uses health probes to determine the health of each origin; if the probe path does not return a 200 OK status (e.g., it points to a missing page or a resource that doesn't exist), Front Door will mark that origin as unhealthy and stop routing traffic to it. Since failover is not occurring, the healthy origin is not being detected as healthy, or the unhealthy origin is not being detected as unhealthy, which directly prevents proper failover.

Answer

Both origins are in the same region.

Answer

Caching is enabled on the Front Door profile.

Answer

Session affinity is enabled.