SC-100 Practice Questions 1 — 50 Questions

Question 1

Refer to the exhibit. A KQL query is used in Microsoft Sentinel to detect brute-force attacks. The query returns no results despite known brute-force attempts. What is the most likely issue?

Accepted Answer

The EventID 4625 may not cover all authentication failures. EventID 4625 in Windows Security logs specifically records failed logon attempts, but brute-force attacks may target other authentication protocols (e.g., RDP, SMB, or network-level authentication) that generate different EventIDs (such as 4648, 4776, or 5156). Additionally, some brute-force attempts might be blocked at the network layer or use non-Windows authentication methods, so relying solely on EventID 4625 will miss those events. Therefore, the query returns no results because it does not capture all authentication failure scenarios.

Answer

The query lacks a time filter

Answer

The 'IPAddress' field does not exist in SecurityEvent

Answer

The 'count()' aggregation is incorrect

Question 2

A startup, Alpine Ski House, is developing a mobile app that allows users to book ski lessons. The app communicates with an Azure Function App backend via REST APIs. The function app stores data in Azure Cosmos DB. The company wants to secure the API endpoints using OAuth 2.0 with Microsoft Entra ID and ensure that only authenticated users can invoke the functions. The function app should also use a managed identity to access Cosmos DB. Which of the following configurations should you implement?

Accepted Answer

Configure the function app to require authentication with Microsoft Entra ID, enforce HTTPS only, and use a system-assigned managed identity to access Cosmos DB.. It uses OAuth 2.0 with Entra ID for authentication, managed identity for database access, and enforces HTTPS. Option B is wrong because function keys are not secure for user authentication. Option C is wrong because client certificates do not provide user-level authentication. Option D is wrong because IP whitelisting is not a substitute for authentication.

Answer

Configure the function app to use function-level authorization keys, enforce HTTPS only, and use a connection string with a read-write key to access Cosmos DB.

Answer

Configure the function app to require client certificates, enforce HTTPS only, and use a managed identity to access Cosmos DB.

Answer

Configure the function app to use IP whitelisting, enforce HTTPS only, and use a managed identity to access Cosmos DB.

Question 3

A company needs to design a secure DevOps pipeline using GitHub Actions and Microsoft Defender for Cloud. They want to scan infrastructure-as-code (IaC) templates for misconfigurations before deployment. What should they integrate?

Accepted Answer

Microsoft Defender for Cloud Infrastructure as Code scanning. Microsoft Defender for Cloud includes a native Infrastructure as Code (IaC) scanning capability that integrates directly with GitHub Actions. This feature automatically analyzes IaC templates (such as ARM, Bicep, Terraform, and CloudFormation) for security misconfigurations during the CI/CD pipeline, providing pre-deployment guardrails. By failing the pipeline on critical findings, it ensures only compliant infrastructure is deployed, aligning with the secure DevOps principle of shifting security left.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 4

Your organization is migrating to Microsoft 365 and wants to implement a data classification strategy. The compliance team needs to automatically detect and label documents containing personal data (e.g., Social Security numbers) in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview are designed to automatically detect sensitive data types (e.g., Social Security numbers) using built-in or custom sensitive information types and apply sensitivity labels to documents in SharePoint Online. This meets the requirement for automatic detection and labeling without user intervention, as the compliance team needs.

Answer

Records Management

Answer

eDiscovery

Answer

Data Loss Prevention policies

Question 5

Your company is migrating to a cloud-native security operations center (SOC) using Microsoft Sentinel. You need to design a solution that automatically investigates and remediates common incidents like brute-force attacks on Azure VMs. The solution should use playbooks triggered by analytics rules. Which Microsoft service should you use to create the playbooks, and what is the recommended authentication method?

Accepted Answer

Azure Logic Apps with managed identity. Azure Logic Apps is the recommended platform for Sentinel playbooks. Managed identity is the preferred authentication method because it avoids credential management and supports automation. Azure Automation is for runbooks, not playbooks. Service principal is possible but not recommended due to credential management.

Answer

Power Automate with user account

Answer

Azure Automation with service principal

Answer

Azure Functions with API key

Question 6

Your organization is planning to deploy Microsoft Purview Information Protection to classify and protect sensitive data. You need to design a solution that automatically applies sensitivity labels to documents containing personally identifiable information (PII) when they are uploaded to SharePoint Online. Which configuration should you use?

Accepted Answer

Create an auto-labeling policy that uses a sensitive info type for PII. Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to documents containing PII when they are uploaded to SharePoint Online. By configuring a policy with a sensitive info type (e.g., U.S. Social Security Number) as the condition, the service scans content at rest and applies the label without user intervention, meeting the requirement for automatic classification.

Answer

Set a default sensitivity label for the SharePoint site

Answer

Use trainable classifiers to identify PII and apply labels

Answer

Configure a manual labeling policy that prompts users to classify documents

Question 7

Your company is migrating on-premises Active Directory to Microsoft Entra ID. The security team requires that users must use passwordless authentication methods for all sign-ins. Which Microsoft Entra ID feature should you enable to support passwordless authentication?

Accepted Answer

Microsoft Entra ID passwordless authentication methods. Microsoft Entra ID passwordless authentication methods (such as Windows Hello for Business, FIDO2 security keys, and Microsoft Authenticator) are the native features designed to eliminate passwords entirely. These methods satisfy the security team's requirement by enabling users to sign in without a password, using biometrics or cryptographic keys instead.

Answer

Password hash synchronization

Answer

Seamless Single Sign-On (Seamless SSO)

Answer

Pass-through authentication

Question 8

A company is designing a data security strategy using Microsoft Purview. They need to identify sensitive data across their data estate, including on-premises SQL Server, Azure SQL Database, and Amazon S3. Which THREE components should they use? (Choose three.)

Accepted Answer

Microsoft Purview Data Estate Insights. Microsoft Purview Data Estate Insights provides visibility into data estate health and security posture, including sensitive data discovery across on-premises SQL Server, Azure SQL Database, and Amazon S3. It aggregates scan results and offers dashboards to identify where sensitive data resides, enabling targeted classification and protection actions.

Answer

Microsoft Purview External Identities

Answer

Microsoft Purview Compliance Manager

Question 9

Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents. Which feature should you configure?

Accepted Answer

Configure an automation rule to run a playbook automatically. Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, including running playbooks (Azure Logic Apps workflows) automatically. This is the correct approach for automatically responding to high-severity incidents because it eliminates manual intervention and ensures consistent, immediate action based on incident properties like severity.

Answer

Create a playbook and run it manually for each incident

Answer

Set up an analytics rule with automatic response

Answer

Use a workbook to trigger a playbook

Question 10

Your company uses Microsoft Defender for Cloud Apps and wants to prevent users from uploading sensitive files to personal cloud storage apps. What should you configure?

Accepted Answer

Session policy. Session policy in Microsoft Defender for Cloud Apps allows real-time monitoring and control of user activities based on app and content inspection. By configuring a session policy, you can block or restrict uploads of sensitive files to personal cloud storage apps like Dropbox or Google Drive during the user's session, leveraging reverse proxy capabilities to inspect and intervene in traffic.

Answer

Activity policy

Answer

App connector

Answer

File policy

Question 11

You are designing a Microsoft Purview data security solution for a multinational organization subject to GDPR and CCPA. Which THREE Purview capabilities should you include to meet regulatory requirements?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies are correct because they allow the organization to detect and prevent the accidental or intentional sharing of sensitive data—such as personally identifiable information (PII) covered under GDPR and CCPA—across email, SharePoint, OneDrive, and endpoints. By scanning content for sensitive information types (e.g., credit card numbers, EU passport numbers) and applying protective actions (e.g., blocking transmission, showing policy tips), DLP directly enforces data protection mandates required by these regulations.

Answer

Advanced eDiscovery

Answer

Data Lifecycle Management (retention policies)

Question 12

A company deploys Azure App Service with a custom domain and SSL certificate. They want to enforce HTTPS only. Which configuration setting should they enable?

Accepted Answer

HTTPS Only. The 'HTTPS Only' setting in Azure App Service enforces that all incoming requests are redirected from HTTP to HTTPS, ensuring encrypted communication. This is achieved by returning a 301 redirect for any HTTP request, which aligns with the requirement to enforce HTTPS only.

Answer

Client Certificates

Answer

Minimum TLS Version

Answer

Custom Domain

Question 13

A company is planning their cloud governance strategy. They have multiple business units with varying compliance requirements. They need to enforce policies consistently across subscriptions while allowing some flexibility. Which Azure governance structure should they recommend?

Accepted Answer

Use a management group hierarchy with Azure Policy assignments and exemptions.. B is correct because a management group hierarchy allows the company to organize subscriptions by business unit or compliance requirement, then apply Azure Policy assignments at the management group level to enforce consistent policies across all subscriptions. Exemptions can be granted at lower scopes (e.g., specific subscriptions or resource groups) to provide the required flexibility while maintaining overall governance. This structure centralizes policy enforcement without requiring separate tenants or manual RBAC assignments.

Answer

Assign RBAC roles to each subscription owner.

Answer

Create separate Azure AD tenants for each business unit.

Answer

Use Azure Blueprints with locked permissions.

Question 14

Refer to the exhibit. You are investigating a security incident in Microsoft Sentinel. The KQL query above is used to identify potential brute-force attacks. What does the query return?

Accepted Answer

A list of user accounts and computers where the account has more than 5 failed logins in the last 24 hours.. The correct answer is C: a list of user accounts and computers where the account has more than 5 failed logins in the last 24 hours. This matches a typical Sentinel brute-force KQL pattern that filters SecurityEvent for EventID 4625 (failed logon), restricts the TimeGenerated window to the last 24 hours, and then summarizes failed attempts by Account and Computer, filtering with a threshold greater than 5. Option A is wrong because the grouping is by account and computer, not by computer alone, and it ignores the 24-hour time window. Option B is wrong because it omits the per-computer grouping, so it would not return computer context. Option D is wrong because it references successful logins rather than failed logons (EventID 4625).

Answer

A list of computers with more than 5 failed logins from any account.

Answer

A list of user accounts with more than 5 failed logins across all computers.

Answer

A list of user accounts with more than 5 successful logins in the last 24 hours.

Question 15

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You need to create an analytics rule in Sentinel that triggers an incident when a device is reported as 'high risk' by MDE. Which data source and rule type should you use?

Accepted Answer

Microsoft Defender XDR connector with a Scheduled query rule. The Microsoft Defender XDR connector ingests alerts from Microsoft Defender for Endpoint (MDE) into Sentinel. A Scheduled query rule is required to run a KQL query at a defined interval (e.g., every 5 minutes) that checks for devices with a 'high risk' severity level in the ingested alert data. This combination allows you to create an incident when MDE reports a device as high risk.

Answer

Microsoft Sentinel's Anomalous Activity rule

Answer

Microsoft 365 Defender connector with an NRT query rule

Answer

Microsoft Defender for Cloud connector with a Fusion rule

Question 16

Your company uses Microsoft Sentinel as a SIEM. You need to ensure that all Azure subscription activity logs are ingested into Sentinel. What is the most efficient way to configure this?

Accepted Answer

Enable the 'Azure Activity' data connector in Sentinel.. The Azure Activity data connector is specifically designed to ingest subscription-level activity logs into Microsoft Sentinel. Option A is incorrect because although diagnostic settings can send activity logs to a Log Analytics workspace, Sentinel requires the data connector to properly collect and correlate the data. Option B is incorrect because an Azure Logic App would be an inefficient custom solution when a built-in connector exists. Option D is incorrect because manually exporting to a storage account is not efficient or automated.

Answer

Configure diagnostic settings on the subscription to send logs to a Log Analytics workspace.

Answer

Create an Azure Logic App to periodically pull activity logs.

Answer

Manually export activity logs to a storage account and connect to Sentinel.

Question 17

An organization uses Microsoft Sentinel to monitor their hybrid infrastructure. They need to detect brute-force attacks against their on-premises Windows servers. Which data source should they connect to Sentinel?

Accepted Answer

Windows Security Events via Azure Monitor Agent. Windows Security Events from Event ID 4625 (failed logon) are the primary source for detecting brute-force attacks. Azure Activity Log is for resource management events. DNS events are for DNS queries. Sysmon is for process activity, not logon failures.

Answer

Azure Activity Log

Answer

DNS Events

Answer

Sysmon Events

Question 18

Refer to the exhibit. A security analyst runs the following KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Detect brute-force attacks against Windows servers. The query filters Windows Security Events for failed logon attempts (EventID 4625) in the last hour, groups by user account, computer, and IP address, and then shows only those with more than 10 failures. This is used to detect brute-force attacks.

Answer

List all accounts that have been locked out

Answer

Identify successful logins from multiple IP addresses

Answer

Find users who logged in after hours

Question 19

A company is implementing a cloud security governance strategy. They need to ensure that all Azure resources are compliant with internal security policies before deployment. Which approach should they use?

Accepted Answer

Assign Azure Policy definitions with 'deny' effect at the subscription scope. Azure Policy with the 'deny' effect is the correct approach because it proactively prevents the deployment of any resource that violates defined security policies at the subscription scope. This ensures compliance before deployment by evaluating the resource against policy rules during the creation or update operation, blocking the request if non-compliant. Unlike reactive measures, this enforces governance at the point of deployment without requiring post-deployment remediation.

Answer

Configure Azure Firewall to block non-compliant resources

Answer

Deploy resources using Azure Blueprints

Answer

Use Azure DevOps pipelines with manual approval gates

Question 20

Your company uses Microsoft Sentinel for security operations. You need to design a solution that automatically remediates a detected threat by blocking a malicious IP address on Azure Firewall. Which Microsoft Sentinel feature should you use?

Accepted Answer

SOAR playbooks. Security Orchestration, Automation, and Response (SOAR) in Microsoft Sentinel uses playbooks to automate remediation actions like blocking IPs on Azure Firewall. Option A is wrong because analytics rules only generate alerts. Option B is wrong because workbooks visualize data. Option D is wrong because UEBA analyzes behavior but does not automate remediation.

Answer

Analytics rules

Answer

Workbooks

Answer

User and Entity Behavior Analytics (UEBA)