SC-100 Practice Test 41 — 15 Questions

Question 1

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They need to ensure that all resources are compliant with the Payment Card Industry Data Security Standard (PCI DSS). What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the PCI DSS regulatory compliance standard in Microsoft Defender for Cloud. Microsoft Defender for Cloud includes built-in regulatory compliance standards, such as PCI DSS, that can be enabled directly. Once enabled, Defender for Cloud continuously assesses your Azure subscriptions against the PCI DSS controls and provides a compliance score with detailed remediation steps. This is the simplest and most effective method to monitor compliance without creating custom policies or blueprints.

Answer

Create Azure Policy initiatives to enforce PCI DSS controls

Answer

Use Microsoft Purview to classify data and apply PCI DSS labels

Answer

Deploy Azure Blueprints that include PCI DSS policies

Question 2

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that detects machines with more than two malware alerts in a day. The query returns no results even though you know there are machines with multiple malware alerts. What is the most likely reason?

Accepted Answer

The alert name in the environment is not exactly 'Malware detected'; it might include a suffix like 'on endpoint'.. The KQL query likely uses a hardcoded string 'Malware detected' in a where clause to filter alerts. If the actual alert names in the environment include a suffix like 'on endpoint' (e.g., 'Malware detected on endpoint'), the exact string match fails, causing the query to return no results. This is a common issue when alert naming conventions vary across Microsoft Defender for Endpoint or other data sources ingested into Sentinel.

Answer

The 'summarize' function is incorrectly used and creates duplicate counts.

Answer

The query filters out alerts with severity less than 'High'.

Answer

The query does not include a time range filter, so it returns data from all time.

Question 3

Refer to the exhibit. You are reviewing a conditional access policy. What is the effect of this policy?

Accepted Answer

Requires multifactor authentication for Global Administrators and Security Administrators. The exhibit shows a conditional access policy that targets the 'Global Administrators' and 'Security Administrators' directory roles, and the policy is configured to 'Require multifactor authentication' for those roles. The policy is enabled (as indicated by the 'On' toggle), so it actively enforces MFA for members of those two admin roles, blocking access if they do not complete MFA. This aligns with the principle of securing high-privilege roles with stronger authentication.

Answer

The policy is disabled and has no effect

Answer

Blocks access for all users

Answer

Requires multifactor authentication for all users

Question 4

A company wants to enforce that all administrators use just-in-time (JIT) access to privileged roles in Microsoft Entra ID. Which feature should they enable?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by enabling time-bound and approval-based role activation. This directly meets the requirement to enforce JIT access for administrators, as PIM allows roles to be activated only when needed and for a limited duration, reducing standing access.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Protection

Question 5

A company uses Microsoft Entra ID for identity management. They want to ensure that only managed devices can access corporate email. Which Conditional Access policy setting should be configured?

Accepted Answer

Require device to be marked as compliant. To ensure only managed devices can access corporate email, you need to enforce device compliance. The Conditional Access policy setting 'Require device to be marked as compliant' checks that the device is enrolled in Microsoft Intune and meets all compliance policies (e.g., encryption, OS version, jailbreak detection) before granting access. This directly restricts access to managed devices only.

Answer

Require multifactor authentication

Answer

Block legacy authentication

Answer

Require approved client app

Question 6

A multinational corporation is implementing a privileged access strategy. They need to ensure that all users with permanent administrative roles sign in using phishing-resistant authentication methods. Which Microsoft Entra ID feature should they enforce?

Accepted Answer

Authentication Strengths in Conditional Access. Authentication Strengths in Conditional Access allows organizations to enforce specific authentication methods, such as FIDO2 security keys or certificate-based authentication, which are phishing-resistant. This directly meets the requirement to ensure users with permanent administrative roles use phishing-resistant methods, unlike general MFA policies that may allow weaker methods like SMS or OTP.

Answer

Privileged Identity Management (PIM) with access reviews

Answer

Multifactor authentication (MFA) with Conditional Access

Answer

Conditional Access policies requiring MFA for all admins

Question 7

Your organization uses Microsoft Defender for Office 365 to protect against phishing attacks. The security team wants to implement a custom advanced phishing threshold policy that blocks suspicious emails more aggressively. Which policy type should they modify?

Accepted Answer

Anti-phishing policy. The Anti-phishing policy in Microsoft Defender for Office 365 includes the Advanced Phishing Threshold (APT) settings that allow administrators to control the aggressiveness of phishing detection. By modifying the anti-phishing policy, you can set the phishing threshold to 'Aggressive' or 'Most Aggressive,' which applies more stringent machine learning models to block suspicious emails earlier. This is the correct policy type because it directly governs the phishing threshold level, not attachment or link scanning.

Answer

ATP policy

Answer

Safe Attachments policy

Answer

Safe Links policy

Question 8

Your company needs to automatically classify and label sensitive documents in Microsoft 365 based on their content. Which Microsoft Purview solution should you implement?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) enables automatic classification and labeling of sensitive documents based on content, using trainable classifiers, exact data match (EDM), and sensitive information types. This solution applies sensitivity labels to documents in Microsoft 365 (e.g., SharePoint, Exchange, OneDrive) via client-side labeling or auto-labeling policies, meeting the requirement to classify and label by content.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Insider Risk Management

Question 9

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a DDoS attack detected by Azure DDoS Protection. The response should include blocking the attacker's IP address in Azure Firewall and sending an alert to the security team. Which approach should you use?

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook to block the IP in Azure Firewall. Microsoft Sentinel automation rules can trigger a playbook (an Azure Logic App) when a DDoS attack detection alert fires. The playbook can execute an action to block the attacker's IP address in Azure Firewall via its REST API or PowerShell cmdlets, and simultaneously send an alert to the security team (e.g., via email or Teams). This provides an automated, orchestrated response directly from the SIEM, aligning with security operations best practices.

Answer

Configure an alert rule in Azure Monitor to send an email to the security team

Answer

Use Azure Policy to deny network traffic from the attacker's IP range

Answer

Configure a resource lock on the Azure Firewall to prevent changes

Question 10

A company is implementing Microsoft Purview to protect sensitive data in SharePoint Online. They need to automatically apply a 'Highly Confidential' label to documents that contain credit card numbers. What should they create?

Accepted Answer

An auto-labeling policy for sensitivity labels. Microsoft Purview auto-labeling policies for sensitivity labels can automatically detect sensitive data types (e.g., credit card numbers) in SharePoint Online documents and apply a 'Highly Confidential' label without user intervention. This meets the requirement for automatic, policy-driven labeling based on content inspection.

Answer

A communication compliance policy

Answer

A data loss prevention (DLP) rule

Answer

A manual labeling policy

Question 11

An organization wants to ensure that all Windows 10 devices are compliant with security policies before they can access corporate email. Microsoft Intune is used for device management. Which component should be used to enforce compliance and block non-compliant devices?

Accepted Answer

Microsoft Entra ID Conditional Access policy integrated with Intune compliance. Microsoft Entra ID Conditional Access policies can evaluate Intune device compliance status in real time. When a device is marked non-compliant by an Intune compliance policy, the Conditional Access policy blocks access to corporate email (e.g., Exchange Online) until the device is remediated. This integration enforces a 'compliant device required' gate that cannot be achieved by Intune compliance alone, which only reports status without blocking access.

Answer

Intune device compliance policy alone

Answer

Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint device risk score

Question 12

You need to audit user activities in Microsoft 365, including who accessed a specific file in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) is the correct solution because it captures and logs user activities across Microsoft 365 services, including SharePoint Online. When a user accesses a specific file, the audit log records the event with details such as the user, file name, action (e.g., FileAccessed), and timestamp, enabling you to query this data via the Microsoft 365 Defender portal or Search-UnifiedAuditLog cmdlet.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Question 13

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the primary purpose?

Accepted Answer

Detect entities that have been repeatedly targeted by high-severity alerts. The KQL query uses `make_set` to aggregate distinct high-severity alert names per entity and filters for entities with more than 5 distinct alert types. This identifies entities that have been targeted by a high variety of high-severity alerts, indicating repeated or broad attack activity.

Answer

Correlate alerts across different data sources

Answer

Identify new high-severity alerts in the last 7 days

Answer

Find entities with fewer than 5 high-severity alerts

Question 14

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only devices with a TPM (Trusted Platform Module) version 2.0 can access corporate resources. What should you configure?

Accepted Answer

Create a device compliance policy that requires TPM 2.0 and use Conditional Access to block non-compliant devices. A device compliance policy in Microsoft Intune can check for TPM 2.0 presence and version. When combined with a Conditional Access policy that blocks non-compliant devices, only devices meeting the TPM 2.0 requirement can access corporate resources. This is the correct approach because Conditional Access enforces the compliance check at the authentication and authorization layer.

Answer

Use Windows Update for Business to ensure TPM firmware is updated

Answer

Configure device enrollment restrictions to require TPM 2.0

Answer

Deploy a device configuration profile that enables TPM 2.0

Question 15

Your organization uses Microsoft Intune to manage devices. You need to ensure that corporate data on personally owned devices is removed when a user leaves the company, but personal data remains intact. What should you use?

Accepted Answer

Selective wipe (retire). Selective wipe (retire) is the correct choice because it removes only corporate data from a personally owned device enrolled in Microsoft Intune, while preserving the user's personal data. This is achieved by targeting managed app data and corporate profiles, leaving personal apps, photos, and settings intact. It aligns with the requirement to protect corporate information upon employee departure without affecting the user's personal property.

Answer

Conditional Access policy

Answer

Full wipe

Answer

Device compliance policy