SC-100 Evaluate GRC and security operations strategies Practice Test 1 — 15 Questions

Question 1

A multinational company is implementing a Zero Trust security model. The security team needs to ensure that all access requests to critical applications are evaluated based on user identity, device health, and real-time risk signals. Which Microsoft solution should they use to centralize policy enforcement?

Accepted Answer

Microsoft Entra Conditional Access. Correct answer is C: Microsoft Entra Conditional Access. It evaluates signals like user, device, and location to enforce access policies. Option A (Microsoft Defender for Cloud Apps) is a CASB, not a policy enforcement point for authentication. Option B (Microsoft Purview Compliance Manager) is for compliance scores. Option D (Azure AD Identity Protection) identifies risks but does not enforce access policies directly.

Answer

Microsoft Defender for Cloud Apps

Answer

Azure AD Identity Protection

Answer

Microsoft Purview Compliance Manager

Question 2

A company is designing a security operations strategy. They want to use Microsoft Sentinel to detect and respond to threats across their hybrid environment. They need to ensure that logs from all sources are collected cost-effectively and that analysts can easily query data. Which data ingestion strategy should they recommend?

Accepted Answer

Use Analytics logs for high-value security logs and Basic logs for verbose logs with low security value.. Option D is correct because it balances cost and query performance by routing high-value security logs (e.g., Windows Security Events, network logs) to the Analytics logs table for full KQL query capabilities and retention, while sending verbose, low-security-value logs (e.g., DNS debug, firewall flow logs) to the Basic logs table, which offers lower ingestion cost and limited query features (e.g., no KQL summarization). This tiered approach ensures analysts can efficiently hunt on critical data without incurring unnecessary costs for voluminous, less actionable logs.

Answer

Send all logs to the Basic logs table to reduce costs.

Answer

Send only Windows Security Events to Sentinel.

Answer

Send all logs to the Analytics logs table for full query capabilities.

Question 3

A company's security team wants to automate response to common incidents like malware detected on endpoints. They have Microsoft 365 Defender and Microsoft Sentinel. Which feature should they use to create automated playbooks?

Accepted Answer

Microsoft Sentinel automation rules and playbooks. Microsoft Sentinel's automation rules and playbooks are the correct choice because they are specifically designed to automate incident response by triggering predefined actions (e.g., running a Logic App) when a detection event, such as malware on an endpoint, is ingested from Microsoft 365 Defender. This integration allows security teams to create custom, automated workflows that respond to common incidents without manual intervention.

Answer

Microsoft Purview's data loss prevention policies

Answer

Azure Policy

Answer

Microsoft Defender for Cloud's workflow automation

Question 4

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to ensure that critical recommendations are automatically remediated. They create a workflow automation that triggers a Logic App for specific recommendations. However, the Logic App fails to run. What is the most likely cause?

Accepted Answer

The managed identity of the Logic App lacks permissions on the target resources.. The most likely cause is that the Logic App's managed identity lacks the necessary permissions on the target Azure resources. Workflow automations in Defender for Cloud use a Logic App that executes remediation actions; if the Logic App's identity (either system-assigned or user-assigned) does not have the required RBAC role (e.g., Contributor or a custom role with specific actions) on the resource scope, the remediation run will fail with an authorization error. This is a common misconfiguration because the automation trigger itself succeeds, but the downstream action fails due to insufficient permissions.

Answer

The subscription is not onboarded to Defender for Cloud.

Answer

Defender for Cloud is disabled for the resource group.

Answer

The recommendation is disabled in the security policy.

Question 5

A company is evaluating their incident response (IR) process. They use Microsoft Sentinel as their SIEM. During a security incident, the IR team struggles to quickly find related alerts and entities. Which improvement should they implement to enhance investigation efficiency?

Accepted Answer

Leverage the investigation graph to explore entity relationships.. The investigation graph in Microsoft Sentinel provides a visual, interactive map of entity relationships (e.g., users, hosts, IP addresses, alerts) connected to an incident. This directly addresses the IR team's struggle to quickly find related alerts and entities by allowing them to explore and pivot across linked data points, drastically reducing manual correlation time.

Answer

Create more analytics rules to cover additional scenarios.

Answer

Configure automation rules to automatically classify incidents.

Answer

Increase data retention for all log tables.

Question 6

A company wants to implement a governance strategy for their Azure environment. They need to enforce tagging standards and restrict deployment to approved regions. Which combination of Azure services should they use?

Accepted Answer

Azure Policy and Azure Blueprints. Azure Policy is the correct service for enforcing tagging standards and restricting deployments to approved regions because it applies rules and effects to resources during creation and existing resources. Azure Blueprints complements this by orchestrating the deployment of policy definitions, role assignments, and resource groups into a single, repeatable package, ensuring consistent governance across subscriptions.

Answer

Azure Management Groups and subscriptions

Answer

Azure RBAC and Azure AD

Answer

Azure Resource Graph and Azure Monitor

Question 7

A company uses Microsoft 365 Defender to protect their endpoints, email, and identities. They want to create a custom detection for a specific behavior that is not covered by built-in detections. Which tool should they use?

Accepted Answer

Custom detection rules in Microsoft 365 Defender. Microsoft 365 Defender provides a 'Custom detection' feature under the 'Advanced hunting' section that allows security teams to create custom detection rules based on Kusto Query Language (KQL) queries. This is the correct tool because the question specifies creating a detection for behavior not covered by built-in detections within the Microsoft 365 Defender ecosystem, and custom detection rules are designed exactly for that purpose—they run on a schedule and generate alerts when the custom query matches.

Answer

Microsoft Sentinel analytics rules

Answer

Azure AD Identity Protection user risk policies

Answer

Microsoft Defender for Cloud Apps policies

Question 8

A company is planning their cloud governance strategy. They have multiple business units with varying compliance requirements. They need to enforce policies consistently across subscriptions while allowing some flexibility. Which Azure governance structure should they recommend?

Accepted Answer

Use a management group hierarchy with Azure Policy assignments and exemptions.. B is correct because a management group hierarchy allows the company to organize subscriptions by business unit or compliance requirement, then apply Azure Policy assignments at the management group level to enforce consistent policies across all subscriptions. Exemptions can be granted at lower scopes (e.g., specific subscriptions or resource groups) to provide the required flexibility while maintaining overall governance. This structure centralizes policy enforcement without requiring separate tenants or manual RBAC assignments.

Answer

Assign RBAC roles to each subscription owner.

Answer

Create separate Azure AD tenants for each business unit.

Answer

Use Azure Blueprints with locked permissions.

Question 9

A company is designing a security operations center (SOC) using Microsoft Sentinel. Which TWO of the following are best practices for managing incident response in Sentinel?

Accepted Answer

Use automation rules and playbooks to automate common response actions.. Option B is correct because automation rules and playbooks in Microsoft Sentinel allow you to automate common incident response actions, such as triggering investigations, sending notifications, or running remediation scripts. This reduces manual effort, ensures consistent response, and accelerates mean time to respond (MTTR), which is a core best practice for SOC operations.

Answer

Create multiple Sentinel workspaces for each incident type.

Answer

Manually classify all incidents to ensure accuracy.

Answer

Use a single data connector for all log sources.

Question 10

A company is implementing a Zero Trust security model using Microsoft 365 Defender. Which THREE of the following are key principles they should follow?

Accepted Answer

Use least privilege access by limiting user permissions with Just-In-Time and Just-Enough-Access.. Option B is correct because Zero Trust mandates least privilege access, and Microsoft 365 Defender integrates with Azure AD Privileged Identity Management (PIM) to enforce Just-In-Time (JIT) and Just-Enough-Access (JEA) policies. This ensures users receive only the permissions necessary for a specific task, for a limited duration, reducing the risk of lateral movement and privilege escalation.

Answer

Trust all traffic originating from within the corporate network.

Answer

Provide implicit trust to known users and devices.

Question 11

A company wants to improve their security posture by using Microsoft Defender for Cloud. Which TWO of the following are features of Defender for Cloud that help with governance and compliance?

Accepted Answer

Regulatory compliance dashboard. The Regulatory compliance dashboard in Defender for Cloud provides continuous monitoring of your Azure and hybrid workloads against industry standards like SOC 2, ISO 27001, PCI DSS, and Azure CIS. It dynamically tracks compliance posture over time, highlights non-compliant resources, and maps controls to specific assessments, directly supporting governance and compliance workflows.

Answer

Azure Blueprints

Answer

Azure Policy

Answer

Microsoft Sentinel

Question 12

A company uses Microsoft Sentinel for threat detection. They want to use User and Entity Behavior Analytics (UEBA) to detect anomalies. Which THREE of the following are key components of UEBA in Sentinel?

Accepted Answer

UEBA analytics rules that baseline normal behavior.. Option A is correct because UEBA in Microsoft Sentinel relies on analytics rules that establish a baseline of normal behavior for users and entities. These rules use machine learning to detect deviations from the established baseline, enabling the identification of anomalous activities such as unusual sign-in locations or data exfiltration attempts.

Answer

Playbooks for automated response to anomalies.

Answer

Azure AD sign-in logs

Question 13

You are the security architect for a large financial services company. The company has a hybrid environment with on-premises Active Directory, Azure AD, and multiple Azure subscriptions. They use Microsoft Sentinel as their SIEM and have deployed Microsoft Defender for Cloud to assess their cloud security posture. Recently, the security team discovered that a critical Azure SQL database was exposed to the internet with a firewall rule allowing 'AllowAllWindowsAzureIps'. This misconfiguration was not flagged by Defender for Cloud because the corresponding recommendation was disabled in the security policy. The company wants to prevent such misconfigurations in the future and ensure that all critical resources are covered by security recommendations. They also need to ensure that any changes to security policies are reviewed and approved. Which of the following actions should you recommend as the most comprehensive solution?

Accepted Answer

Review and enable all relevant security recommendations in Defender for Cloud, and implement a change management process using Azure Policy and a custom workflow that requires approval before modifying security policies.. Option A is correct because it addresses the root cause—disabled security recommendations—by enabling all relevant recommendations in Defender for Cloud, and it enforces a change management process using Azure Policy with a custom approval workflow. This ensures that any modifications to security policies are reviewed and approved, preventing future misconfigurations like the 'AllowAllWindowsAzureIps' rule from going unnoticed. The combination of policy enforcement and approval workflow provides a comprehensive, automated governance layer that covers both detection and prevention.

Answer

Deploy Azure Monitor alerts on all SQL Server firewall rule changes and instruct the security team to manually review each change.

Answer

Assign the Contributor role to the security team on the subscription so they can directly modify firewall rules if needed.

Answer

Enable the specific recommendation for SQL Server firewall rules in Defender for Cloud and set up an automation rule to send alerts when the recommendation is triggered.

Question 14

A global organization uses Microsoft Sentinel for SIEM and Microsoft Defender for Cloud for cloud security posture management. The security team notices that critical alerts from Azure Active Directory Identity Protection are not triggering automated response playbooks in Sentinel. The team needs to ensure that all high-severity Identity Protection risk detections automatically create incidents in Sentinel and trigger a playbook to block the user. What should the team configure?

Accepted Answer

Enable the Identity Protection data connector and create a Microsoft Security incident creation rule for Identity Protection.. Option A is correct because to have Identity Protection risk detections automatically create incidents in Microsoft Sentinel and trigger a playbook, you must first enable the Identity Protection data connector (which brings the alerts into Sentinel) and then create a Microsoft Security incident creation rule specifically for Identity Protection. This rule ingests the alerts as security incidents, and you can attach an automation rule to run a playbook (e.g., to block the user) when a high-severity incident is created. Without the incident creation rule, the alerts would be ingested as raw events but not automatically turned into incidents.

Answer

Enable the Azure Active Directory Identity Protection data connector in Sentinel.

Answer

Configure diagnostic settings on Azure AD to stream logs to Sentinel and create a playbook automation rule.

Answer

Configure the Identity Protection connector with the 'Create incidents' toggle enabled.

Question 15

A company is designing a security operations strategy using Microsoft Sentinel. They want to prioritize triage of incidents that involve critical assets. The SOC manager suggests using the entity behavior analytics feature. Which capability of entity behavior analytics helps achieve this goal?

Accepted Answer

It profiles entities and assigns an anomaly score based on deviations from baseline behaviors.. Entity behavior analytics (UEBA) in Microsoft Sentinel profiles entities such as users, hosts, or applications by establishing baseline behaviors over time. It then assigns an anomaly score to deviations from that baseline, enabling SOC analysts to prioritize incidents involving critical assets based on unusual activity rather than static rules. This directly supports the goal of triaging incidents by highlighting anomalous behavior on high-value targets.

Answer

It combines multiple alerts into a single incident using Fusion.

Answer

It uses threat intelligence to correlate with known bad actors.

Answer

It automatically groups incidents by severity and asset criticality.