SC-100 Practice Test 39 — 15 Questions

Question 1

Your organization is implementing a Zero Trust network architecture in Azure. Which TWO principles are foundational to Zero Trust?

Accepted Answer

Verify explicitly. Option B, 'Verify explicitly,' is correct because Zero Trust requires that every access request be authenticated and authorized based on all available data points—user identity, device health, location, and workload—rather than granting implicit trust based on network location. Option C, 'Assume breach,' is correct because Zero Trust operates on the assumption that the environment is already compromised, so organizations must minimize blast radius through micro-segmentation, end-to-end encryption, and continuous monitoring to detect and respond to threats. These two principles, along with 'Use least privilege access,' form the three core Zero Trust principles as defined by Microsoft and NIST SP 800-207. Option A, 'Use network segmentation,' is a technique or implementation control that supports Zero Trust rather than a foundational principle itself. Option D, 'Rely on perimeter security,' contradicts Zero Trust, which explicitly rejects the castle-and-moat model of trusting everything inside the corporate firewall. Option E, 'Trust but verify,' is a traditional security adage that still implies initial trust, which is incompatible with Zero Trust's requirement to never trust implicitly.

Answer

Use network segmentation

Answer

Rely on perimeter security

Answer

Trust but verify

Question 2

Your organization is designing a Microsoft Sentinel solution to detect and respond to threats across multi-cloud environments (Azure, AWS, GCP). Which TWO components are essential for this design?

Accepted Answer

Data connectors for AWS and GCP. Option B is correct because Microsoft Sentinel ingests AWS and GCP telemetry through dedicated data connectors (for example, the AWS S3/CloudTrail connector and the GCP Pub/Sub connector), which are the mechanism that brings multi-cloud logs into the Sentinel workspace for correlation and detection. Option E is correct because analytics rules are the Sentinel detection logic that runs scheduled or near-real-time queries against the ingested multi-cloud data to generate incidents and alerts, which is the core of detecting threats across Azure, AWS, and GCP. Option A is not essential here because Azure Policy assignments govern resource compliance and configuration within Azure, not cross-cloud threat detection in Sentinel. Option C is not essential because Microsoft Defender for Cloud primarily provides CSPM/CWPP posture and workload protection for Azure, AWS, and GCP but is not the Sentinel component that ingests and detects on multi-cloud logs. Option D is not essential because Azure Automation accounts are used for runbook orchestration and task automation, not for the core ingestion and detection design of a multi-cloud Sentinel solution.

Answer

Azure Policy assignments

Answer

Microsoft Defender for Cloud

Answer

Azure Automation accounts

Question 3

Which THREE components are essential for implementing a successful SIEM strategy using Microsoft Sentinel?

Accepted Answer

Automation rules. Data connectors (E) are essential because Microsoft Sentinel must first ingest telemetry from sources such as Microsoft 365, Azure, AWS, and third-party systems via connectors like the Azure Activity or Syslog connector before any detection or response can occur. Analytics rules (C) are essential because they correlate the ingested events and generate alerts/incidents based on scheduled, NRT, or Microsoft security rules, forming the core detection engine of the SIEM. Automation rules (A) are essential because they provide the orchestration and response layer, allowing Sentinel to automatically triage, assign, tag, or trigger playbooks on incidents to reduce response time. Workbooks (B) are valuable for visualization and reporting but are not required for the core detect-and-respond SIEM pipeline, and watchlists (D) are an optional enrichment feature for importing reference data such as IPs or VIP users, not a foundational component of a Sentinel SIEM strategy.

Answer

Workbooks

Answer

Watchlists

Question 4

Which TWO of the following are benefits of using Microsoft Defender XDR (Extended Detection and Response)? (Choose two.)

Accepted Answer

Cross-domain correlation of alerts. Option C is correct because Microsoft Defender XDR is specifically designed to correlate signals and alerts across multiple security domains — endpoints (Defender for Endpoint), identities (Defender for Identity), email and collaboration (Defender for Office 365), and cloud apps (Defender for Cloud Apps) — into unified incidents, which is the core value of an XDR platform. Option E is correct because Defender XDR includes automated investigation and response (AIR) capabilities that use playbooks and automation to investigate alerts, remediate threats, and reduce analyst workload. Option A is not correct because vulnerability scanning of VMs is a function of Microsoft Defender for Cloud (or Defender Vulnerability Management), not the defining benefit of Defender XDR. Option B is not correct because compliance assessments are provided by Microsoft Purview Compliance Manager and Microsoft Defender for Cloud regulatory compliance dashboards, not by Defender XDR itself. Option D is not correct because Defender XDR is a detection and response platform and does not replace a network firewall, which remains necessary for perimeter and network-layer filtering.

Answer

Scans for vulnerabilities in VMs

Answer

Provides compliance assessments

Answer

Replaces the need for a firewall

Question 5

You are designing a solution to protect Microsoft 365 data from insider threats. Which TWO Microsoft Purview features should you use?

Accepted Answer

Microsoft Purview Insider Risk Management. Microsoft Purview Insider Risk Management (A) is correct because it is the purpose-built solution for detecting and remediating insider threat activity, using machine learning and behavioral signals (such as mass downloads, exfiltration to personal cloud storage, or unusual file access) to surface risky user activity and trigger investigation workflows. Microsoft Purview Data Loss Prevention (B) is also correct because DLP policies can identify and block sensitive information (for example, credit card numbers, HIPAA data, or custom sensitive info types) from being shared inappropriately across Exchange Online, SharePoint, OneDrive, Teams, and endpoint devices, directly mitigating insider exfiltration scenarios. Communication Compliance (C) is not the right fit here because it focuses on monitoring and reviewing potentially inappropriate or policy-violating communications (harassment, regulatory compliance in chats/email), not on detecting or preventing data exfiltration by insiders. Audit (Premium) (D) provides long-term retention and high-value forensic events for investigations, but it is a logging/investigation capability rather than a protective control against insider threats. eDiscovery (Premium) (E) is designed for legal hold, identification, collection, and review of content for litigation or investigations, not for proactively protecting data from insider risk.

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Audit (Premium)

Answer

Microsoft Purview eDiscovery (Premium)

Question 6

Which THREE components are included in Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR is the unified extended detection and response suite that correlates signals across Microsoft's first-party security workloads, and its core components include Microsoft Defender for Office 365 (A), which protects email, collaboration tools, and Office apps against phishing, malware, and business email compromise; Microsoft Defender for Identity (C), which monitors on-premises Active Directory Domain Services signals via domain controllers to detect identity-based attacks like lateral movement and credential theft; and Microsoft Defender for Endpoint (D), which provides endpoint detection and response, threat and vulnerability management, and automated investigation on devices. These three feed alerts and incidents into the Defender XDR portal alongside Defender for Cloud Apps to enable cross-domain correlation. Microsoft Defender for IoT (B) is a separate offering for operational technology and IoT/OT environments, and Microsoft Defender for Cloud (E) is a cloud security posture management and workload protection solution (CSPM/CWPP) that, while integrated with the Defender portal, is not one of the three named Defender XDR components tested here.

Answer

Microsoft Defender for IoT

Answer

Microsoft Defender for Cloud

Question 7

Your organization is designing a secure access solution for a partner company that needs to access specific SharePoint Online sites. You need to implement Microsoft Entra ID B2B collaboration. Which THREE configurations are essential for a secure B2B collaboration setup?

Accepted Answer

Configure cross-tenant access settings in Microsoft Entra ID. Option A is correct because cross-tenant access settings in Microsoft Entra ID let you control inbound and outbound B2B collaboration with the partner tenant, including trust settings for MFA and device claims, which is essential for governing partner access to specific SharePoint Online sites. Option B is correct because enabling MFA for guest users strengthens authentication and reduces the risk of compromised credentials being used to access shared SharePoint resources. Option E is correct because Conditional Access policies scoped to guest users enforce sign-in controls such as MFA, compliant devices, and location restrictions, which are critical for securing B2B access. Option C is not essential here because B2B direct connect is designed for Teams shared channels and does not apply to SharePoint site access in this scenario. Option D is incorrect because allowing all external domains without restrictions removes governance and exposes the tenant to unauthorized invitations and access.

Answer

Use B2B direct connect for SharePoint site access

Answer

Allow all external domains to invite users without restrictions

Question 8

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to design a policy that prevents users from sharing credit card numbers via email. Which THREE components are required to build this DLP policy?

Accepted Answer

A rule that includes a sensitive info type for credit card numbers. Option B is correct because a DLP rule must reference a sensitive information type (SIT), such as the built-in Credit Card Number SIT, to detect the credit card data the policy is meant to protect. Option D is correct because the policy must be scoped to the Exchange Online workload so that email traffic is actually evaluated by the DLP engine. Option E is correct because a rule needs an action, such as blocking the email and notifying the sender or admin, to enforce protection once credit card numbers are detected. Option A is not required because a policy tip is an optional user-notification enhancement, not a mandatory component for the policy to function. Option C is not required because trainable classifiers are used for content that is hard to identify with patterns, whereas credit card numbers are detected by a built-in sensitive information type.

Answer

A policy tip to warn users before sending

Answer

A trainable classifier for financial data

Question 9

A company is implementing Microsoft Defender for Cloud to protect their Azure environment. Which TWO of the following are security best practices that should be enabled? (Choose two.)

Accepted Answer

Cloud Security Posture Management (CSPM). Option A, Cloud Security Posture Management (CSPM), is correct because Defender for Cloud's foundational CSPM continuously assesses Azure resources against security benchmarks like Microsoft Cloud Security Benchmark, surfaces secure score recommendations, and detects misconfigurations and external attack surface risks — the core best practice for hardening an Azure environment. Option B, Microsoft Defender for Cloud workload protection, is correct because enabling the Defender plans (e.g., Defender for Servers, Storage, SQL, Containers, App Service, Key Vault) adds threat detection, vulnerability assessment, and advanced protection for running workloads, which is the recommended complement to CSPM. Option C, Microsoft Defender for Office 365, is not part of Defender for Cloud's Azure protection scope; it protects Exchange Online, SharePoint, Teams, and email against phishing and malware. Option D, Microsoft Defender for Endpoint onboarding, is a separate endpoint security product (though Defender for Servers can auto-provision it), not a Defender for Cloud best-practice toggle itself. Option E, Microsoft Sentinel integration, is an optional SIEM/SOAR data-connector scenario for centralized detection and response, not a required Defender for Cloud security best practice.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint onboarding

Answer

Microsoft Sentinel integration

Question 10

Which TWO are best practices for designing a Microsoft 365 Defender (XDR) deployment to ensure optimal detection and response?

Accepted Answer

Configure automated investigation and response for common incident types. Option B is correct because configuring automated investigation and response (AIR) for common incident types lets Microsoft 365 Defender automatically investigate and remediate recurring, well-understood threats, which reduces analyst workload and speeds response so human effort can focus on complex attacks. Option D is correct because XDR detection quality depends on ingesting all supported signal sources (endpoint, identity, email, cloud apps, and other connectors) and having the corresponding licenses enabled, since missing telemetry or unlicensed workloads create blind spots that degrade correlation and incident detection. Option A is not a best practice because deploying Defender for Endpoint on unsupported operating systems with limited functionality provides incomplete telemetry and unreliable protection, undermining XDR detection rather than optimizing it. Option C is not a best practice because relying solely on manual alert triage does not scale and increases the risk of missing complex or high-volume attacks that automation and correlation are designed to catch. Option E is not a best practice because configuring workloads in silo mode prevents cross-domain signal correlation, which is the core value of Microsoft 365 Defender XDR and would increase, not reduce, false positives and missed detections.

Answer

Deploy Defender for Endpoint on unsupported operating systems with limited functionality

Answer

Rely solely on manual alert triage to avoid missing complex attacks

Answer

Configure each workload (Endpoint, Identity, etc.) in SILO mode to avoid false positives

Question 11

Which THREE are components of Microsoft's Zero Trust model?

Accepted Answer

Data. Microsoft's Zero Trust model is built on three foundational principles—verify explicitly, use least privilege access, and assume breach—and it organizes its architecture around six core components: identities, devices (endpoints), applications, data, infrastructure, and networks. Option A (Data) is correct because data is one of those six pillars, protected through classification, labeling, and encryption so that access is granted based on sensitivity and policy. Option D (Identities) is correct because identities are the primary control plane in Zero Trust, verified with strong authentication (such as MFA and conditional access) before any resource is reached. Option E (Endpoints) is correct because devices/endpoints are a core component, validated for health and compliance before being trusted to access corporate resources. Option B (Assume breach) is not a component but one of the three guiding principles of Zero Trust, and Option C (Microsoft Defender for Cloud) is a specific product/CNAPP offering rather than a structural component of the model.

Answer

Assume breach

Answer

Microsoft Defender for Cloud

Question 12

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a unified security operations platform. Which THREE capabilities should you enable?

Accepted Answer

Microsoft Defender XDR incident integration with Sentinel. Option C is correct because integrating Microsoft Defender XDR incidents with Microsoft Sentinel streams correlated alerts and incidents from Defender XDR products (Defender for Endpoint, Identity, Office 365, Cloud Apps) into Sentinel, enabling a single incident queue and unified investigation across the SOC. Option D is correct because Microsoft Sentinel provides the cloud-native SIEM layer—log ingestion via data connectors, analytics rules, and KQL-based hunting—that serves as the central platform for the unified security operations design. Option E is correct because Sentinel UEBA builds behavioral baselines and entity pages (users, hosts, IPs) that surface anomalous activity and enrich incidents, which is essential for detecting threats that static rules miss in a unified SOC. Option A is not correct here because Azure Policy governs resource compliance and configuration, not security operations incident detection or response. Option B is not correct because Microsoft Purview Information Protection focuses on data classification, labeling, and DLP, which is a data-governance capability rather than a SIEM/XDR operations capability.

Answer

Azure Policy for security controls

Answer

Microsoft Purview Information Protection

Question 13

Which TWO components are required to enable Microsoft Sentinel to ingest data from Amazon Web Services (AWS) CloudTrail?

Accepted Answer

An AWS S3 bucket to store CloudTrail logs.. Microsoft Sentinel's AWS CloudTrail connector uses a polling-based architecture in which CloudTrail delivers its log files to an Amazon S3 bucket, so option B (an AWS S3 bucket to store CloudTrail logs) is required as the source location that Sentinel reads from. To know when new log objects arrive, the connector relies on Amazon SQS notifications from that S3 bucket, making option D (an AWS SQS queue to trigger ingestion) the second required component, since the SQS queue signals the connector to pull newly delivered CloudTrail files. Option A is not required because the connector runs as a built-in data connector in Microsoft Sentinel rather than a customer-deployed Azure Function. Option C is not required because no AWS Lambda function is used in the CloudTrail ingestion path. Option E is not required because Event Hubs is used for other connectors (such as CEF or syslog-based sources), not for the AWS CloudTrail S3/SQS polling connector.

Answer

An Azure Function to pull logs from AWS.

Answer

An AWS Lambda function to process logs.

Answer

An Azure Event Hubs namespace to receive logs.

Question 14

An organization uses Microsoft Defender XDR to detect and respond to threats. Which THREE data sources does Defender XDR ingest? (Choose three.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender XDR is the unified extended detection and response platform that correlates signals from Microsoft's first-party security workloads. Option A, Microsoft Defender for Identity, is correct because it feeds identity-based signals (domain controller sensors, AD FS, Entra ID) into Defender XDR for detecting identity threats like lateral movement and pass-the-hash. Option B, Microsoft Defender for Endpoint, is correct because it supplies endpoint telemetry (device alerts, file/process events) that Defender XDR correlates into incidents. Option D, Microsoft Defender for Office 365, is correct because it contributes email and collaboration signals (phishing, malicious attachments/URLs) to the unified incident queue. Option C, Microsoft Sentinel, is not a native Defender XDR data source; it is a separate SIEM/SOAR that can ingest Defender XDR incidents, not the reverse. Option E, Microsoft Intune, is a device management service and is not one of the Defender XDR native signal sources, even though it integrates with Defender for Endpoint for compliance and onboarding.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 15

Which TWO of the following are components of Microsoft Defender XDR (Extended Detection and Response)?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR is the unified extended detection and response suite that natively correlates signals across Microsoft's first-party security workloads, and Microsoft Defender for Endpoint (B) is a core component, providing endpoint detection and response (EDR), attack surface reduction, and automated investigation and remediation for devices. Microsoft Defender for Office 365 (C) is likewise a core component, delivering protection and detection for email, collaboration tools, and phishing/URL detonation signals that feed into the XDR incident graph. By contrast, Microsoft Sentinel (A) is a standalone cloud-native SIEM/SOAR platform that, while it can integrate with Defender XDR, is not itself one of its components. Microsoft Intune (D) is a mobile device management (MDM) and endpoint management service, and Microsoft Purview (E) is a data governance, compliance, and information-protection suite — neither is a Defender XDR component.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Microsoft Purview