SC-100 Practice Test 20 — 15 Questions

Question 1

A global enterprise uses Microsoft Entra ID with Privileged Identity Management (PIM) and Conditional Access. They need to ensure that all privileged role activations require an approval workflow, and that the approval process is documented for compliance. What configuration should they implement?

Accepted Answer

In PIM, edit the role settings to require approval for activation. Option C is correct because PIM approvals require configuring role settings with approval required. Option A is incorrect because role-assignable groups are for group-based assignments, not approval workflows. Option B is incorrect because access reviews are for periodic review, not per-activation approval. Option D is incorrect because Authentication Strengths control MFA, not approval.

Answer

Create a Conditional Access policy requiring an Authentication Strength

Answer

Configure an access review for the privileged roles

Answer

Create a role-assignable group and assign the privileged role to the group

Question 2

A company uses Microsoft Sentinel as its SIEM. They want to minimize storage costs for verbose logs that are rarely accessed but must be retained for one year for compliance. Which TWO actions should they take?

Accepted Answer

Archive the logs to Azure Storage after 30 days. Option B is correct because basic logs are cheaper than analytics logs. Option C is correct because archiving long-term data to Azure Storage reduces costs. Option A is incorrect because removing data sources reduces visibility. Option D is incorrect because continuous export does not reduce cost. Option E is incorrect because increasing retention increases cost.

Answer

Increase the retention period to one year

Answer

Remove the data sources that generate verbose logs

Answer

Set up continuous export to an event hub

Question 3

Your organization uses Microsoft Sentinel as its SIEM. You receive a large number of low-severity alerts from various sources, overwhelming the security operations team. You need to design a solution to reduce alert fatigue while ensuring that critical incidents are not missed. The solution should also automatically collect feedback from analysts when they close an incident. What should you implement?

Accepted Answer

Tune analytics rules to generate incidents only for high-fidelity alerts and use automation rules to collect feedback on incident closure. Option D is correct because Sentinel's analytics rules can be configured to create incidents only for high-fidelity alerts, and automation rules can be used to prompt analysts for feedback when closing incidents. Option A is wrong because simply increasing severity thresholds may miss critical events. Option B is wrong because creating incidents for all alerts would increase fatigue. Option C is wrong because a playbook for feedback is useful but does not reduce alert volume.

Answer

Create a separate analytics rule for each severity level

Answer

Implement a playbook that automatically closes low-severity alerts and collects feedback

Answer

Increase the severity threshold for all analytics rules

Question 4

A company uses Microsoft Defender for Cloud Apps to monitor SaaS apps. They discover that a user is downloading large volumes of data from SharePoint Online from an atypical IP address. The security team wants to automatically suspend the user's access to all cloud apps. What is the most efficient way to achieve this?

Accepted Answer

Create a session policy that blocks the user's session based on the anomaly.. Option B is correct because session policies enforce real-time controls and can block access. Option A is wrong because file policies control data at rest, not access. Option C is wrong because app tags categorize apps. Option D is wrong because OAuth app policies manage third-party app permissions.

Answer

Tag the user as suspicious using an app tag.

Answer

Create a file policy that triggers when a user downloads many files.

Answer

Create an OAuth app policy to revoke permissions.

Question 5

Which THREE are valid methods to secure privileged access in Microsoft Entra ID? (Choose three.)

Accepted Answer

Use privileged access groups to manage elevated access to resources.. Option A is correct because PIM enables just-in-time access. Option B is correct because conditional access can enforce MFA for admins. Option D is correct because privileged access groups manage group membership elevation. Option C is wrong because self-service password reset is for end users. Option E is wrong because device enrollment is for device management, not privileged access.

Answer

Require device enrollment via Microsoft Intune.

Answer

Enable self-service password reset for all users.

Question 6

Your organization has Microsoft Sentinel. You need to create an analytics rule that detects when a user account is created outside of business hours (9 AM to 5 PM, Monday-Friday). Which KQL query should you use as the rule query?

Accepted Answer

... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) !between (9 .. 17). The query filters for events where the time is not between 9 AM and 5 PM on weekdays. The correct condition uses dayofweek() and datetimepart functions to check the hour. Option B uses the correct logic: dayofweek between 2 and 6 (Monday-Friday) and hour not between 9 and 17. Option A is incorrect for weekdays, C and D have wrong hour ranges.

Answer

... | where dayofweek(TimeGenerated) between (1 .. 5) and datetime_part("hour", TimeGenerated) !between (9 .. 17)

Answer

... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) between (9 .. 17)

Answer

... | where dayofweek(TimeGenerated) !between (2 .. 6) or datetime_part("hour", TimeGenerated) between (9 .. 17)

Question 7

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and block data exfiltration from sanctioned cloud apps to personal devices. What should you configure?

Accepted Answer

Create a session policy with app governance to block download.. Option C is correct because session policies with app governance can monitor and control data transfer in real time. Option A is wrong because discovery policies identify unsanctioned apps, not block actions. Option B is wrong because file policies are for static compliance. Option D is wrong because OAuth app policies manage permissions, not data exfiltration.

Answer

Create an OAuth app policy to revoke permissions.

Answer

Create an app discovery policy to identify unsanctioned apps.

Answer

Create a file policy to detect sensitive data in sanctioned apps.

Question 8

Your organization uses Microsoft Sentinel for security operations. You need to ensure that all incidents related to a specific critical asset are automatically assigned to the senior SOC analyst. The assignment should occur as soon as the incident is created. What should you configure?

Accepted Answer

Create an automation rule that sets the incident owner to the senior SOC analyst.. Option B is correct because automation rules in Microsoft Sentinel can be used to assign incidents to specific owners automatically upon creation. Option A is incorrect because playbooks can automate responses but are not the simplest method for assignment. Option C is incorrect because analytics rules create alerts, not assign incidents. Option D is incorrect because workbooks are for visualization.

Answer

Modify the analytics rule to include a custom details field for owner.

Answer

Create a playbook and trigger it from an automation rule.

Answer

Configure a workbook to display incidents and manually assign them.

Question 9

Which TWO actions should you take to implement a Zero Trust security strategy for identity and access? (Choose two.)

Accepted Answer

Require Multi-Factor Authentication for all users.. Options A and D are correct. Option A is correct because Multi-Factor Authentication is a fundamental Zero Trust control. Option D is correct because Conditional Access enforces policies based on signals. Option B is incorrect because VPN is a perimeter-based approach, not Zero Trust. Option C is incorrect because shared accounts violate the principle of least privilege. Option E is incorrect because passwords alone are not sufficient.

Answer

Use VPN for remote access to the corporate network.

Answer

Rely on strong passwords only.

Answer

Create shared accounts for temporary workers.

Question 10

A company uses Microsoft Defender XDR and wants to ensure that all devices are reporting to the service. They notice that some devices are not appearing in the device inventory. Which log source should they check first to troubleshoot?

Accepted Answer

Microsoft Defender for Endpoint deployment log (MDEClientAnalyzer). Option B is correct because the Microsoft Defender for Endpoint deployment log shows onboarding status and errors. Option A is incorrect because Windows Event Log may not be enabled. Option C is incorrect because Intune enrollment is for MDM, not Defender. Option D is incorrect because Syslog is for non-Microsoft devices.

Answer

Microsoft Intune enrollment logs

Answer

Windows Event Log - Microsoft-Windows-Windows Defender/Operational

Answer

Syslog from the device

Question 11

A company uses Microsoft Defender for Cloud to secure multicloud environments. They want to assess compliance with SOC 2. Which THREE steps should they take?

Accepted Answer

Monitor the secure score for SOC 2 recommendations. Option A is correct because Defender for Cloud has built-in regulatory compliance standards. Option B is correct because secure score helps track compliance. Option C is correct because continuous export sends data to other tools. Option D is incorrect because Azure Policy is for Azure resources, not multicloud. Option E is incorrect because JIT is a security control, not compliance assessment.

Answer

Enable just-in-time (JIT) VM access

Answer

Create Azure Policy definitions for SOC 2 controls

Question 12

Your organization is required to retain all Microsoft Teams chat messages for 7 years due to regulatory compliance. You need to design a solution that automatically retains and, if needed, e-discovery searches these messages. What should you configure?

Accepted Answer

Microsoft Purview retention policies and eDiscovery. Option A is correct because Microsoft Purview retention policies can be applied to Teams chats to retain them for a specified period, and eDiscovery can search retained messages. Option B is wrong because sensitivity labels classify but do not enforce retention. Option C is wrong because DLP policies prevent data loss, not retention. Option D is wrong because Azure Policy applies to Azure resources, not Microsoft 365 data.

Answer

Microsoft Purview Data Loss Prevention policies

Answer

Azure Policy

Answer

Sensitivity labels auto-labeling

Question 13

A multinational company uses Microsoft Purview for data governance. They need to automatically classify sensitive data in Microsoft 365 and apply retention labels. The solution must use pattern-based detection for credit card numbers and support custom keywords. What should they configure?

Accepted Answer

Create a custom sensitive info type with a regex pattern and keyword list.. Option D is correct because sensitive info types can be custom-defined with patterns and keywords. Option A is wrong because retention labels are applied after classification. Option B is wrong because trainable classifiers use machine learning, not fixed patterns. Option C is wrong because DLP policies enforce actions but don't classify.

Answer

Use a trainable classifier for credit card numbers.

Answer

Configure a DLP policy with a rule for credit card numbers.

Answer

Create a retention label with auto-labeling policy.

Question 14

A company wants to automate incident response in Microsoft 365 Defender. Which THREE actions can be automated using automated investigation and response (AIR) capabilities? (Choose three.)

Accepted Answer

Block a file hash across the organization.. Option A is correct because AIR can isolate devices automatically. Option B is correct because AIR can delete malicious emails. Option C is correct because AIR can block file hashes. Option D is wrong because resetting passwords is not an AIR action; it requires a playbook. Option E is wrong because creating users is not a security response action.

Answer

Reset a user's password.

Answer

Create a new user account.

Question 15

Your organization is deploying Microsoft Defender for Cloud Apps. Which THREE capabilities are included in Defender for Cloud Apps? (Select three.)

Accepted Answer

Session controls. Defender for Cloud Apps provides Cloud Discovery (discover shadow IT), app governance (control app permissions), and session controls (protect data in real time). Conditional Access is an Entra ID feature, and DLP policies are part of Microsoft Purview, though Cloud Apps can integrate with them.

Answer

Data Loss Prevention (DLP) policies

Answer

Conditional Access