SC-100 Practice Test 22 — 15 Questions

Question 1

Your organization uses Microsoft Purview Information Protection to label sensitive documents. You need to ensure that documents containing personally identifiable information (PII) are automatically labeled when saved in SharePoint Online. What should you configure?

Accepted Answer

Configure an auto-labeling policy for sensitivity labels targeting SharePoint.. Option C is correct because auto-labeling policies can scan content in SharePoint and apply labels automatically. Option A is wrong because sensitivity labels require manual application or client-side auto-labeling. Option B is wrong because retention labels are for retention, not sensitivity. Option D is wrong because DLP policies enforce actions but don't label.

Answer

Create a retention label with auto-labeling rule.

Answer

Publish a sensitivity label with auto-labeling for SharePoint.

Answer

Set up a DLP policy to detect PII and apply a label.

Question 2

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for ransomware attacks. Which action should you take?

Accepted Answer

Enable 'Automatic attack disruption' in the Microsoft 365 Defender portal. Automatic attack disruption is a feature of Microsoft Defender XDR that can be enabled to automatically contain attacks. It is configured in the Microsoft 365 Defender portal under Settings > Endpoints > Advanced features. The other options are not correct: disabling automated investigation reduces response, and the other portals are not for this setting.

Answer

Enable the 'Automatically investigate and respond to alerts' feature in Defender for Cloud Apps

Answer

Configure an automation rule in Microsoft Sentinel

Answer

Disable 'Automated investigation and response' in Defender for Endpoint

Question 3

You are designing a security operations solution for a multinational organization using Microsoft Sentinel. The organization has multiple Azure subscriptions, each with its own Log Analytics workspace. You need to centralize incident management while minimizing data egress costs. What should you recommend?

Accepted Answer

Use a single Log Analytics workspace for all subscriptions and configure Sentinel in that workspace.. Option C is correct because using a single workspace for all subscriptions centralizes data and incidents, and Microsoft Sentinel does not charge for cross-workspace querying within the same region. Option A is wrong because separate workspaces per region would not centralize incidents. Option B is wrong because a third-party SIEM adds complexity and cost. Option D is wrong because Azure Monitor cross-workspace queries are for analysis, not incident centralization.

Answer

Deploy a Sentinel workspace in each region and use cross-workspace views.

Answer

Export all logs to a third-party SIEM using Azure Event Hubs.

Answer

Configure Azure Monitor cross-workspace queries to correlate incidents.

Question 4

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. What does this policy accomplish?

Accepted Answer

Blocks all users when sign-in risk is high.. Option C is correct because the policy blocks all users when sign-in risk is high. Option A is wrong because it does not require MFA. Option B is wrong because it does not target specific apps. Option D is wrong because it blocks all users, not just external.

Answer

Requires MFA for high-risk sign-ins.

Answer

Blocks external users from high-risk sign-ins.

Answer

Blocks sign-ins from specific applications.

Question 5

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You need to create an analytics rule that generates an incident when a user is reported as compromised by Microsoft Defender for Identity. The rule should use the most efficient method to get this data. What should you use as the data source?

Accepted Answer

The SecurityAlert table with a filter for Defender for Identity.. Option B is correct because Defender for Identity alerts are ingested via the Microsoft 365 Defender connector and can be queried using the SecurityAlert table. Option A is incorrect because IdentityInfo does not contain alerts. Option C is incorrect because the Advanced Hunting schema is not directly available in Sentinel tables. Option D is incorrect because the OfficeActivity table is for audit logs, not security alerts.

Answer

The DeviceEvents table from Advanced Hunting.

Answer

The OfficeActivity table.

Answer

The IdentityInfo table.

Question 6

A company uses Microsoft Intune and wants to ensure that devices are compliant before accessing corporate resources. They create a Conditional Access policy that requires devices to be marked as compliant. However, some users report that they are blocked even though their device shows as compliant in Intune. What is the most likely cause?

Accepted Answer

The device is not registered in Microsoft Entra ID. Option B is correct because the device must be registered in Entra ID for the Conditional Access policy to evaluate its compliance status. Option A is incorrect because the policy is for compliant devices, not MFA. Option C is incorrect because the policy is for compliance, not app protection. Option D is incorrect because location is not mentioned.

Answer

The user's location is blocked by a location-based policy

Answer

The policy also requires MFA, and users haven't registered for MFA

Answer

The policy requires an app protection policy, which is not applied

Question 7

Your organization is designing a privileged access strategy using Microsoft Entra ID. Which TWO configurations should be part of the design to protect privileged accounts?

Accepted Answer

Require multi-factor authentication for all administrative roles via Conditional Access. Options A and C are correct. Option A: Conditional Access with MFA for admin roles reduces risk of credential theft. Option C: Privileged Identity Management (PIM) provides just-in-time access and approval workflows. Option B is wrong because security defaults enforce MFA for all users but lack granularity for privileged roles. Option D is wrong because self-service password reset is not specific to privileged accounts and does not protect against misuse. Option E is wrong because disabling MFA would weaken security.

Answer

Enable security defaults

Answer

Enable self-service password reset for admins

Answer

Disable multi-factor authentication for emergency admin accounts

Question 8

You need to design a security operations strategy for a hybrid environment using Microsoft Sentinel. Your environment includes on-premises servers and Azure VMs. Which data connector should you use to collect security events from both sources?

Accepted Answer

Windows Security Events via AMA connector. Option C is correct because the Windows Security Events via AMA connector works for both on-prem and Azure VMs. Option A is wrong because the Azure Activity log covers Azure resource operations, not security events. Option B is wrong because Syslog is for Linux. Option D is wrong because Office 365 is for cloud apps.

Answer

Azure Activity log connector

Answer

Office 365 connector

Answer

Syslog connector

Question 9

You are analyzing a custom detection rule in Microsoft 365 Defender. Based on the exhibit, what is a potential operational issue with this rule?

Accepted Answer

The threshold is too low, leading to alert fatigue.. Option D is correct because high severity with a low threshold (5) will generate many alerts. Option A is wrong because the query is valid. Option B is wrong because the severity is set to High. Option C is wrong because the query includes both powershell.exe and pwsh.exe.

Answer

The query syntax is invalid.

Answer

The severity should be Medium instead of High.

Answer

The rule does not cover PowerShell 7 (pwsh.exe).

Question 10

Your organization uses Microsoft Sentinel. You need to design a solution to detect and respond to threats across on-premises and cloud workloads. Which TWO components are essential for this? (Select two.)

Accepted Answer

Analytics rules. Data connectors ingest logs from various sources, and analytics rules detect threats. Playbooks automate response, but are not essential for detection. Workbooks visualize data, and UEBA enriches analytics but is not a separate essential component.

Answer

UEBA

Answer

Workbooks

Answer

Playbooks

Question 11

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to automatically create incidents in Sentinel for high-severity alerts from Defender XDR. You also want to suppress low-severity alerts to reduce noise. What should you configure?

Accepted Answer

Create a scheduled analytics rule that queries Defender XDR alerts with severity filter and creates incidents.. Option B is correct because you can create an analytics rule that filters by severity and maps alerts to incidents. Option A is wrong because automation rules can create incidents but are not the primary method for ingesting alerts. Option C is wrong because a playbook would be reactive. Option D is wrong because the incident creation rule is not a thing.

Answer

Configure the Microsoft Defender XDR connector to create incidents only for high severity.

Answer

Configure an automation rule to create incidents for all alerts.

Answer

Create a playbook that triggers on alerts and creates incidents.

Question 12

Your organization uses Microsoft Entra ID. You need to ensure that when a user's risk level is assessed as high by Identity Protection, the user is automatically blocked from signing in. The block should apply immediately. What should you configure?

Accepted Answer

Configure a Conditional Access policy that blocks access when sign-in risk is high.. Option A is correct because a Conditional Access policy with a session control can block access based on sign-in risk. Option B is incorrect because Identity Protection user risk policy can block sign-in, but Conditional Access is the more common method. Option C is incorrect because an access review does not block sign-ins. Option D is incorrect because MFA registration does not block based on risk.

Answer

Enable self-service password reset for high-risk users.

Answer

Create an access review to require re-certification of high-risk users.

Answer

Configure a user risk policy in Identity Protection to block sign-in.

Question 13

Your company uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a confirmed ransomware incident by isolating affected devices and blocking malicious IPs. What should you use?

Accepted Answer

Sentinel automation rules with playbooks. Option D is correct because Microsoft Sentinel automation rules can trigger playbooks (based on Azure Logic Apps) to perform actions like device isolation and IP blocking. Option A is wrong because Microsoft Defender for Cloud Apps is more focused on SaaS app security. Option B is wrong because Azure Policy is for compliance, not automated response. Option C is wrong because Microsoft Intune supports device management but would require additional orchestration.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 14

Your company is deploying Microsoft Defender XDR. You need to design a solution that uses advanced hunting to proactively search for threats. Which THREE data sources should be included in the advanced hunting schema to enable comprehensive threat hunting across endpoints, identities, and cloud apps?

Accepted Answer

CloudAppEvents. Options A, B, and D are correct because they represent key data sources in Defender XDR advanced hunting. Option A: IdentityInfo provides identity context. Option B: DeviceEvents captures endpoint activities. Option D: CloudAppEvents provides cloud app activity. Option C is wrong because EmailEvents is part of Defender for Office 365 but not a core advanced hunting table in Defender XDR; it is available in Microsoft 365 Defender advanced hunting but the question asks for core sources. Option E is wrong because AzureActivity is not part of Defender XDR schema; it is in Azure Monitor.

Answer

EmailEvents

Answer

AzureActivity

Question 15

Your organization uses Microsoft Defender for Endpoint (MDE) and wants to implement automated investigation and response (AIR) for ransomware. You need to ensure that when a suspicious file is detected, the investigation is automatically started and the file is contained. What should you configure?

Accepted Answer

Configure the automated investigation and response capabilities in MDE.. Option B is correct because AIR automates investigation and containment actions. Option A is wrong because attack surface reduction rules prevent but don't automate response. Option C is wrong because indicators of compromise are for blocking known threats. Option D is wrong because custom detections create alerts but don't automate response.

Answer

Create a custom detection rule in Microsoft 365 Defender.

Answer

Enable attack surface reduction rules.

Answer

Add the file hash to the indicators of compromise list.