SC-100 Practice Exam 56 — 20 Questions

Question 1

Your organization is migrating on-premises workloads to Azure and wants to use Microsoft Defender for Cloud to secure the environment. The compliance team requires that all critical vulnerabilities be remediated within 30 days. What is the most efficient way to track and enforce this?

Accepted Answer

Use Microsoft Defender for Cloud regulatory compliance dashboard with a custom initiative. Option D is correct because Microsoft Defender for Cloud's regulatory compliance dashboard allows you to apply a custom initiative (e.g., based on the Microsoft Cloud Security Benchmark or a custom policy set) that maps specific security recommendations to compliance controls. By setting the initiative to enforce a 30-day remediation SLA via Azure Policy's 'deployIfNotExists' or 'modify' effects, you can automatically track compliance status and trigger remediation actions, meeting the compliance team's requirement efficiently.

Answer

Configure Azure Policy to auto-remediate all Defender for Cloud recommendations

Answer

Create a custom Azure Dashboard and manually update it weekly

Answer

Enable automatic VM patching in Azure Update Manager

Question 2

Your organization is migrating to Microsoft 365 and wants to implement a data classification strategy. The compliance team needs to automatically detect and label documents containing personal data (e.g., Social Security numbers) in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview are designed to automatically detect sensitive data types (e.g., Social Security numbers) using built-in or custom sensitive information types and apply sensitivity labels to documents in SharePoint Online. This meets the requirement for automatic detection and labeling without user intervention, as the compliance team needs.

Answer

Records Management

Answer

eDiscovery

Answer

Data Loss Prevention policies

Question 3

Your company uses Microsoft Sentinel for security information and event management (SIEM). You need to design a solution that reduces alert fatigue by correlating low-fidelity alerts from multiple sources into a single high-fidelity incident. Which Microsoft Sentinel feature should you use?

Accepted Answer

Analytics rules with alert grouping enabled. Analytics rules with alert grouping enabled allow you to configure a rule that correlates multiple low-fidelity alerts (e.g., from different data sources or detection types) into a single high-fidelity incident. When alert grouping is enabled, the rule groups alerts that occur within a specified time window and share common entities (such as IP addresses or user accounts), reducing alert fatigue by presenting one consolidated incident instead of many individual alerts.

Answer

Workbooks

Answer

Playbooks

Answer

Hunting queries

Question 4

Your organization wants to implement a security baseline for Azure resources using built-in policies. Which Azure service should you use to assign policies that enforce compliance with security best practices?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules and effects on your Azure resources. These policies can be used to implement a security baseline by ensuring resources comply with built-in security best practices, such as requiring encryption or restricting resource types. Azure Policy evaluates resources against assigned policies and can automatically remediate non-compliant resources.

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud

Answer

Azure Role-Based Access Control (RBAC)

Question 5

Your company uses Microsoft Defender for Endpoint (MDE) and wants to integrate threat intelligence from an external source to improve detection. The security team needs to ingest custom indicators of compromise (IOCs) into MDE. Which feature should they use?

Accepted Answer

Custom indicators (IOCs). Option D is correct because the Custom Indicators (IOCs) feature in Microsoft Defender for Endpoint allows security teams to manually ingest and manage threat intelligence from external sources, such as IP addresses, URLs, domains, or file hashes. These indicators are then used by MDE to create or block alerts, enabling tailored detection beyond built-in threat intelligence feeds.

Answer

Advanced Hunting

Answer

Threat Analytics

Answer

Automated investigation and response

Question 6

Your organization uses Microsoft Sentinel for security operations. The SOC team wants to automatically disable a compromised user account in Microsoft Entra ID when a high-severity alert is generated. Which automation method should you use?

Accepted Answer

An automation rule with a playbook. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when a high-severity alert fires. The playbook can then execute an action to disable the user account in Microsoft Entra ID via the Microsoft Graph API. This is the correct method because it provides the necessary integration between Sentinel alerts and Entra ID identity remediation.

Answer

A workbook

Answer

A KQL query in a hunting rule

Answer

An analytics rule

Question 7

Your organization is designing a Microsoft Sentinel solution to detect and respond to threats across multi-cloud environments (Azure, AWS, GCP). Which TWO components are essential for this design?

Accepted Answer

Data connectors for AWS and GCP. Data connectors are the foundational component for ingesting logs from external cloud providers into Microsoft Sentinel. For AWS, you typically use the AWS CloudTrail connector via S3 and SQS; for GCP, you use the GCP Security Command Center connector or a custom log ingestion pipeline. Without these connectors, Sentinel cannot receive telemetry from those environments, making multi-cloud detection impossible.

Answer

Azure Policy assignments

Answer

Microsoft Defender for Cloud

Answer

Azure Automation accounts

Question 8

A company deploys Microsoft Defender for Cloud Apps. They need to detect anomalous behavior in user activities across multiple cloud apps. Which feature should they enable?

Accepted Answer

Anomaly detection policies. Anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify unusual patterns in user activities across connected cloud apps, such as impossible travel, mass file downloads, or ransomware-like behavior. These policies leverage machine learning and behavioral analytics to establish a baseline of normal user behavior and trigger alerts when deviations occur, making them the correct choice for detecting anomalous behavior.

Answer

Session policies

Answer

Data loss prevention policies

Answer

App governance

Question 9

Which TWO of the following are benefits of using Microsoft Defender XDR (Extended Detection and Response)? (Choose two.)

Accepted Answer

Cross-domain correlation of alerts. Option C is correct because Microsoft Defender XDR correlates alerts across endpoints, email, identities, and cloud apps to provide a unified incident view. This cross-domain correlation enables security teams to detect multi-stage attacks that span different attack surfaces, which is a core benefit of an XDR solution.

Answer

Scans for vulnerabilities in VMs

Answer

Provides compliance assessments

Answer

Replaces the need for a firewall

Question 10

An organization uses Microsoft Purview Information Protection. They want to automatically apply a sensitivity label to documents containing credit card numbers. Which policy should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview Information Protection automatically apply sensitivity labels to documents and emails that match specified conditions, such as the presence of credit card numbers. This policy uses sensitive information types (e.g., Credit Card Number) to scan content and apply the label without user intervention, meeting the requirement for automatic labeling.

Answer

Retention policy

Answer

Sensitivity label policy

Answer

Data loss prevention policy

Question 11

Your organization uses Microsoft Purview to classify sensitive data. You need to automatically apply a sensitivity label to documents that contain personally identifiable information (PII). Which TWO components should you configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policy (A) is correct because it automatically applies sensitivity labels to documents based on conditions such as the presence of sensitive data types (e.g., PII). Sensitivity label (D) is correct because it defines the classification and protection settings (e.g., encryption, markings) that are applied to the content. Together, they enable automatic classification of PII documents without manual user intervention.

Answer

Retention label

Answer

Data Loss Prevention (DLP) policy

Answer

Trainable classifier

Question 12

A company uses Microsoft Sentinel and wants to implement a security orchestration, automation, and response (SOAR) solution. They need a playbook that automatically blocks a user in Microsoft Entra ID when a high-severity incident is created. What should they use?

Accepted Answer

Azure Logic Apps integrated with Microsoft Sentinel. Option C is correct because Azure Logic Apps provides the native integration with Microsoft Sentinel to create automated playbooks that trigger on incident creation. Logic Apps connectors allow direct interaction with Microsoft Entra ID to block a user via the Microsoft Graph API, enabling a seamless SOAR workflow without additional licensing or services.

Answer

Microsoft Defender XDR automated investigation and response

Answer

Power Automate cloud flows

Answer

Microsoft Purview Compliance Manager

Question 13

Your organization is implementing a Zero Trust security model. Which Microsoft security solution should you use to enforce conditional access policies based on user, device, location, and real-time risk signals?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct solution because it is the native policy engine in Azure AD that evaluates signals from user identity, device compliance, location (IP ranges or countries), and real-time risk from Microsoft Entra ID Protection to enforce access decisions. It directly implements the 'explicit verification' and 'assume breach' principles of Zero Trust by blocking or requiring step-up authentication based on these dynamic conditions.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 14

Your organization uses Microsoft Defender XDR for incident response. You need to design a process to automatically isolate a compromised device when a high-severity incident is triggered. Which automation approach should you use?

Accepted Answer

Use automation rules in Microsoft Sentinel with a playbook that runs a Defender for Endpoint isolation action. Option D is correct because Microsoft Sentinel's automation rules can directly trigger a playbook (Azure Logic App) that executes the Microsoft Defender for Endpoint 'Isolate device' action. This provides near-real-time, event-driven isolation without polling, aligning with the requirement to automatically isolate a compromised device when a high-severity incident is triggered in Defender XDR.

Answer

Create a compliance policy in Microsoft Intune that marks the device as noncompliant

Answer

Configure an Azure Automation runbook to poll Defender alerts and isolate devices

Answer

Set up a Power Automate flow triggered by email notifications from Defender

Question 15

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to prioritize remediation of high-severity findings based on the greatest potential business impact. Which security policy or framework should you configure to align remediation with business priorities?

Accepted Answer

Enable the Regulatory Compliance dashboard. The Regulatory Compliance dashboard in Microsoft Defender for Cloud allows you to map security controls to specific regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS) and track compliance posture. By selecting a framework that aligns with your organization's business obligations (e.g., a standard required by customers or regulators), you can prioritize remediation of high-severity findings based on the greatest potential business impact, such as fines or loss of certification.

Answer

Use the Azure Security Benchmark initiative

Answer

Set up workflow automation for high-severity findings

Answer

Configure the Secure Score dashboard

Question 16

Which THREE components are essential for implementing a successful SIEM strategy using Microsoft Sentinel?

Accepted Answer

Automation rules. Automation rules are essential because they allow you to centrally manage and automate incident response actions, such as assigning incidents, running playbooks, or triggering suppression logic, based on specific conditions. Without automation rules, your SOC would have to manually handle every alert, which is not scalable for a successful SIEM strategy.

Answer

Workbooks

Answer

Watchlists

Question 17

Your organization needs to audit all changes to Azure resources, including who made the change and what was changed. Which Azure service should you use to collect and analyze this audit data?

Accepted Answer

Azure Monitor with activity logs. Azure Monitor with activity logs is the correct service because it captures all control-plane operations on Azure resources, including who performed the change (via Azure Active Directory authentication), what was changed (the resource and properties), and when it occurred. Activity logs are retained for 90 days by default and can be exported to Log Analytics workspaces for advanced querying and alerting, making them the native audit trail for Azure resource modifications.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Question 18

Your organization is implementing Microsoft Entra ID Conditional Access. You need to require multi-factor authentication (MFA) for all users accessing financial applications, but only when the sign-in risk is medium or higher. What is the most efficient way to achieve this?

Accepted Answer

Create a Conditional Access policy that targets the financial applications, uses sign-in risk as a condition, and requires MFA. Option D is correct because it uses a single Conditional Access policy to target the specific financial applications and sets the sign-in risk condition to medium or higher, which triggers MFA only when the risk threshold is met. This approach is efficient as it avoids per-user MFA configuration and leverages Microsoft Entra ID Protection's risk detection to dynamically enforce MFA based on real-time sign-in risk, aligning with the principle of adaptive access control.

Answer

Create a Microsoft Entra ID Protection user risk policy to require MFA

Answer

Enable MFA per user for all users in the financial team

Answer

Create a Conditional Access policy that targets all users, includes a named location, and requires MFA

Question 19

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution that ensures all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. However, some legacy apps still require basic authentication. What should you recommend?

Accepted Answer

Enable authentication policies in Microsoft Entra ID to block legacy authentication. Option A is correct because enabling authentication policies in Microsoft Entra ID to block legacy authentication ensures that all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. Legacy authentication protocols (e.g., POP3, IMAP, SMTP, basic auth) bypass modern authentication and Conditional Access, so blocking them forces clients to use modern protocols (OAuth 2.0, OpenID Connect) that are subject to Conditional Access evaluation. This directly addresses the requirement while allowing legacy apps to be updated or replaced over time.

Answer

Configure Active Directory Federation Services (AD FS) as the identity provider

Answer

Deploy Microsoft Entra Application Proxy for all legacy apps

Answer

Enable pass-through authentication (PTA) to forward authentication requests

Question 20

Your organization uses Microsoft Intune for mobile device management. You need to ensure that only devices compliant with security policies can access corporate email. What should you implement?

Accepted Answer

Conditional Access policy requiring compliant device. A is correct because a Conditional Access policy in Microsoft Entra ID can evaluate device compliance status reported by Intune before granting access to corporate email. By configuring a policy that requires a device to be marked as compliant, only devices that meet your security policies (e.g., encryption, OS version, threat level) will be allowed to authenticate and access email. This directly enforces the requirement that only compliant devices can access corporate email.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Defender for Endpoint integration

Answer

Microsoft Intune App Protection Policies