SC-100 Practice Exam 60 — 20 Questions

Question 1

Your company is deploying Microsoft Intune for mobile device management. You need to ensure that corporate data on personally owned devices is protected without affecting the user's personal data. Which Intune feature should you use?

Accepted Answer

App Protection Policies (MAM). App Protection Policies (MAM) are the correct choice because they allow you to manage and protect corporate data within applications on personally owned devices without requiring device enrollment. This ensures that corporate data is encrypted, can be selectively wiped, and is prevented from being copied to personal apps, while leaving the user's personal data untouched.

Answer

Device compliance policies

Answer

Conditional Access for app control

Answer

Windows Autopilot

Question 2

Your organization uses Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. You need to create a custom detection rule that triggers when a user receives a phishing email and then attempts to log in from a new location. Which approach should you use?

Accepted Answer

Use Advanced Hunting to create a custom detection rule. Option A is correct because Advanced Hunting in Microsoft Defender XDR allows you to write Kusto Query Language (KQL) queries that correlate events across multiple data tables (e.g., EmailEvents, IdentityLogonEvents). You can then create a custom detection rule from that query, which will trigger an alert when a user receives a phishing email and subsequently logs in from a new location, enabling cross-domain correlation within Defender XDR.

Answer

Create a custom detection rule in Microsoft Defender for Endpoint

Answer

Use an automation rule in Microsoft Defender XDR

Answer

Create an analytics rule in Microsoft Sentinel

Question 3

An organization uses Microsoft Defender XDR to detect and respond to threats. Which THREE data sources does Defender XDR ingest? (Choose three.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender XDR ingests signals from Microsoft Defender for Identity to correlate on-premises Active Directory activities with cloud-based threats. This integration allows Defender XDR to detect identity-based attacks like Kerberoasting or pass-the-hash by analyzing domain controller logs and authentication events.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 4

Your organization uses Microsoft Sentinel and wants to reduce alert fatigue by grouping related alerts into incidents. Which configuration should you use?

Accepted Answer

Configure incident creation in the analytics rule properties. Option A is correct because in Microsoft Sentinel, incident creation is configured directly within the analytics rule properties. When you create or edit a scheduled or Microsoft Security analytics rule, the 'Incident settings' tab allows you to enable incident creation and define how alerts are grouped into incidents. This is the native mechanism for reducing alert fatigue by automatically grouping related alerts into a single incident based on criteria such as entity matching or time window.

Answer

Use a workbook to aggregate alerts

Answer

Use a playbook to create incidents

Answer

Create an automation rule to group alerts

Question 5

Your organization is implementing a data loss prevention (DLP) strategy using Microsoft Purview. The compliance team needs to automatically classify and label sensitive data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct choice because it provides unified data governance across hybrid and multi-cloud environments, including Microsoft 365, Azure SQL Database, and Amazon S3. It automatically scans, classifies, and labels sensitive data using built-in classifiers and sensitivity labels, enabling consistent DLP policies across these disparate data sources.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Records Management

Answer

Microsoft Defender for Cloud Apps

Question 6

A company wants to implement hybrid identity with Microsoft Entra ID. Which TWO components are required for password hash synchronization? (Choose two.)

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the on-premises tool that orchestrates synchronization between Active Directory and Microsoft Entra ID. It is required because password hash synchronization (PHS) is a feature within Entra Connect that reads password hashes from on-premises AD and syncs them to Entra ID, enabling seamless authentication without federated services.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra ID Protection

Answer

Azure AD Application Proxy

Question 7

Your organization uses Microsoft Sentinel for security operations. You need to ensure that all incident investigations are automatically captured for compliance reporting. Which feature should you enable?

Accepted Answer

Enable Microsoft Sentinel audit logging. Microsoft Sentinel audit logging captures all actions performed within the Sentinel environment, including incident investigations, queries run, and configuration changes. Enabling this feature ensures that every investigation step is logged and can be used for compliance reporting, as it records user activities and system events in the Azure Activity Log or Log Analytics workspace.

Answer

Use Microsoft Purview Compliance Manager

Answer

Configure Azure Policy for Sentinel

Answer

Enable Microsoft Defender for Cloud Apps

Question 8

Your organization uses Microsoft Sentinel and wants to correlate security events from multiple sources to detect multi-stage attacks. What should you create?

Accepted Answer

Fusion rule. Fusion rules in Microsoft Sentinel are specifically designed to correlate security events from multiple sources and detect multi-stage attacks by combining alerts from different detection technologies into a single incident. This matches the requirement to correlate events across sources for complex attack chains, unlike other rule types that focus on single-source or single-event detection.

Answer

Scheduled query rule

Answer

NRT rule

Answer

Anomaly rule

Question 9

Which THREE capabilities does Microsoft Purview provide for compliance management?

Accepted Answer

Information protection with sensitivity labels. Microsoft Purview provides compliance management capabilities including information protection with sensitivity labels, which allow organizations to classify and protect sensitive data across Microsoft 365 services, endpoints, and third-party apps. Sensitivity labels enforce encryption, visual markings, and access restrictions based on policy, directly supporting data loss prevention and governance.

Answer

Identity protection and risk detection

Answer

Endpoint detection and response

Question 10

Your organization has Microsoft Entra ID (Azure AD) and uses Privileged Identity Management (PIM). You need to ensure that when a user activates a privileged role, they must provide a reason and a ticket number. What should you configure?

Accepted Answer

PIM role settings requiring justification and approval on activation. Option A is correct because PIM role settings allow you to configure activation requirements, including mandatory justification (reason) and ticket number. By editing the role settings in PIM, you can enforce that users provide both a reason and a ticket number when activating a privileged role, ensuring auditability and compliance.

Answer

Conditional Access policy requiring multi-factor authentication

Answer

An access review for the privileged role

Answer

Microsoft Entra Identity Protection user risk policy

Question 11

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the primary purpose?

Accepted Answer

Detect entities that have been repeatedly targeted by high-severity alerts. The KQL query uses the `make_set` function to aggregate distinct alert names per entity (e.g., host or user) and then filters for entities that have been hit by more than 5 distinct high-severity alerts. This directly identifies entities repeatedly targeted by high-severity alerts, which is the primary purpose.

Answer

Correlate alerts across different data sources

Answer

Identify new high-severity alerts in the last 7 days

Answer

Find entities with fewer than 5 high-severity alerts

Question 12

Your organization uses Microsoft Defender for Cloud to manage the security posture of Azure resources. You need to receive alerts when a virtual machine is deployed without just-in-time (JIT) access enabled. What should you do?

Accepted Answer

Use the built-in Defender for Cloud recommendation for JIT access. The correct answer is D because Microsoft Defender for Cloud provides a built-in security recommendation specifically for just-in-time (JIT) VM access. This recommendation continuously assesses your VMs and generates an alert when a VM is deployed without JIT enabled, without requiring custom rules or manual configuration. It directly addresses the requirement to receive alerts for non-compliant VMs.

Answer

Create a custom alert rule in Microsoft Sentinel

Answer

Configure JIT access on the VM and monitor via activity logs

Answer

Enable JIT access on all VMs

Question 13

Which TWO of the following are components of Microsoft Defender XDR (Extended Detection and Response)?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR (Extended Detection and Response) is a unified security operations platform that natively integrates signals from Microsoft Defender for Endpoint (endpoint detection and response) and Microsoft Defender for Office 365 (email and collaboration security). These two components provide the core telemetry for cross-domain threat correlation and automated response within the Defender XDR portal.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 14

A company uses Microsoft Defender for Cloud Apps to discover and control Shadow IT. They want to block the use of a newly discovered unsanctioned app. What should they do?

Accepted Answer

Mark the app as unsanctioned in Defender for Cloud Apps. Option C is correct because marking an app as unsanctioned in Microsoft Defender for Cloud Apps is the direct mechanism to block access to a discovered Shadow IT app. When an app is marked unsanctioned, Defender for Cloud Apps automatically enforces a block by integrating with Conditional Access to prevent users from accessing the app, and it can also generate alerts and session controls. This action is specifically designed for the discovered app governance workflow within Defender for Cloud Apps.

Answer

Create a Conditional Access policy to block the app

Answer

Use Microsoft Purview Data Loss Prevention to block the app

Answer

Block the app's domain in Microsoft Intune

Question 15

Your organization uses Microsoft Purview to comply with regulatory requirements. Which TWO features should you use to manage data retention and deletion?

Accepted Answer

Data lifecycle management policies (retention policies).. Data lifecycle management policies (retention policies) in Microsoft Purview allow you to automatically retain or delete data at the container level (e.g., SharePoint sites, Exchange mailboxes, Teams channel messages) based on regulatory requirements. They enforce retention and deletion actions without user intervention, making them essential for compliance with data governance mandates.

Answer

Sensitivity labels.

Answer

Data Loss Prevention (DLP) policies.

Answer

Trainable classifiers.

Question 16

A company uses Microsoft Defender for Cloud Apps to discover and control cloud apps. They want to receive alerts when a user accesses a sanctioned app from an unusual location. Which feature should they configure?

Accepted Answer

Anomaly detection policies. Option C is correct because anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify behavioral deviations, such as a user accessing a sanctioned app from an unusual geographic location. These policies leverage machine learning to establish a baseline of normal user activity and trigger alerts when access patterns deviate from that baseline, enabling detection of potential account compromise or insider threats.

Answer

Session policies

Answer

File policies

Answer

App discovery policies

Question 17

Your organization uses Microsoft Entra ID and plans to implement a Zero Trust architecture. You need to ensure that all access requests to internal applications are verified continuously, not just at the initial sign-in. What should you configure?

Accepted Answer

Continuous Access Evaluation (CAE). Continuous Access Evaluation (CAE) is the correct choice because it enables real-time token validation and policy enforcement for critical events (e.g., user risk elevation, device compliance change, or IP address change) without requiring a new authentication request. This aligns with the Zero Trust principle of 'verify explicitly and continuously' by revoking access mid-session when conditions change, rather than only at initial sign-in.

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access policies with session controls

Question 18

A company uses Microsoft Sentinel for security operations. The SOC team needs to automatically respond to a specific type of incident involving a known malicious IP address. They want to create an automated response that blocks the IP at the firewall and creates a Teams notification. Which feature should they use?

Accepted Answer

Automation rule with a playbook. Automation rules in Microsoft Sentinel allow you to trigger automated responses when incidents are created or updated. By associating a playbook (an Azure Logic Apps workflow) with the automation rule, you can execute actions such as blocking an IP at a firewall via a connector and posting a Teams notification. This directly meets the requirement for a two-step automated response triggered by a specific incident type.

Answer

UEBA to detect anomalous behavior

Answer

Watchlist to correlate IP addresses

Answer

Analytics rule with scheduled query

Question 19

Your company uses Microsoft Defender for Cloud Apps and wants to prevent users from uploading sensitive files to personal cloud storage apps. What should you configure?

Accepted Answer

Session policy. Session policy in Microsoft Defender for Cloud Apps allows real-time monitoring and control of user activities based on app and content inspection. By configuring a session policy, you can block or restrict uploads of sensitive files to personal cloud storage apps like Dropbox or Google Drive during the user's session, leveraging reverse proxy capabilities to inspect and intervene in traffic.

Answer

Activity policy

Answer

App connector

Answer

File policy

Question 20

Refer to the exhibit. You configure this mail flow rule in Exchange Online. What happens to emails with 'FREE' in the subject?

Accepted Answer

Emails are moved to the Junk Email folder. The mail flow rule is configured to add the header 'X-CustomHeader' with the value 'Free' to emails that have 'FREE' in the subject. However, the rule also has the action 'Increase the spam confidence level (SCL) to 9', which causes Exchange Online to treat the message as high-confidence spam. When the SCL is set to 9, Exchange Online automatically moves the email to the Junk Email folder for the recipient, unless a transport rule or mailbox setting overrides this behavior. Therefore, the emails are not deleted, blocked, or simply have a header added; they are moved to the Junk Email folder due to the SCL increase.

Answer

Emails are deleted

Answer

Emails have a custom header added

Answer

Emails are blocked and not delivered