SC-100 Design security operations, identity, and compliance capabilities — 10 Questions

Question 1

Your organization uses Microsoft Purview to classify sensitive data. You need to automatically apply a sensitivity label to documents that contain personally identifiable information (PII). Which TWO components should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Auto-labeling policy. Auto-labeling policy (A) is correct because it automatically applies sensitivity labels to documents based on conditions such as the presence of sensitive data types (e.g., PII). Sensitivity label (D) is correct because it defines the classification and protection settings (e.g., encryption, markings) that are applied to the content. Together, they enable automatic classification of PII documents without manual user intervention.

Answer

Retention label

Answer

Data Loss Prevention (DLP) policy

Answer

Trainable classifier

Question 2

Your company uses Microsoft Defender for Cloud to manage security posture across hybrid workloads. You need to ensure that critical vulnerabilities found on Azure VMs are automatically remediated without manual intervention. Which feature should you enable?

Accepted Answer

Enable 'Remediate' for security recommendations in Defender for Cloud. Microsoft Defender for Cloud's 'Remediate' feature allows you to automatically apply the necessary configuration changes or deploy the required patches to fix critical vulnerabilities on Azure VMs without manual intervention. This is achieved by enabling the 'Remediate' option on specific security recommendations, which triggers an automated workflow (often using Azure Policy or a custom script) to resolve the identified issue. This directly addresses the requirement for automatic remediation of critical vulnerabilities.

Answer

File Integrity Monitoring (FIM)

Answer

Microsoft Defender for Cloud's Regulatory Compliance dashboard

Answer

Azure Automation Update Management

Question 3

Your organization uses Microsoft Sentinel to centralize security logs from multiple clouds. The security team needs a solution that automatically investigates low-fidelity alerts and creates incidents only when confirmed malicious. Which Microsoft Sentinel feature should you configure?

Accepted Answer

Entity behavior analytics (UEBA) with automated investigation. Entity behavior analytics (UEBA) with automated investigation is the correct choice because it profiles normal user and entity behavior, then automatically investigates low-fidelity alerts by correlating them with historical baselines. When the investigation confirms malicious activity, it escalates to an incident, reducing noise and manual triage.

Answer

Automation rules with playbooks

Answer

Machine Learning (ML) based anomaly detection

Answer

Custom analytic rules

Question 4

Your organization uses Microsoft Defender XDR to detect and respond to threats. The SOC team wants to automatically isolate a device when a high-severity incident is confirmed. Which automation feature should you configure?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender XDR is designed to automatically respond to confirmed high-severity incidents, including isolating devices, without manual intervention. This feature leverages playbooks and machine learning to contain threats rapidly, aligning with the SOC's requirement for automatic isolation upon incident confirmation.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Manual device isolation from Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint's endpoint detection and response (EDR)

Question 5

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate using their existing on-premises credentials while gradually moving to cloud-only authentication. Which authentication method should you implement first?

Accepted Answer

Password Hash Synchronization (PHS) with Seamless SSO. Password Hash Synchronization (PHS) with Seamless SSO is the correct first step because it synchronizes on-premises password hashes to Microsoft Entra ID, allowing users to authenticate with their existing credentials directly against Entra ID while the organization gradually transitions to cloud-only authentication. Seamless SSO then provides a smooth sign-in experience for domain-joined devices without additional prompts. PHS also enables leaked-credential detection and simplifies the environment by removing dependency on on-premises authentication infrastructure. Microsoft Entra Connect is the synchronization tool that enables PHS but is not itself an authentication method, AD FS is a more complex federated setup that keeps authentication on-premises and is harder to retire, and Pass-through Authentication still depends on on-premises agents for every sign-in, making it less aligned with a gradual move to cloud-only authentication.

Answer

Azure AD Connect

Answer

Active Directory Federation Services (AD FS)

Answer

Pass-through Authentication (PTA)

Question 6

Your organization needs to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. You plan to use Microsoft Entra ID Conditional Access. Which grant control should you configure?

Accepted Answer

Require multi-factor authentication. The question specifies a requirement to enforce MFA for all users accessing sensitive applications. In Microsoft Entra ID Conditional Access, the 'Require multi-factor authentication' grant control directly enforces Microsoft Entra ID MFA (e.g., via Microsoft Authenticator, OATH tokens, or SMS) as the primary authentication method. This is the simplest and most direct control to meet the stated goal of requiring MFA, without adding additional constraints like device compliance or authentication strength levels.

Answer

Require authentication strength (e.g., phishing-resistant MFA)

Answer

Require device to be marked as compliant

Answer

Use app enforced restrictions

Question 7

Your organization is implementing a privileged access strategy using Microsoft Entra ID. You need to provide just-in-time (JIT) access to Azure resources for administrators. Which TWO features should you use?

Accepted Answer

Privileged Access Groups (PAG). Privileged Access Groups (PAG) provide just-in-time activation of group membership that can be assigned to Azure RBAC roles, enabling JIT access to Azure resources. PIM for Microsoft Entra ID roles is specifically for Microsoft Entra ID roles and does not directly manage Azure resource access.

Answer

Identity Protection user risk policy

Answer

Privileged Identity Management (PIM) for Azure AD roles

Answer

Azure RBAC roles

Answer

Access reviews

Question 8

Your organization is using Microsoft Sentinel to detect advanced threats. You need to ensure that alerts from Microsoft Defender XDR are automatically synchronized with Sentinel and that incidents are created. Which THREE components are required?

Accepted Answer

Microsoft Defender XDR data connector. Option B is correct because the Microsoft Defender XDR data connector is the mechanism that ingests and synchronizes alerts (and their associated incidents) from Defender XDR into Microsoft Sentinel; without this connector, no Defender XDR alerts would flow into the workspace. Option D is correct because an analytic rule is required to generate incidents in Sentinel from the ingested alerts, since the connector alone streams data but does not itself create Sentinel incidents. Option E is correct because an automation rule is needed to act on those incidents (for example, setting incident severity automatically), which is part of ensuring incidents are properly created and managed in the required state. Option A is not required because UEBA is an optional enrichment capability and is not necessary for Defender XDR alert synchronization or incident creation. Option C is not required because an automation rule that triggers a playbook is only needed if you want automated response actions, not for synchronizing alerts or creating incidents.

Answer

Entity behavior analytics (UEBA)

Answer

Automation rule to trigger playbook

Question 9

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. The policy is intended to block legacy authentication. However, users are still able to access email using Outlook (modern auth). What is the most likely reason?

Accepted Answer

The clientAppTypes list does not include 'modernAuth'. The 'clientAppTypes' list in the Conditional Access policy must include 'modernAuth' to explicitly target and block modern authentication clients. Without this entry, the policy only applies to legacy authentication protocols (e.g., POP, IMAP, SMTP), leaving modern auth flows (like Outlook using OAuth 2.0) unaffected. The JSON snippet shows 'clientAppTypes': ['exchangeActiveSync', 'other'], which omits 'modernAuth', so Outlook (modern auth) bypasses the block.

Answer

The policy does not include 'Microsoft Office 365' in applications

Answer

The grant control should be 'require MFA' instead of 'block'

Answer

The policy state is set to 'enabled' incorrectly

Question 10

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. The security team requires that only HTTPS traffic is allowed and that TLS 1.2 is enforced. Does this template meet the requirements?

Accepted Answer

Yes, the template correctly enforces HTTPS and TLS 1.2. The ARM template sets 'supportsHttpsTrafficOnly' to true, which enforces HTTPS-only traffic, and 'minimumTlsVersion' to 'TLS1_2', which enforces TLS 1.2 as the minimum protocol version. These two properties together fully satisfy the security team's requirement that only HTTPS traffic is allowed and TLS 1.2 is enforced.

Answer

No, because 'minimumTlsVersion' should be 'TLS1_0'

Answer

No, because 'supportsHttpsTrafficOnly' should be false

Answer

No, because 'defaultAction': 'Deny' blocks all traffic including HTTPS