SC-100 Practice Test 40 — 15 Questions

Question 1

Your organization uses Microsoft Purview to comply with regulatory requirements. Which TWO features should you use to manage data retention and deletion?

Accepted Answer

Data lifecycle management policies (retention policies).. Data lifecycle management policies (retention policies) (A) are correct because they let you centrally define how long content is kept and when it is deleted across Exchange, SharePoint, OneDrive, Teams, and other workloads, satisfying regulatory retention and deletion requirements. Records management (retention labels and disposition) (C) is also correct because it uses retention labels with file plan descriptors, event-based retention, and disposition review to declare items as records and control their deletion with proof of disposition. Sensitivity labels (B) are for classification and protection (encryption, marking, access control), not for retention or deletion timing. Data Loss Prevention (D) policies detect and block risky sharing of sensitive data but do not govern retention periods or deletion. Trainable classifiers (E) identify content types to support classification and labeling, but they do not themselves manage retention or deletion.

Answer

Sensitivity labels.

Answer

Data Loss Prevention (DLP) policies.

Answer

Trainable classifiers.

Question 2

Which TWO Microsoft Purview solutions should you use to protect sensitive data in Microsoft 365? (Choose two.)

Accepted Answer

Sensitivity labels and policies.. Sensitivity labels and policies (C) are correct because they apply persistent protection to content by classifying data and enforcing encryption, content marking, and usage restrictions that travel with the file or email across Microsoft 365 workloads. Data Loss Prevention (DLP) policies (E) are correct because they detect sensitive information types and take protective actions such as blocking, warning, or encrypting data when it is shared inappropriately in Exchange Online, SharePoint, OneDrive, and Teams. Audit (A) is not a protection solution; it records and searches user and admin activity for investigation and compliance reporting. Insider Risk Management (B) focuses on detecting and remediating risky user behavior rather than directly protecting sensitive data. eDiscovery (D) is used to identify, preserve, collect, and review content for legal or investigative purposes, not to enforce data protection.

Answer

Microsoft Purview Audit.

Answer

Insider Risk Management.

Answer

Microsoft Purview eDiscovery.

Question 3

Your organization deploys Microsoft Sentinel and wants to automatically respond to phishing emails reported by users. You need to recommend a solution that creates an incident in Sentinel and blocks the email sender in Exchange Online. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Microsoft Sentinel automation rules trigger playbooks (Logic Apps) in response to incident creation. A playbook can call the Exchange Online connector to block the sender and can also update the Sentinel incident, providing the automated response the scenario requires. This is the standard SOAR pattern in Sentinel.

Answer

Use a watchlist to store known phishing senders.

Answer

Enable UEBA to detect anomalous email behavior.

Answer

Create an analytics rule that queries user-reported phishing data.

Question 4

Your organization uses Microsoft Entra ID and plans to implement a Zero Trust security model. You need to ensure that all access requests to corporate applications are continuously evaluated based on user risk, device compliance, and location. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it enables real-time policy evaluation of access requests based on signals such as user risk (from Identity Protection), device compliance (via Microsoft Intune), and location (IP address ranges or named locations). This aligns directly with the Zero Trust principle of 'never trust, always verify' by continuously re-evaluating each access attempt rather than relying on static permissions.

Answer

Identity Governance

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection

Question 5

Your organization plans to use Microsoft Defender for Cloud to secure Azure resources. The security team wants to continuously assess compliance against the CIS Azure Foundations Benchmark. What should you do?

Accepted Answer

Enable the CIS Azure Foundations Benchmark in Defender for Cloud regulatory compliance dashboard. Microsoft Defender for Cloud's regulatory compliance dashboard includes built-in support for the CIS Azure Foundations Benchmark. By enabling this standard in the dashboard, Defender for Cloud continuously assesses your Azure resources against all CIS controls, providing automated compliance scores and remediation recommendations without requiring custom definitions or manual policy assignments.

Answer

Create a custom Azure Blueprint for CIS

Answer

Deploy Azure Security Center (legacy)

Answer

Assign Azure Policy for all CIS controls manually

Question 6

You are designing a security solution for an Azure Kubernetes Service (AKS) cluster. You need to ensure that only authorized images from a specific container registry can be deployed. Which Azure Policy definition should you use?

Accepted Answer

Kubernetes cluster containers should only use allowed images. The Azure Policy built-in definition 'Kubernetes cluster containers should only use allowed images' enforces a constraint on the container images deployed in an AKS cluster. This policy uses an Open Policy Agent (OPA) constraint to validate that every container's image reference matches a specified list of allowed registries or image patterns, ensuring only authorized images from a specific container registry can be deployed.

Answer

Kubernetes cluster should be accessible only over HTTPS

Answer

Kubernetes cluster should use internal load balancers

Answer

Kubernetes cluster should not allow privileged containers

Question 7

A company uses Microsoft Sentinel and wants to use a built-in connector to ingest logs from Amazon Web Services (AWS). Which connector should they use?

Accepted Answer

Amazon Web Services S3 connector. The Amazon Web Services (AWS) S3 connector is the correct built-in connector in Microsoft Sentinel for ingesting logs from AWS. It works by configuring AWS to send logs (such as CloudTrail, VPC Flow Logs, or GuardDuty findings) to an S3 bucket, which Sentinel then polls via the S3 REST API using an IAM role for secure, cross-account access. This is the native, supported method for log ingestion from AWS into Sentinel.

Answer

ServiceNow connector

Answer

Azure Policy for AWS

Answer

Office 365 connector

Question 8

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a specific minimum OS version can access corporate resources. Which configuration should you use?

Accepted Answer

Device compliance policy with minimum OS version rule. A device compliance policy with a minimum OS version rule is the correct choice because Intune compliance policies evaluate device attributes—including OS version—against defined rules before granting access to corporate resources. When a device fails the minimum OS version check, Conditional Access blocks access until the device is updated or remediated, ensuring only compliant devices can connect.

Answer

Device configuration profile

Answer

Enrollment restrictions

Answer

App protection policy

Question 9

Your company, Lucerne Publishing, is migrating its on-premises SQL Server databases to Azure SQL Managed Instance. The databases contain sensitive customer data subject to GDPR. You need to design a security solution that includes: (1) Always Encrypted for sensitive columns, (2) dynamic data masking for non-privileged users, (3) auditing of all data access, and (4) encryption at rest using customer-managed keys stored in Azure Key Vault. Which of the following configurations should you implement?

Accepted Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable Azure SQL auditing to a Log Analytics workspace, and enable TDE with a customer-managed key stored in Azure Key Vault.. The correct configuration must satisfy all four requirements: Always Encrypted for sensitive columns, dynamic data masking for non-privileged users, auditing of all data access, and encryption at rest with customer-managed keys in Azure Key Vault. Option D meets all four by enabling Azure SQL auditing to a Log Analytics workspace and TDE with a customer-managed key stored in Azure Key Vault, alongside Always Encrypted and dynamic data masking.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable auditing via Azure Policy, and enable TDE with a customer-managed key stored in Azure Key Vault.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, disable TDE to improve performance, and use row-level security to restrict access.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable SQL Server auditing to Azure Blob Storage, and enable Transparent Data Encryption (TDE) with a service-managed key.

Question 10

Your organization uses Microsoft Sentinel for security operations. The SOC team wants to automatically disable a compromised user account in Microsoft Entra ID when a high-severity alert is generated. Which automation method should you use?

Accepted Answer

An automation rule with a playbook. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when a high-severity alert fires. The playbook can then execute an action to disable the user account in Microsoft Entra ID via the Microsoft Graph API. This is the correct method because it provides the necessary integration between Sentinel alerts and Entra ID identity remediation.

Answer

A workbook

Answer

A KQL query in a hunting rule

Answer

An analytics rule

Question 11

A security architect is designing a solution to detect and respond to advanced threats across email, endpoints, and identities. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct solution because it provides unified pre- and post-breach detection, investigation, and response across email, endpoints, and identities. It correlates signals from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single incident queue, enabling automated remediation of advanced multi-vector attacks.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 12

Your company uses Microsoft Defender for Endpoint (MDE) and wants to integrate threat intelligence from an external source to improve detection. The security team needs to ingest custom indicators of compromise (IOCs) into MDE. Which feature should they use?

Accepted Answer

Custom indicators (IOCs). The Custom Indicators (IOCs) feature in Microsoft Defender for Endpoint allows security teams to manually ingest and manage threat intelligence from external sources, such as IP addresses, URLs, domains, or file hashes. These indicators are then used by MDE to create or block alerts, enabling tailored detection beyond built-in threat intelligence feeds.

Answer

Advanced Hunting

Answer

Threat Analytics

Answer

Automated investigation and response

Question 13

A company uses Microsoft Defender for Endpoint (MDE) and needs to ensure that all devices report their security configuration to Microsoft Defender XDR. Which setting should they verify?

Accepted Answer

Devices are onboarded to Microsoft Defender XDR. Devices must be onboarded to Microsoft Defender XDR to report their security configuration. Onboarding registers the device with the Defender for Endpoint service, enabling the collection and forwarding of security telemetry to the Microsoft 365 Defender portal. Without onboarding, the device cannot communicate its security state, regardless of other integrations.

Answer

Devices are enrolled in Microsoft Intune

Answer

Microsoft Sentinel is connected to Defender for Endpoint

Answer

Microsoft Purview Information Protection is enabled

Question 14

Refer to the exhibit. You are reviewing an ARM template snippet for an Azure Storage container. Which security best practice does this configuration enforce?

Accepted Answer

Disables anonymous public access to the container. The ARM template snippet sets the `publicAccess` property of the container to `None`. This explicitly disables anonymous public access to the container, enforcing the security best practice of preventing unauthenticated access to Azure Storage data. By default, Azure Storage containers allow anonymous read access if enabled at the account level, but this configuration overrides that to block any public requests.

Answer

Allows public access from the internet

Answer

Configures a firewall rule to restrict access to specific IPs

Answer

Enables encryption at rest for the container

Question 15

A company uses Microsoft Intune to manage devices. They want to ensure that all devices accessing corporate email are compliant with security policies before they can connect. Which feature should they enable?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it enforces compliance-based access control at the authentication layer. By integrating with Intune compliance policies, Conditional Access can block or allow device access to corporate email (e.g., Exchange Online) based on real-time compliance status, ensuring only compliant devices can connect.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Intune App Protection Policies

Answer

Mobile Device Management (MDM) enrollment