SC-100 Practice Test 26 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. You need to design a solution that centralizes security alerts and automates remediation across all clouds. Which security operations capability should you prioritize?

Accepted Answer

Use Microsoft Sentinel as a single SIEM and SOAR platform with connectors for AWS and GCP. Option D is correct because Microsoft Sentinel provides a centralized SIEM and SOAR solution that ingests security alerts from multiple clouds and can automate remediation. Option A is wrong because Defender for Cloud does not natively ingest alerts from AWS/GCP into a single SIEM. Option B is wrong because Defender for Identity is focused on on-premises identity threats. Option C is wrong because Microsoft Purview is for data governance, not security operations.

Answer

Configure Microsoft Purview Compliance Manager for regulatory assessments

Answer

Enable Microsoft Defender for Cloud's multi-cloud connector to aggregate alerts

Answer

Deploy Microsoft Defender for Identity to monitor hybrid identities

Question 2

Your organization needs to meet compliance requirements for GDPR. You need to design a solution that uses Microsoft Purview to classify and protect personal data. Which TWO capabilities should you include?

Accepted Answer

Data Subject Requests (DSR) tool. Option A and Option D are correct. Data Classification in Purview helps identify personal data, and Data Subject Requests (DSR) tool helps respond to GDPR requests. Option B is wrong because Insider Risk Management is for insider threats, not GDPR. Option C is wrong because Communication Compliance is for communication monitoring. Option E is wrong because eDiscovery is for legal discovery, not GDPR-specific classification.

Answer

eDiscovery (Premium)

Answer

Insider Risk Management

Answer

Communication Compliance

Question 3

Your organization uses Microsoft Defender for Cloud to secure multi-cloud resources. You need to ensure that security recommendations are automatically remediated for non-compliant resources without manual intervention. What should you configure?

Accepted Answer

Use Quick Fix remediation for security recommendations and enable automation. Option D is correct because Quick Fix remediation combined with automation can auto-remediate recommendations. Option A is incorrect because Azure Policy can enforce but requires additional setup. Option B is incorrect because Defender for Cloud's automatic provisioning is for agents. Option C is incorrect because Secure Score does not remediate.

Answer

Azure Policy initiatives with remediation tasks

Answer

Set a Secure Score target and alert on changes

Answer

Enable automatic provisioning of Log Analytics agent

Question 4

Refer to the exhibit. You receive an alert from Microsoft Defender for Cloud Apps. You need to investigate this alert in Microsoft Sentinel. Which Microsoft Sentinel feature should you use to visualize the relationship between the user account and the IP address?

Accepted Answer

Use the Investigation graph to explore the entities involved.. Option B is correct because the investigation graph in Microsoft Sentinel provides a visual representation of entities and their relationships, which is ideal for understanding connections between a user and an IP address. Option A (workbook) is for dashboards. Option C (hunting query) is for proactive threat hunting. Option D (automation rule) is for automated responses.

Answer

Configure an automation rule to trigger a playbook.

Answer

Run a hunting query to search for similar alerts.

Answer

Create a new workbook to display the alert details.

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to design a solution that collects security events from Azure virtual machines and sends them to Microsoft Sentinel. The solution must minimize cost and management overhead. Which data connector should you use?

Accepted Answer

Windows Security Events via the Log Analytics agent (AMA). Option C is correct because the Azure Windows VM (or Linux VM) connector via the Log Analytics agent is the standard, cost-effective way to collect security events. Option A (Azure Activity) is for subscription-level logs. Option B (Defender for Cloud) requires additional licensing. Option D (Azure AD) is for identity logs.

Answer

Microsoft Defender for Cloud data connector

Answer

Azure Activity data connector

Answer

Microsoft Entra ID (Azure AD) data connector

Question 6

Your organization has a Microsoft 365 E5 subscription and wants to detect insider data exfiltration attempts. You need to design a solution that can identify users copying sensitive data to personal cloud storage services. Which Microsoft Purview capability should you use?

Accepted Answer

Insider Risk Management. Option A is correct because Insider Risk Management in Microsoft Purview is designed to detect insider data exfiltration scenarios, including copying data to personal cloud storage. Option B is wrong because Data Loss Prevention (DLP) prevents data from being shared but does not detect exfiltration attempts from user activities. Option C is wrong because Communication Compliance focuses on inappropriate communications. Option D is wrong because eDiscovery is for legal discovery.

Answer

Data Loss Prevention (DLP) policies

Answer

eDiscovery (Premium)

Answer

Communication Compliance

Question 7

Your organization, Fabrikam Inc., uses Microsoft Intune for device management and Microsoft Entra ID for identity. You need to design a solution to ensure that only compliant and healthy devices can access corporate resources. The solution must require that devices are either enrolled in Intune and compliant, or joined to Azure AD with a health attestation. Additionally, you need to block access from devices that are rooted or jailbroken. You have the following requirements: 1) Enforce conditional access policies to check device compliance and health. 2) Use Microsoft Defender for Endpoint integration for device health signals. 3) Provide a fallback option for unmanaged devices to access only web apps via browser with app protection policies. Which combination of actions should you take?

Accepted Answer

Configure conditional access policies: one requiring device compliance or Azure AD joined with health attestation, and another for unmanaged devices requiring app protection policies.. Option B is correct because it covers all requirements: conditional access policies for compliance/health, Defender for Endpoint integration for health signals, and app protection policies for unmanaged devices. Option A is incorrect because it uses MFA only, not device compliance. Option C is incorrect because it relies on device compliance only, not health attestation. Option D is incorrect because it uses location-based policy, which does not address device health.

Answer

Configure conditional access to require MFA for all devices, and use device filters to exclude non-compliant devices.

Answer

Configure conditional access to require device compliance, and enable device health attestation via Intune.

Answer

Configure conditional access to block access from unknown locations, and require device enrollment for all users.

Question 8

Your organization uses Microsoft Purview and Microsoft Sentinel. You need to design a solution that alerts the security team when a user tries to share a file labeled 'Highly Confidential' with an external email address. The alert should include the file name, user, and external recipient. Which two components should you use? (Choose TWO.)

Accepted Answer

Microsoft Sentinel analytics rule that queries DLP audit logs. Options B and D are correct because Microsoft Purview DLP can detect and alert on sharing of sensitive files, and Microsoft Sentinel can ingest those DLP alerts and provide a central interface for investigation. Option A (auto-labeling) applies labels but does not generate alerts. Option C (Information Protection) is for labeling, not monitoring. Option E (audit) logs events but does not generate proactive alerts.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Answer

Microsoft Purview auto-labeling policy

Question 9

Your organization is planning to use Microsoft Entra ID for identity management. You need to design a solution that enforces conditional access policies for sensitive applications while minimizing user friction. The solution must support offline access for mobile devices and require step-up authentication only when accessing high-risk data. What should you recommend?

Accepted Answer

Use Conditional Access session controls with app-enforced restrictions and grant controls for high-risk sign-ins. Option B is correct because session controls in Conditional Access allow for continuous access evaluation (CAE) and step-up authentication based on risk, while app-based conditional access provides offline access. Option A is wrong because device compliance policies do not support offline access natively. Option C is wrong because risk-based policies alone do not handle offline scenarios. Option D is wrong because identity protection requires online connectivity.

Answer

Implement Microsoft Entra ID Protection to automatically remediate risky users

Answer

Configure risk-based Conditional Access policies with user risk and sign-in risk

Answer

Require device compliance via Intune and block non-compliant devices

Question 10

Your organization uses Microsoft Defender for Cloud and Microsoft Sentinel. You need to design a solution that automates incident response for critical security alerts. Which THREE components should you include?

Accepted Answer

Playbooks built on Azure Logic Apps. Option B, Option C, and Option D are correct. Automation rules in Sentinel trigger playbooks (Azure Logic Apps) for incident response. Microsoft Teams can be used for communication during response. Option A is wrong because Conditional Access is for identity, not incident response automation. Option E is wrong because Microsoft Intune is for device management.

Answer

Microsoft Intune compliance policies

Answer

Conditional Access policies

Question 11

Refer to the exhibit. You are reviewing a conditional access policy in Microsoft Entra ID. The policy is enabled but users report they can still sign in from high-risk sessions. What is the most likely reason?

Accepted Answer

The grant control operator is set to 'OR' instead of 'AND' with multiple controls.. Option A is correct because the policy uses 'OR' for grant controls, meaning only one condition must be met. 'Block' is the only control, but risk levels must be evaluated. If risk levels are not computed in real-time, the policy may not trigger. Option B is incorrect because the policy includes guest users. Option C is incorrect because 'All' apps includes all. Option D is incorrect because state is enabled.

Answer

The policy is not applied to all cloud apps.

Answer

The policy is in report-only mode.

Answer

The policy excludes guest users by default.

Question 12

Your organization uses Microsoft Purview. You need to design a solution that discovers and classifies sensitive data across Microsoft 365 services. Which two services should you include in your data map? (Choose TWO.)

Accepted Answer

SharePoint Online. Options A and C are correct because Microsoft Purview Data Map can scan SharePoint Online and OneDrive for sensitive data. Option B (Azure SQL Database) is not a Microsoft 365 service. Option D (Azure Blob Storage) is not Microsoft 365. Option E (Power BI) is a Microsoft 365 service but is not typically scanned for sensitive data classification in the same way; however, it can be included, but the question asks for data across Microsoft 365 services, and SharePoint and OneDrive are the primary sources.

Answer

Power BI

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 13

Your organization is a multi-national corporation that uses Microsoft 365 E5 and Azure. You need to design a security operations center (SOC) to detect and respond to threats across identities, endpoints, and cloud apps. The SOC team will use a single pane of glass for incident management. Requirements: (1) Centralize alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, (2) Automate incident response playbooks, (3) Use advanced hunting across all data sources, (4) Integrate with external threat intelligence feeds, (5) Provide role-based access control for SOC analysts. Which Microsoft solution should you implement?

Accepted Answer

Microsoft Sentinel. Option B is correct because Microsoft Sentinel is a cloud-native SIEM/SOAR that ingests alerts from all Microsoft Defender products, supports automation playbooks, advanced hunting via KQL, threat intelligence connectors, and RBAC. Option A is wrong because Defender for Cloud is for cloud workload protection, not unified SIEM. Option C is wrong because Microsoft 365 Defender portal provides visibility but limited automation and external TI integration. Option D is wrong because Microsoft Purview is for data governance.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Cloud

Question 14

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy appears to block all legacy authentication. However, some users report that they can still access Exchange Online using Outlook 2010 (which uses basic authentication). What is the most likely reason the policy is not blocking these connections?

Accepted Answer

The policy is configured in 'report-only' mode. Option B is correct because the policy is in 'report-only' mode, which logs but does not block connections. The exhibit shows 'enabled' but not 'enabledForReportingButNotEnforced'. However, the question implies the policy is not blocking, so the most common reason is that it's in report-only mode. Option A is wrong because 'otherClients' covers Outlook 2010. Option C is wrong because the policy is enabled. Option D is wrong because there is no exclusion for specific users.

Answer

The policy excludes all users in the 'Global Administrators' group

Answer

The clientAppTypes condition does not include 'mobileAppsAndDesktopClients'

Answer

The policy state is 'disabled'

Question 15

Your organization uses Microsoft Sentinel as a SIEM. You need to design a solution to detect advanced persistent threats (APTs) by correlating data from multiple sources, including network logs, endpoint data, and threat intelligence feeds. The solution must use machine learning to identify anomalies and reduce false positives. Which analytics rule type should you configure?

Accepted Answer

Fusion. Option A is correct because Fusion uses ML to correlate alerts from multiple sources and detect multi-stage attacks, reducing false positives. Option B is wrong because Scheduled query rules are rule-based and do not use ML. Option C is wrong because Anomaly detection rules are for individual data source anomalies. Option D is wrong because ML Behavior Analytics is not an analytics rule type in Sentinel.

Answer

ML Behavior Analytics

Answer

Anomaly detection rules

Answer

Scheduled query rules