SC-100 Practice Test 9 — 10 Questions

Question 1

A multinational company uses Microsoft Purview for data governance. They need to automatically classify sensitive data in Microsoft 365 and apply retention labels. The solution must use pattern-based detection for credit card numbers and support custom keywords. What should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom sensitive info type with a regex pattern and keyword list.. The requirement specifies pattern-based detection for credit card numbers and support for custom keywords. A custom sensitive info type in Microsoft Purview allows you to define a regex pattern (e.g., for credit card numbers) and associate a custom keyword list, enabling precise auto-classification and retention label application. Trainable classifiers use machine learning, not pattern-based detection, and DLP policies or retention label auto-labeling policies do not directly create the pattern and keyword logic needed.

Answer

Use a trainable classifier for credit card numbers.

Answer

Configure a DLP policy with a rule for credit card numbers.

Answer

Create a retention label with auto-labeling policy.

Question 2

A company is planning their Zero Trust data protection strategy. They want to classify and protect sensitive data stored in SharePoint Online. Which Microsoft tool should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Microsoft Information Protection) is the correct tool because it provides integrated classification, labeling, and protection for sensitive data across Microsoft 365 services, including SharePoint Online. It uses sensitivity labels that can automatically apply encryption, rights management, and visual markings (headers/footers) to documents based on policy conditions, directly supporting the Zero Trust principle of 'assume breach' by protecting data at rest and in transit.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Answer

Azure Policy

Question 3

Your organization needs to comply with regulatory requirements for data retention and deletion. Which TWO Microsoft Purview features should you use?

Accepted Answer

Retention policies. Retention policies (A) are correct because they let you apply retention and deletion settings at the workload, location, or site level (for example, all Exchange mailboxes or all SharePoint sites) so content is kept for a defined period and then deleted, which directly satisfies regulatory data-retention and deletion requirements. Retention labels (D) are also correct because they provide item-level retention and deletion control, including event-based retention and disposition review, allowing specific documents or emails to be governed precisely per regulation. Together, policies handle broad, automatic governance while labels handle granular, item-specific governance. DLP policies (B) are not the right fit because they prevent sharing or leakage of sensitive data rather than enforcing retention or deletion periods. Audit logs (C) only record activity for investigation and compliance monitoring, and eDiscovery (E) is used to identify, hold, and export content for legal cases, not to implement retention or deletion schedules.

Answer

Data Loss Prevention (DLP) policies

Answer

Audit logs

Answer

eDiscovery

Question 4

Your organization uses Microsoft Defender for Office 365 and wants to block malicious links in email messages in real time. Which policy should you configure?

Accepted Answer

Safe Links policy. Safe Links policy in Microsoft Defender for Office 365 provides real-time URL scanning and rewriting at the time of click, enabling the blocking of malicious links in email messages. This policy wraps URLs to route clicks through Microsoft's threat intelligence service, which checks the link against current threat data and blocks access if malicious content is detected.

Answer

Anti-phishing policy

Answer

Safe Attachments policy

Answer

Anti-spam policy

Question 5

Your organization is a multi-national corporation that uses Microsoft 365 E5 and Azure. You need to design a security operations center (SOC) to detect and respond to threats across identities, endpoints, and cloud apps. The SOC team will use a single pane of glass for incident management. Requirements: (1) Centralize alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, (2) Automate incident response playbooks, (3) Use advanced hunting across all data sources, (4) Integrate with external threat intelligence feeds, (5) Provide role-based access control for SOC analysts. Which Microsoft solution should you implement?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM and SOAR solution that ingests alerts from Microsoft Defender services, third-party sources, and external threat intelligence, provides a single pane of glass for incident management, supports automation playbooks via Logic Apps, and offers advanced hunting with KQL across all connected data sources. It also supports RBAC for SOC analysts. The Microsoft 365 Defender portal (A) centralizes Defender alerts but lacks the broader SIEM/SOAR capabilities and external threat intelligence integration required.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Cloud

Question 6

A company is implementing Microsoft Priva to manage subject rights requests. Users submit requests to access their personal data stored in Exchange Online, SharePoint, and Teams. The privacy team needs to automate the retrieval of data from these sources. Which Priva capability should they use?

Accepted Answer

Subject Rights Requests. Microsoft Priva's Subject Rights Requests capability is purpose-built to automate the intake, search, and fulfillment of data subject access requests (DSARs) across Microsoft 365 workloads including Exchange Online, SharePoint, OneDrive, and Teams. It provides templates, automated searches, and review workflows that map directly to the scenario described.

Answer

Consent Management

Answer

Data Inventory

Answer

Data Breach Notifications

Question 7

A company uses Microsoft Sentinel for security operations. The SOC team needs to automatically respond to a specific type of incident involving a known malicious IP address. They want to create an automated response that blocks the IP at the firewall and creates a Teams notification. Which feature should they use?

Accepted Answer

Automation rule with a playbook. Automation rules in Microsoft Sentinel allow you to trigger automated responses when incidents are created or updated. By associating a playbook (an Azure Logic Apps workflow) with the automation rule, you can execute actions such as blocking an IP at a firewall via a connector and posting a Teams notification. This directly meets the requirement for a two-step automated response triggered by a specific incident type.

Answer

UEBA to detect anomalous behavior

Answer

Watchlist to correlate IP addresses

Answer

Analytics rule with scheduled query

Question 8

You are designing a Zero Trust architecture for a company that uses Microsoft Entra ID and Microsoft Intune. The security team wants to enforce device compliance before granting access to cloud apps. Which policy should you implement?

Accepted Answer

Microsoft Entra Conditional Access policy requiring compliant device. Microsoft Entra Conditional Access policies can require that devices are marked as compliant by Microsoft Intune before granting access to cloud apps. This directly enforces device compliance as a condition for access, which is a core Zero Trust principle of verifying every access request based on device health.

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Azure AD Identity Protection sign-in risk policy

Question 9

Your company uses Microsoft Intune to manage corporate devices. The security team wants to prevent users from copying sensitive data from corporate apps to personal apps on mobile devices. Which Intune policy should you configure?

Accepted Answer

App protection policies. App protection policies (APP) are the correct Intune policy to prevent data transfer from corporate apps to personal apps on mobile devices. These policies apply at the application layer, allowing you to configure data protection settings such as 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' specifically for managed apps, regardless of the device enrollment state.

Answer

Device configuration policies

Answer

Windows Information Protection

Answer

Device compliance policies

Question 10

Your organization uses Microsoft Sentinel to centralize security logs from multiple clouds. They need to ensure that logs from Amazon Web Services (AWS) are ingested and analyzed for threats. Which connector should you implement?

Accepted Answer

AWS S3 connector. The AWS S3 connector is the correct choice because it is the native Microsoft Sentinel data connector designed specifically to ingest AWS CloudTrail logs (and other AWS service logs) from an S3 bucket. It uses an AWS Simple Queue Service (SQS) to poll for new log files, then streams them into Sentinel for analysis, enabling threat detection across multi-cloud environments.

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor Agent

Answer

Azure Event Hubs