SC-100 Evaluate GRC and security operations strategies Practice Test 2 — 15 Questions

Question 1

A SOC team uses Microsoft Sentinel for incident management. They need to ensure that when a high-severity incident is created, a Teams message is sent to the security team and an email is sent to the IT manager. What is the most efficient way to achieve this?

Accepted Answer

Create an automation rule in Sentinel that triggers a playbook to send the notifications.. Option B is correct because automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when an incident is created, allowing you to send a Teams message and an email simultaneously. This is the most efficient, automated approach without manual intervention or modifying the analytics rule itself.

Answer

Configure the analytics rule to send notifications when an incident is created.

Answer

Use a workbook to display incidents and have a manual process to send notifications.

Answer

Enable incident creation in the data connector settings.

Question 2

A company has a hybrid identity infrastructure with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. The security team wants to use Microsoft Defender for Identity (MDI) to detect on-premises attacks. They have installed the MDI sensor on all domain controllers. However, they notice that some alerts are missing. What is the most likely cause?

Accepted Answer

The necessary Windows event logs are not being forwarded to the MDI sensor.. Microsoft Defender for Identity relies on Windows Event Logs (specifically Event ID 4776, 4624, 4648, and others) to detect on-premises attacks such as Pass-the-Hash, Golden Ticket, and DCSync. If these logs are not being forwarded to the MDI sensor (e.g., due to disabled audit policies or log size limits), the sensor cannot analyze the events, resulting in missing alerts. The sensor itself is installed on domain controllers, but it must have access to the relevant security logs to function correctly.

Answer

MDI is not integrated with Microsoft Sentinel.

Answer

Azure AD Connect is not syncing frequently enough.

Answer

The sensor is not licensed for all detection types.

Question 3

A SOC analyst needs to investigate a potential privilege escalation using Azure AD roles. Which Microsoft 365 Defender data source would be most useful to review?

Accepted Answer

Azure Active Directory audit logs. Azure AD audit logs (now part of the Azure Monitor / Microsoft Entra audit logs) are the authoritative source for tracking changes to Azure AD roles, including role assignments, activations of Privileged Identity Management (PIM) roles, and modifications to directory roles. Since the question specifically involves privilege escalation using Azure AD roles, these logs contain the necessary details such as who assigned a role, when, and from which IP address, making them the most directly relevant data source.

Answer

Microsoft 365 Defender identity logs

Answer

Microsoft Defender for Cloud Apps logs

Answer

Microsoft 365 audit logs

Question 4

An organization is planning to use Microsoft Defender for Cloud's regulatory compliance dashboard to track adherence to PCI DSS. The security team wants to ensure that all Azure resources are covered by the compliance assessment. What is the first step?

Accepted Answer

Enable Microsoft Defender for Cloud on all subscriptions and ensure resources are covered.. Option D is correct because to assess compliance, the resources must first be onboarded to Defender for Cloud (enabling enhanced security features). Option A is incorrect because the built-in initiative does not apply automatically without enabling Defender for Cloud coverage. Option B is incorrect because while you can assign a custom initiative, the first step is still to ensure resources are covered. Option C is incorrect because the compliance dashboard shows results only after assessment.

Answer

Configure the compliance dashboard to show PCI DSS controls.

Answer

Create a custom regulatory compliance standard for PCI DSS.

Answer

Enable the built-in PCI DSS policy initiative in Azure Policy.

Question 5

A company has a Microsoft Sentinel workspace that ingests data from multiple sources. The SOC team wants to improve the efficiency of investigating incidents by using UEBA capabilities. Which two actions should the team take to enable and configure UEBA in Sentinel?

Accepted Answer

Set the entity behavior analytics to 'Active' in the Sentinel configuration.. Options B and D are correct. Enabling UEBA is done per workspace (B). Setting the entity behavior analytics to 'Active' enables the feature (D). Option A is incorrect because UEBA is not a data connector; it's a feature enabled in the workspace settings. Option C is incorrect because the analytics rule for UEBA is not a separate rule; UEBA is enabled at the workspace level. Option E is incorrect because time range selection is not part of enabling UEBA; it's part of analytics rule configuration.

Answer

Install the UEBA data connector from the Sentinel content hub.

Answer

Create an analytics rule that uses the UEBA template.

Answer

Define a time range for entity behavior baselines.

Question 6

A company uses Microsoft Defender for Cloud to assess compliance with Azure Security Benchmark (ASB). The security team wants to ensure that all recommendations are being followed. Which three actions should the team take to manage and remediate recommendations effectively?

Accepted Answer

Enable continuous export of compliance data to Log Analytics or Event Hubs.. Option A is correct because enabling continuous export of compliance data to Log Analytics or Event Hubs allows the security team to centralize, query, and monitor compliance data over time. This is essential for tracking the status of all Azure Security Benchmark recommendations, creating custom alerts, and integrating with SIEM or automation workflows, rather than relying on manual checks.

Answer

Manually remediate all high-severity recommendations each month.

Answer

Disable recommendations that are not applicable to the environment.

Question 7

You are the security architect for a multinational corporation that uses Microsoft 365 E5 licenses. The company has deployed Microsoft Sentinel in a central Azure subscription, and all subsidiaries stream their logs to this workspace. The SOC team uses Microsoft 365 Defender to investigate incidents. Recently, the company experienced a sophisticated phishing campaign that bypassed Exchange Online Protection (EOP) and resulted in credential theft for several users. The SOC team manually created incidents in Sentinel for each compromised user. However, they want to automate the creation of Sentinel incidents from Microsoft 365 Defender alerts. Additionally, they want to ensure that when a user is confirmed compromised, a playbook automatically disables the user's account in Azure AD and resets their password. The SOC team has already deployed the Microsoft 365 Defender data connector in Sentinel and enabled streaming of alerts. However, no incidents are being created automatically from Defender alerts. You need to recommend a solution to automate incident creation and response. What should you do?

Accepted Answer

Create a Microsoft Security incident creation rule for Microsoft 365 Defender, and create an automation rule that triggers a playbook to disable the user and reset password.. Option B is correct because it uses a Microsoft Security incident creation rule, which is the proper method to automatically generate Sentinel incidents from Microsoft 365 Defender alerts. The automation rule then triggers a playbook to disable the user in Azure AD and reset their password, fulfilling the automated response requirement. This approach aligns with Sentinel's native integration for Microsoft 365 Defender, where alerts are ingested via the data connector but incidents require a dedicated rule to be created.

Answer

Configure the Microsoft 365 Defender connector to send alerts to a Logic App that creates incidents.

Answer

Enable the Microsoft 365 Defender connector by selecting the 'Create incidents' checkbox.

Answer

Create an analytics rule that queries Microsoft 365 Defender alerts and creates incidents.

Question 8

A company is deploying Microsoft Defender for Cloud to secure their hybrid cloud environment. They need to ensure that regulatory compliance with PCI DSS is continuously monitored and reported. Which solution should they use to automatically assess and report compliance posture?

Accepted Answer

Regulatory compliance dashboard in Microsoft Defender for Cloud. The Regulatory compliance dashboard in Microsoft Defender for Cloud is the correct solution because it provides built-in, automated assessment of compliance against regulatory standards like PCI DSS. It continuously monitors your hybrid cloud environment against the PCI DSS controls, generates a compliance score, and produces detailed reports without requiring custom policy definitions. This dashboard integrates with Azure Policy to map controls to assessments, but the dashboard itself is the dedicated tool for viewing and reporting compliance posture.

Answer

Azure Policy

Answer

Microsoft Purview Information Protection

Answer

Microsoft Entra ID Governance

Question 9

Which THREE of the following are key components of a security operations strategy according to Microsoft's best practices?

Accepted Answer

Detection and analysis. Detection and analysis is a core component of a security operations strategy because it defines how security events are identified, triaged, and investigated. Microsoft's NIST-based SOC maturity model emphasizes continuous monitoring and analytics (e.g., using Microsoft Sentinel analytics rules, UEBA, and threat intelligence) to reduce mean time to detect (MTTD). Without robust detection and analysis, an organization cannot effectively respond to threats.

Answer

Microsoft Sentinel deployment

Answer

Policy and standards development

Question 10

Refer to the exhibit. A security administrator created this Azure Policy definition to prevent unauthorized role assignments. However, SOC analysts are unable to assign the Security Operations Contributor role to new team members. What is the most likely cause?

Accepted Answer

The policy uses the 'deny' effect, which blocks any role assignment for the specified role.. Option D is correct because the Azure Policy definition uses the 'deny' effect, which explicitly blocks any role assignment that matches the specified role definition ID. Since the policy targets the Security Operations Contributor role, any attempt to assign that role—including by SOC analysts—is denied by the policy engine, regardless of permissions.

Answer

The policy is scoped to a management group that does not include the SOC team's subscription.

Answer

The parameter 'principalId' is required but not provided when assigning the policy.

Answer

The role definition ID in the policy does not match the Security Operations Contributor role.

Question 11

Contoso Ltd. is a multinational organization with a hybrid environment consisting of on-premises Active Directory and Azure AD (now Microsoft Entra ID). They use Microsoft Defender for Cloud Apps, Microsoft Sentinel, and Microsoft 365 Defender. The security operations team has noticed that several high-severity alerts from Microsoft 365 Defender are not being forwarded to Microsoft Sentinel, causing delayed response. The team has confirmed that the data connector between Microsoft 365 Defender and Sentinel is enabled and appears healthy. However, only low-severity alerts appear in Sentinel. Further investigation reveals that the Microsoft 365 Defender portal has a configured rule set that suppresses high-severity alerts for certain users deemed low risk. The security operations manager wants to ensure all high-severity alerts are sent to Sentinel without changing the suppression rules in Microsoft 365 Defender, as those rules are required for operational efficiency. What should the team do to ensure high-severity alerts are ingested into Sentinel?

Accepted Answer

In the Microsoft 365 Defender data connector in Sentinel, enable the option to include suppressed alerts.. Option B is correct because the Microsoft 365 Defender data connector in Microsoft Sentinel includes a configuration setting to 'Include suppressed alerts.' Enabling this option forces Sentinel to ingest all alerts from Microsoft 365 Defender, including those that are suppressed by rule sets in the Defender portal. This satisfies the requirement to forward high-severity alerts without modifying the suppression rules that the operations team relies on for operational efficiency.

Answer

Modify the suppression rules in Microsoft 365 Defender to not suppress high-severity alerts.

Answer

Use the Microsoft Graph Security API connector in Sentinel to ingest alerts instead.

Answer

Create a separate Logic App to fetch high-severity alerts from Microsoft 365 Defender API and send them to Sentinel.

Question 12

Order the steps to configure a Conditional Access policy requiring MFA for all users.

Question 13

Order the steps to troubleshoot an Azure VPN gateway connection failure.

Question 14

Match each Microsoft 365 Defender workload to its protection domain.

Question 15

Match each encryption type to its use case in Azure.