SC-100 Practice Test 23 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel to centralize security events. You need to ensure that alerts from Microsoft Defender for Cloud are automatically ingested into Sentinel. Which data connector should you enable?

Accepted Answer

Microsoft Defender for Cloud connector. The Microsoft Defender for Cloud connector (formerly Azure Security Center) is specifically designed to ingest alerts and recommendations from Defender for Cloud into Sentinel. The other options are unrelated: Office 365 connector ingests Office logs, Azure Activity logs track Azure resource operations, and DNS connector ingests DNS queries.

Answer

DNS connector

Answer

Office 365 connector

Answer

Azure Activity connector

Question 2

Your organization is implementing Microsoft Entra ID governance. Which TWO features are part of Microsoft Entra ID Governance? (Select two.)

Accepted Answer

Entitlement management. Entitlement management and access reviews are core features of Entra ID Governance. Conditional Access is an identity protection feature, Privileged Identity Management (PIM) is part of Identity Governance, but the question asks for two of the governance features. Entitlement management and access reviews are correct. PIM is also governance, but the question limits to two. Authentication methods policy is not governance.

Answer

Privileged Identity Management

Answer

Authentication methods policy

Answer

Conditional Access

Question 3

Your organization uses Microsoft 365 and wants to protect against phishing attacks. Which TWO configurations should you recommend?

Accepted Answer

Enable anti-spoofing protection in Exchange Online Protection.. Option A is correct because Safe Links and Safe Attachments in Defender for Office 365 protect against malicious links and attachments. Option C is correct because anti-spoofing protection in Exchange Online Protection helps prevent phishing. Option B is wrong because DMARC is for email authentication, not phishing protection. Option D is wrong because MFA is for authentication, not phishing. Option E is wrong because DLP is for data protection.

Answer

Configure DMARC policy to reject spoofed emails.

Answer

Require MFA for all external email access.

Answer

Configure DLP policies to detect sensitive data in email.

Question 4

Refer to the exhibit. You have deployed the automation shown in the exhibit in Microsoft Defender for Cloud. The automation triggers a Logic App when a high-severity alert is generated. Users report that the Logic App is not being triggered for some high-severity alerts. What is the most likely cause?

Accepted Answer

Some high-severity alerts are generated from a different event source not included in the 'sources' array.. Option B is correct because the automation is configured to trigger on 'Alerts' source, but Defender for Cloud also generates 'RegulatoryComplianceAssessment' and other sources. Some high-severity alerts may come from a different event source that is not included. Option A is incorrect because the event source is 'Alerts', not 'SecurityPolicies'. Option C is incorrect because severity value is correct. Option D is incorrect because the trigger condition is correct.

Answer

The trigger condition uses 'Equals' instead of 'Contains' for severity.

Answer

The Logic App resource ID is incorrect.

Answer

The automation is configured to trigger on 'Alerts' but should be 'SecurityPolicies'.

Question 5

Your organization needs to meet regulatory requirements that mandate keeping security audit logs for at least seven years. Which Microsoft Sentinel feature should you configure to comply with this requirement?

Accepted Answer

Adjust the data retention settings in the Log Analytics workspace used by Microsoft Sentinel.. Option B is correct because retention settings in the Log Analytics workspace allow you to specify how long data is kept, up to seven years (or longer with archive). Option A (data connectors) are for ingestion, not retention. Option C (workbooks) are for visualization. Option D (playbooks) are for automation.

Answer

Configure data connectors to collect logs from all sources.

Answer

Develop a playbook to export logs to Azure Blob Storage.

Answer

Create a workbook to archive logs to a storage account.

Question 6

Your organization wants to use Microsoft Defender XDR to automatically investigate and respond to alerts. You need to ensure that the solution can autonomously remediate confirmed threats on endpoints, such as quarantining files and isolating devices. What should you enable?

Accepted Answer

Microsoft Defender for Endpoint. Option B is correct because Microsoft Defender for Endpoint includes automated investigation and remediation capabilities that can quarantine files and isolate devices. Option A is wrong because Microsoft Defender for Office 365 focuses on email and collaboration threats. Option C is wrong because Microsoft Defender for Cloud Apps is for SaaS app security. Option D is wrong because Microsoft Defender for Identity is for on-premises AD threats.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Question 7

Your organization deploys Microsoft Sentinel and wants to automatically respond to phishing emails reported by users. You need to recommend a solution that creates an incident in Sentinel and blocks the email sender in Exchange Online. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Option A is correct because automation rules in Microsoft Sentinel can trigger playbooks when an incident is created. Option B is wrong because analytics rules create incidents from data, not from existing incidents. Option C is wrong because watchlists are for reference data, not automation. Option D is wrong because UEBA is for user behavior analytics.

Answer

Use a watchlist to store known phishing senders.

Answer

Enable UEBA to detect anomalous email behavior.

Answer

Create an analytics rule that queries user-reported phishing data.

Question 8

Your company uses Microsoft Sentinel to manage security incidents. You need to design a solution that automatically triages low-severity incidents and enriches them with threat intelligence. Which THREE capabilities would you include? (Choose three.)

Accepted Answer

Playbooks to perform enrichment actions like querying threat intelligence.. Option A is correct because automation rules can take actions on incident creation. Option B is correct because playbooks can run complex workflows. Option C is correct because watchlists can be used for enrichment data. Option D is wrong because analytics rules create incidents, not triage. Option E is wrong because hunting queries are for proactive hunting, not triage.

Answer

Advanced hunting queries to investigate incidents.

Answer

Analytics rules to generate alerts for low-severity incidents.

Question 9

Your organization uses Microsoft Purview to protect sensitive data. You need to create a sensitivity label that automatically encrypts documents containing credit card numbers when they are shared externally. Which configuration should you use?

Accepted Answer

Create an auto-labeling policy that applies a label with encryption for external sharing. Auto-labeling in Purview can be configured to apply a sensitivity label based on sensitive info types like credit card numbers. The label should have encryption enabled for external sharing. The other options describe different scenarios: manual labeling, default labeling, or classification without encryption.

Answer

Create a trainable classifier to detect credit cards

Answer

Create a default label policy for SharePoint

Answer

Create a manual sensitivity label that users apply

Question 10

Your organization is planning to migrate from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can use the same passwords for both on-premises and cloud resources without having to change them. What should you implement?

Accepted Answer

Microsoft Entra Connect password hash synchronization.. Option B is correct because password hash synchronization (PHS) syncs password hashes to Entra ID, allowing users to use the same passwords. Option A is wrong because pass-through authentication does not sync passwords. Option C is wrong because federation does not sync passwords. Option D is wrong because AD FS is for federation, not password sync.

Answer

Microsoft Entra Cloud Sync.

Answer

Federation with on-premises AD FS.

Answer

Microsoft Entra Connect pass-through authentication.

Question 11

Refer to the exhibit. You are reviewing a Microsoft Purview Data Map resource pattern for scanning. What is this pattern intended to do?

Accepted Answer

Automatically apply sensitivity labels to resources matching the pattern.. Option C is correct because the pattern targets all *.onmicrosoft.com resources in Global and USGov regions and applies sensitivity labels. Option A is wrong because it applies labels, not just scans. Option B is wrong because it does not block access. Option D is wrong because it does not enforce retention.

Answer

Scan all resources in the onmicrosoft.com domain for classification.

Answer

Block access to resources in USGov regions.

Answer

Enforce retention policies on scanned resources.

Question 12

Your organization uses Microsoft Defender for Cloud Apps. You need to identify users who are downloading large amounts of data from a sanctioned cloud app in a short period. What should you configure?

Accepted Answer

Create an anomaly detection policy for impossible travel or unusual activity.. Option B is correct because anomaly detection policies in Defender for Cloud Apps can detect unusual download activity. Option A is incorrect because file policies are for specific file attributes, not volume. Option C is incorrect because app permissions are about OAuth apps. Option D is incorrect because activity policies can be used, but anomaly detection is more specific for this scenario.

Answer

Create an app permission policy to block downloads.

Answer

Create an activity policy to monitor downloads.

Answer

Create a file policy to detect mass download.

Question 13

Your organization uses Microsoft Intune to manage devices. You need to design a compliance policy that requires devices to have a minimum OS version and be encrypted. Which policy type should you use?

Accepted Answer

Create a device compliance policy in Microsoft Intune.. Option A is correct because compliance policies in Intune define the rules devices must meet to be considered compliant, such as minimum OS version and encryption. Option B (configuration policy) is for settings like Wi-Fi. Option C (conditional access) is a separate Entra ID feature. Option D (app protection policy) is for app-level data protection.

Answer

Create a device configuration profile in Microsoft Intune.

Answer

Create a Conditional Access policy in Microsoft Entra ID.

Answer

Create an app protection policy in Microsoft Intune.

Question 14

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to design a solution that automatically remediates non-compliant devices by running a remediation script. Which Intune component should you use?

Accepted Answer

Remediation policy in Microsoft Intune. Option D is correct because Intune remediation policies (part of device management) allow you to automatically run scripts to fix non-compliant settings. Option A (compliance policy) sets rules but does not run scripts. Option B (configuration profile) deploys settings. Option C (app protection policy) is for app data.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 15

Your company uses Microsoft Intune to manage corporate devices. You need to design a compliance policy that requires devices to have a minimum OS version, be encrypted, and not be jailbroken or rooted. Additionally, you want to automatically block non-compliant devices from accessing corporate email. What should you configure?

Accepted Answer

Intune compliance policies and Conditional Access. Option C is correct because Intune compliance policies define device requirements (OS version, encryption, jailbreak status), and Conditional Access policies can block access to corporate resources like email for non-compliant devices. Option A is wrong because configuration profiles set settings but do not enforce access control. Option B is wrong because device enrollment restrictions limit which devices can enroll, not access after enrollment. Option D is wrong because app protection policies protect data at the app level, not device-level compliance.

Answer

Device configuration profiles and Azure AD join

Answer

App protection policies and Microsoft Defender for Endpoint

Answer

Device enrollment restrictions