SC-100 Practice Exam 4 — 20 Questions

Question 1

Your company uses Microsoft Purview to classify and label sensitive data. The data protection team needs to automatically apply a 'Confidential' label to documents that contain a custom sensitive info type for employee IDs. Which should you create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A custom sensitive information type and an auto-labeling policy. To automatically apply a 'Confidential' label based on the presence of a custom sensitive info type (employee IDs), you need both a custom sensitive information type (SIT) to define the pattern and an auto-labeling policy to trigger the label application. The auto-labeling policy uses the SIT to scan documents and automatically applies the specified sensitivity label when a match is found. This is the only option that combines the detection mechanism with automated labeling.

Answer

A trainable classifier

Answer

A sensitivity label

Answer

A retention label

Question 2

A company uses Microsoft Defender for Cloud to manage security across hybrid workloads. They need to ensure that all Azure VMs have guest-level threat detection enabled. Which security policy should they assign?

Accepted Answer

Microsoft cloud security benchmark. The Microsoft cloud security benchmark (MCSB) is the correct policy because it includes built-in guest-level threat detection recommendations for Azure VMs, such as deploying the Log Analytics agent and enabling Microsoft Defender for Servers with guest-level monitoring. This benchmark is the default initiative in Defender for Cloud and directly maps to the requirement of enabling guest-level threat detection across all VMs.

Answer

Azure Security Benchmark

Answer

Microsoft Defender for Cloud Apps

Answer

NIST SP 800-53

Question 3

An organization is implementing a Zero Trust identity strategy. They have a mix of on-premises Active Directory and Azure AD. They want to enforce conditional access policies that require device compliance for accessing sensitive apps. However, some users report that their devices are not being evaluated for compliance even though they are enrolled in Microsoft Intune. What should the organization check first?

Accepted Answer

Verify that devices are registered in Azure AD. Device compliance evaluation in a hybrid identity environment requires that devices are registered in Azure AD (Azure AD Registration) so that Azure AD can associate the device identity with Intune compliance data. Even if a device is enrolled in Intune, without Azure AD registration, Conditional Access policies cannot evaluate its compliance status because the device identity is not recognized by Azure AD during authentication.

Answer

Ensure Intune compliance policies are assigned to the correct user groups

Answer

Confirm that devices are Azure AD Joined

Answer

Check if users have enabled multi-factor authentication

Question 4

Your organization uses Microsoft Sentinel and wants to reduce alert fatigue by grouping related alerts into incidents. Which configuration should you use?

Accepted Answer

Configure incident creation in the analytics rule properties. In Microsoft Sentinel, incident creation is configured directly within the analytics rule properties. When you create or edit a scheduled or Microsoft Security analytics rule, the 'Incident settings' tab allows you to enable incident creation and define how alerts are grouped into incidents. This is the native mechanism for reducing alert fatigue by automatically grouping related alerts into a single incident based on criteria such as entity matching or time window.

Answer

Use a workbook to aggregate alerts

Answer

Use a playbook to create incidents

Answer

Create an automation rule to group alerts

Question 5

Your organization uses Microsoft Sentinel as its SIEM. You receive a large number of low-severity alerts from various sources, overwhelming the security operations team. You need to design a solution to reduce alert fatigue while ensuring that critical incidents are not missed. The solution should also automatically collect feedback from analysts when they close an incident. What should you implement?

Accepted Answer

Tune analytics rules to generate incidents only for high-fidelity alerts and use automation rules to collect feedback on incident closure. Tuning analytics rules to generate incidents only for high-fidelity alerts directly reduces alert volume without compromising detection of critical threats. Automation rules in Microsoft Sentinel can trigger a playbook or run a logic app on incident closure, enabling automatic collection of analyst feedback via custom fields or external systems.

Answer

Create a separate analytics rule for each severity level

Answer

Implement a playbook that automatically closes low-severity alerts and collects feedback

Answer

Increase the severity threshold for all analytics rules

Question 6

Your organization needs to audit all changes to Azure resources, including who made the change and what was changed. Which Azure service should you use to collect and analyze this audit data?

Accepted Answer

Azure Monitor with activity logs. Azure Monitor with activity logs is the correct service because it captures all control-plane operations on Azure resources, including who performed the change (via Azure Active Directory authentication), what was changed (the resource and properties), and when it occurred. Activity logs are retained for 90 days by default and can be exported to Log Analytics workspaces for advanced querying and alerting, making them the native audit trail for Azure resource modifications.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 7

You are designing a security operations strategy for Microsoft 365. You need to prioritize alerts from Microsoft Defender XDR based on their impact on business operations. Which security best practice should you follow?

Accepted Answer

Prioritize alerts based on a risk assessment that considers asset criticality, threat severity, and business impact. Microsoft Defender XDR integrates with Microsoft 365 Defender's risk-based alert prioritization, which uses a combination of asset criticality (e.g., from Microsoft Purview or Defender for Cloud Apps), threat severity (e.g., from the Microsoft Defender portal's alert severity levels: Informational, Low, Medium, High), and business impact (e.g., via sensitivity labels or data classification). This aligns with the security best practice of risk-based alert triage, ensuring that high-impact alerts are addressed first to minimize business disruption.

Answer

Prioritize alerts based on a qualitative risk assessment only

Answer

Treat all alerts with equal severity to ensure none are missed

Answer

Prioritize alerts based solely on the MITRE ATT&CK technique involved

Question 8

A company wants to protect sensitive email data from being exfiltrated by malicious insiders. They need a solution that can detect and block anomalous outbound email traffic in real time. Which Microsoft solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) is the correct solution because it provides real-time detection and blocking of anomalous outbound email traffic through its outbound spam filtering and anti-phishing policies. MDO uses machine learning models to analyze email sending patterns, such as sudden spikes in volume or unusual recipient domains, and can automatically quarantine or block suspicious outbound messages to prevent data exfiltration by malicious insiders.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 9

Your organization is adopting Microsoft Copilot for Security. You need to ensure that the AI model does not expose sensitive data during interactions. What is the primary security control you should implement?

Accepted Answer

Microsoft Purview Data Loss Prevention policies for Copilot. Microsoft Purview Data Loss Prevention (DLP) policies for Copilot for Security are the primary control to prevent sensitive data exposure because they can inspect and block sensitive information (e.g., credit card numbers, health records) in real-time during Copilot interactions. DLP policies integrate directly with Copilot to enforce data protection rules on both prompts and responses, ensuring that sensitive data is not leaked through the AI model. This is the most direct and effective control for preventing data exposure in AI interactions.

Answer

Microsoft Entra Conditional Access policies

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Purview Information Protection sensitivity labels

Question 10

Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?

Accepted Answer

Microsoft Intune. Microsoft Intune provides device compliance policies and can send device posture signals to Entra ID Conditional Access. With Intune, you can enforce device health and compliance requirements before granting access. Option A is wrong because Microsoft Purview focuses on data governance and compliance, not device management. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) and does not directly manage device compliance. Option D is wrong because Microsoft Sentinel is a security information and event management (SIEM) solution and does not provide device posture signals.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 11

A company wants to implement a secure web application gateway to protect their public-facing web apps from common exploits like SQL injection and cross-site scripting. Which Azure service should they use?

Accepted Answer

Azure Application Gateway with WAF. Azure Application Gateway with WAF is the correct choice because it is a regional, layer-7 load balancer that includes a built-in Web Application Firewall (WAF) specifically designed to protect web applications from common exploits such as SQL injection and cross-site scripting (XSS). The WAF uses OWASP Core Rule Sets (CRS) to inspect HTTP/HTTPS traffic and block malicious payloads at the application layer, making it the ideal service for securing public-facing web apps.

Answer

Azure Front Door with WAF

Answer

Azure Firewall

Answer

Azure DDoS Protection

Question 12

A company is designing a security operations strategy. They want to use Microsoft Sentinel to detect and respond to threats across their hybrid environment. They need to ensure that logs from all sources are collected cost-effectively and that analysts can easily query data. Which data ingestion strategy should they recommend?

Accepted Answer

Use Analytics logs for high-value security logs and Basic logs for verbose logs with low security value.. It balances cost and query performance by routing high-value security logs (e.g., Windows Security Events, network logs) to the Analytics logs table for full KQL query capabilities and retention, while sending verbose, low-security-value logs (e.g., DNS debug, firewall flow logs) to the Basic logs table, which offers lower ingestion cost and limited query features (e.g., no KQL summarization). This tiered approach ensures analysts can efficiently hunt on critical data without incurring unnecessary costs for voluminous, less actionable logs.

Answer

Send all logs to the Basic logs table to reduce costs.

Answer

Send only Windows Security Events to Sentinel.

Answer

Send all logs to the Analytics logs table for full query capabilities.

Question 13

Refer to the exhibit. You are an Azure security engineer reviewing a custom Azure Policy definition. The policy is intended to audit virtual machines to ensure they have the Azure Security extension installed. However, the policy is not triggering on any resources. What is the most likely reason?

Accepted Answer

The policy condition requires a managed disk, but the VMs might have unmanaged disks.. The policy condition uses `field` to check for `Microsoft.Compute/virtualMachines/storageProfile.osDisk.managedDisk.id`, which requires the VM to have a managed disk. If the VMs use unmanaged disks (i.e., the `managedDisk` property is absent), the condition evaluates to false, and the `auditIfNotExists` effect never triggers the existence check for the Azure Security extension.

Answer

The 'existenceCondition' field path is incorrect; it should be 'Microsoft.Compute/virtualMachines/extensions/publisher'.

Answer

The policy is assigned to a management group, but the VMs are in a subscription under a different management group.

Answer

The policy effect should be 'Deny' instead of 'auditIfNotExists'.

Question 14

You are the security architect for a large financial services company. The company has a hybrid environment with on-premises Active Directory, Azure AD, and multiple Azure subscriptions. They use Microsoft Sentinel as their SIEM and have deployed Microsoft Defender for Cloud to assess their cloud security posture. Recently, the security team discovered that a critical Azure SQL database was exposed to the internet with a firewall rule allowing 'AllowAllWindowsAzureIps'. This misconfiguration was not flagged by Defender for Cloud because the corresponding recommendation was disabled in the security policy. The company wants to prevent such misconfigurations in the future and ensure that all critical resources are covered by security recommendations. They also need to ensure that any changes to security policies are reviewed and approved. Which of the following actions should you recommend as the most comprehensive solution?

Accepted Answer

Review and enable all relevant security recommendations in Defender for Cloud, and implement a change management process using Azure Policy and a custom workflow that requires approval before modifying security policies.. It addresses the root cause—disabled security recommendations—by enabling all relevant recommendations in Defender for Cloud, and it enforces a change management process using Azure Policy with a custom approval workflow. This ensures that any modifications to security policies are reviewed and approved, preventing future misconfigurations like the 'AllowAllWindowsAzureIps' rule from going unnoticed. The combination of policy enforcement and approval workflow provides a comprehensive, automated governance layer that covers both detection and prevention.

Answer

Deploy Azure Monitor alerts on all SQL Server firewall rule changes and instruct the security team to manually review each change.

Answer

Assign the Contributor role to the security team on the subscription so they can directly modify firewall rules if needed.

Answer

Enable the specific recommendation for SQL Server firewall rules in Defender for Cloud and set up an automation rule to send alerts when the recommendation is triggered.

Question 15

Your organization wants to implement a security information and event management (SIEM) solution that can ingest logs from multiple sources, including on-premises servers, Azure resources, and third-party SaaS applications. Which Microsoft service should you choose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM solution specifically designed to ingest logs from diverse sources, including on-premises servers, Azure resources, and third-party SaaS applications, using built-in connectors for over 100 data sources. It provides centralized security analytics, threat detection, and incident response, making it the appropriate service for this multi-source log ingestion requirement.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 16

A security architect needs to design a solution that provides a unified view of security alerts from multiple clouds (Azure, AWS, GCP) and on-premises systems. The solution must also support automated response using playbooks. Which Microsoft service should they use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that ingests security alerts from multiple clouds (Azure, AWS, GCP) and on-premises systems via connectors. It supports automated response through playbooks built on Azure Logic Apps, enabling unified alert management and remediation workflows.

Answer

Microsoft Defender XDR

Answer

Microsoft Defender for Cloud

Answer

Microsoft Purview

Question 17

A company plans to implement a Zero Trust architecture using Microsoft security solutions. They want to ensure that all access to corporate resources is verified explicitly, uses least privilege, and assumes breach. Which Microsoft service should be the central policy engine for enforcing conditional access decisions?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct central policy engine because it directly enforces Zero Trust principles by evaluating signals (user, device, location, risk) in real time to grant or block access. It acts as the policy decision point (PDP) that enforces explicit verification, least privilege, and assumes breach by requiring continuous authentication and authorization for every access request.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 18

A company uses Microsoft Defender for Endpoint to protect endpoints. They want to configure attack surface reduction rules to block executable files from running unless they meet a specific prevalence, age, or trust level. Which ASR rule should they enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is specifically designed to block executables that do not meet Microsoft's cloud-based prevalence, age, or trustworthiness criteria. This rule uses the Microsoft Intelligent Security Graph to evaluate files against global telemetry, blocking those that are new, rare, or unsigned, which directly matches the requirement to block executables based on prevalence, age, or trust level.

Answer

Block Office communication application from creating child processes

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block untrusted and unsigned processes that run from USB

Question 19

Your organization uses Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. You need to create a custom detection rule that triggers when a user receives a phishing email and then attempts to log in from a new location. Which approach should you use?

Accepted Answer

Use Advanced Hunting to create a custom detection rule. Advanced Hunting in Microsoft Defender XDR allows you to write Kusto Query Language (KQL) queries that correlate events across multiple data tables (e.g., EmailEvents, IdentityLogonEvents). You can then create a custom detection rule from that query, which will trigger an alert when a user receives a phishing email and subsequently logs in from a new location, enabling cross-domain correlation within Defender XDR.

Answer

Create a custom detection rule in Microsoft Defender for Endpoint

Answer

Use an automation rule in Microsoft Defender XDR

Answer

Create an analytics rule in Microsoft Sentinel

Question 20

Your organization uses Microsoft Purview and needs to prevent users from copying sensitive data to USB drives. Which solution should you implement?

Accepted Answer

Endpoint data loss prevention (DLP). Endpoint DLP is the correct solution because it extends data loss prevention policies to endpoints, enabling the detection and blocking of sensitive data being copied to removable USB drives. Unlike other controls, Endpoint DLP can monitor and restrict data exfiltration actions at the device level, such as copying files to USB media, based on the content's sensitivity classification.

Answer

Sensitivity labels with encryption

Answer

Insider Risk Management

Answer

Communication Compliance