SC-100 Design security operations, identity, and compliance capabilities — 100 Questions

Question 1

Your organization uses Microsoft Purview to classify sensitive data. You need to automatically apply a sensitivity label to documents that contain personally identifiable information (PII). Which TWO components should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Auto-labeling policy. Auto-labeling policy (A) is correct because it automatically applies sensitivity labels to documents based on conditions such as the presence of sensitive data types (e.g., PII). Sensitivity label (D) is correct because it defines the classification and protection settings (e.g., encryption, markings) that are applied to the content. Together, they enable automatic classification of PII documents without manual user intervention.

Answer

Retention label

Answer

Data Loss Prevention (DLP) policy

Answer

Trainable classifier

Question 2

Your company uses Microsoft Defender for Cloud to manage security posture across hybrid workloads. You need to ensure that critical vulnerabilities found on Azure VMs are automatically remediated without manual intervention. Which feature should you enable?

Accepted Answer

Enable 'Remediate' for security recommendations in Defender for Cloud. Microsoft Defender for Cloud's 'Remediate' feature allows you to automatically apply the necessary configuration changes or deploy the required patches to fix critical vulnerabilities on Azure VMs without manual intervention. This is achieved by enabling the 'Remediate' option on specific security recommendations, which triggers an automated workflow (often using Azure Policy or a custom script) to resolve the identified issue. This directly addresses the requirement for automatic remediation of critical vulnerabilities.

Answer

File Integrity Monitoring (FIM)

Answer

Microsoft Defender for Cloud's Regulatory Compliance dashboard

Answer

Azure Automation Update Management

Question 3

Your organization uses Microsoft Sentinel to centralize security logs from multiple clouds. The security team needs a solution that automatically investigates low-fidelity alerts and creates incidents only when confirmed malicious. Which Microsoft Sentinel feature should you configure?

Accepted Answer

Entity behavior analytics (UEBA) with automated investigation. Entity behavior analytics (UEBA) with automated investigation is the correct choice because it profiles normal user and entity behavior, then automatically investigates low-fidelity alerts by correlating them with historical baselines. When the investigation confirms malicious activity, it escalates to an incident, reducing noise and manual triage.

Answer

Automation rules with playbooks

Answer

Machine Learning (ML) based anomaly detection

Answer

Custom analytic rules

Question 4

Your organization uses Microsoft Defender XDR to detect and respond to threats. The SOC team wants to automatically isolate a device when a high-severity incident is confirmed. Which automation feature should you configure?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender XDR is designed to automatically respond to confirmed high-severity incidents, including isolating devices, without manual intervention. This feature leverages playbooks and machine learning to contain threats rapidly, aligning with the SOC's requirement for automatic isolation upon incident confirmation.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Manual device isolation from Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint's endpoint detection and response (EDR)

Question 5

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate using their existing on-premises credentials while gradually moving to cloud-only authentication. Which authentication method should you implement first?

Accepted Answer

Password Hash Synchronization (PHS) with Seamless SSO. Password Hash Synchronization (PHS) with Seamless SSO is the correct first step because it synchronizes on-premises password hashes to Microsoft Entra ID, allowing users to authenticate with their existing credentials directly against Entra ID while the organization gradually transitions to cloud-only authentication. Seamless SSO then provides a smooth sign-in experience for domain-joined devices without additional prompts. PHS also enables leaked-credential detection and simplifies the environment by removing dependency on on-premises authentication infrastructure. Microsoft Entra Connect is the synchronization tool that enables PHS but is not itself an authentication method, AD FS is a more complex federated setup that keeps authentication on-premises and is harder to retire, and Pass-through Authentication still depends on on-premises agents for every sign-in, making it less aligned with a gradual move to cloud-only authentication.

Answer

Azure AD Connect

Answer

Active Directory Federation Services (AD FS)

Answer

Pass-through Authentication (PTA)

Question 6

Your organization needs to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. You plan to use Microsoft Entra ID Conditional Access. Which grant control should you configure?

Accepted Answer

Require multi-factor authentication. The question specifies a requirement to enforce MFA for all users accessing sensitive applications. In Microsoft Entra ID Conditional Access, the 'Require multi-factor authentication' grant control directly enforces Microsoft Entra ID MFA (e.g., via Microsoft Authenticator, OATH tokens, or SMS) as the primary authentication method. This is the simplest and most direct control to meet the stated goal of requiring MFA, without adding additional constraints like device compliance or authentication strength levels.

Answer

Require authentication strength (e.g., phishing-resistant MFA)

Answer

Require device to be marked as compliant

Answer

Use app enforced restrictions

Question 7

Your organization is implementing a privileged access strategy using Microsoft Entra ID. You need to provide just-in-time (JIT) access to Azure resources for administrators. Which TWO features should you use?

Accepted Answer

Privileged Access Groups (PAG). Privileged Access Groups (PAG) provide just-in-time activation of group membership that can be assigned to Azure RBAC roles, enabling JIT access to Azure resources. PIM for Microsoft Entra ID roles is specifically for Microsoft Entra ID roles and does not directly manage Azure resource access.

Answer

Identity Protection user risk policy

Answer

Privileged Identity Management (PIM) for Azure AD roles

Answer

Azure RBAC roles

Answer

Access reviews

Question 8

Your organization is using Microsoft Sentinel to detect advanced threats. You need to ensure that alerts from Microsoft Defender XDR are automatically synchronized with Sentinel and that incidents are created. Which THREE components are required?

Accepted Answer

Microsoft Defender XDR data connector. Option B is correct because the Microsoft Defender XDR data connector is the mechanism that ingests and synchronizes alerts (and their associated incidents) from Defender XDR into Microsoft Sentinel; without this connector, no Defender XDR alerts would flow into the workspace. Option D is correct because an analytic rule is required to generate incidents in Sentinel from the ingested alerts, since the connector alone streams data but does not itself create Sentinel incidents. Option E is correct because an automation rule is needed to act on those incidents (for example, setting incident severity automatically), which is part of ensuring incidents are properly created and managed in the required state. Option A is not required because UEBA is an optional enrichment capability and is not necessary for Defender XDR alert synchronization or incident creation. Option C is not required because an automation rule that triggers a playbook is only needed if you want automated response actions, not for synchronizing alerts or creating incidents.

Answer

Entity behavior analytics (UEBA)

Answer

Automation rule to trigger playbook

Question 9

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. The policy is intended to block legacy authentication. However, users are still able to access email using Outlook (modern auth). What is the most likely reason?

Accepted Answer

The clientAppTypes list does not include 'modernAuth'. The 'clientAppTypes' list in the Conditional Access policy must include 'modernAuth' to explicitly target and block modern authentication clients. Without this entry, the policy only applies to legacy authentication protocols (e.g., POP, IMAP, SMTP), leaving modern auth flows (like Outlook using OAuth 2.0) unaffected. The JSON snippet shows 'clientAppTypes': ['exchangeActiveSync', 'other'], which omits 'modernAuth', so Outlook (modern auth) bypasses the block.

Answer

The policy does not include 'Microsoft Office 365' in applications

Answer

The grant control should be 'require MFA' instead of 'block'

Answer

The policy state is set to 'enabled' incorrectly

Question 10

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. The security team requires that only HTTPS traffic is allowed and that TLS 1.2 is enforced. Does this template meet the requirements?

Accepted Answer

Yes, the template correctly enforces HTTPS and TLS 1.2. The ARM template sets 'supportsHttpsTrafficOnly' to true, which enforces HTTPS-only traffic, and 'minimumTlsVersion' to 'TLS1_2', which enforces TLS 1.2 as the minimum protocol version. These two properties together fully satisfy the security team's requirement that only HTTPS traffic is allowed and TLS 1.2 is enforced.

Answer

No, because 'minimumTlsVersion' should be 'TLS1_0'

Answer

No, because 'supportsHttpsTrafficOnly' should be false

Answer

No, because 'defaultAction': 'Deny' blocks all traffic including HTTPS

Question 11

A company uses Microsoft Defender for Cloud to assess the security posture of their hybrid environment. They need to ensure that all Azure subscriptions are evaluated against the same set of regulatory compliance standards. What should they configure?

Accepted Answer

Assign the regulatory compliance standard to the management group containing all subscriptions. Regulatory compliance standards in Microsoft Defender for Cloud are assigned at the management group scope, which automatically applies the standard to all subscriptions within that management group. This ensures consistent evaluation across the entire hybrid environment without needing per-subscription configuration. The assignment inherits down the hierarchy, so all subscriptions under the management group are assessed against the same compliance framework.

Answer

Assign the standard to each subscription individually

Answer

Create an Azure Policy initiative and assign it to the management group

Answer

Use Microsoft Defender for Cloud's default policy

Question 12

Your organization has Microsoft Entra ID (Azure AD) and uses Privileged Identity Management (PIM). You need to ensure that when a user activates a privileged role, they must provide a reason and a ticket number. What should you configure?

Accepted Answer

PIM role settings requiring justification and approval on activation. PIM role settings allow you to configure activation requirements, including mandatory justification (reason) and ticket number. By editing the role settings in PIM, you can enforce that users provide both a reason and a ticket number when activating a privileged role, ensuring auditability and compliance.

Answer

Conditional Access policy requiring multi-factor authentication

Answer

An access review for the privileged role

Answer

Microsoft Entra Identity Protection user risk policy

Question 13

Refer to the exhibit. You are configuring a Microsoft Purview sensitivity label. When a user applies this label to an email, what happens?

Accepted Answer

The email is encrypted and cannot be forwarded, printed, or copied. The sensitivity label is configured with encryption that includes the 'Do Not Forward' option. This applies Azure Rights Management (Azure RMS) protection, which encrypts the email and restricts the recipient from forwarding, printing, or copying the content. The label enforces these restrictions at the message level, regardless of the email client used.

Answer

The email is encrypted but can be forwarded

Answer

The email is not encrypted but cannot be forwarded

Answer

The email is encrypted and the recipient cannot reply

Question 14

Which TWO configurations are required to enable Microsoft Defender for Cloud Apps to monitor cloud app usage?

Accepted Answer

Add app connectors for the cloud apps you want to monitor. A is correct because Microsoft Defender for Cloud Apps requires app connectors to establish API-based connections with cloud applications (e.g., Office 365, Salesforce, AWS). These connectors enable the service to ingest activity logs, file metadata, and user sessions for monitoring and threat detection. Without app connectors, Defender for Cloud Apps cannot access the cloud app's data plane to perform its core monitoring functions.

Answer

Configure Microsoft Intune device compliance policies

Answer

Deploy Azure Information Protection scanner

Answer

Synchronize with Microsoft Entra ID

Question 15

Your organization uses Microsoft Sentinel as a SIEM. You need to reduce the cost of data ingestion while ensuring that security-relevant events are retained. You have identified that Windows Event ID 4624 (successful logon) produces a high volume of logs. What should you do?

Accepted Answer

Configure the analytics connector to ingest these events as basic logs. Microsoft Sentinel supports 'basic logs' ingestion, which is a lower-cost tier designed for high-volume, verbose logs like Windows Event ID 4624. Basic logs are stored in the same table but with a reduced retention period (default 30 days) and still retain the full event data, enabling cost savings while preserving the ability to query for security incidents. This approach avoids the need to filter or drop events entirely, ensuring compliance with security monitoring requirements.

Answer

Reduce the retention period for all logs to 30 days

Answer

Ingest the events into a separate Log Analytics workspace with a shorter retention

Answer

Filter out Event ID 4624 at the source using Windows Event Forwarding

Question 16

Your organization uses Microsoft Defender for Cloud to manage the security posture of Azure resources. You need to receive alerts when a virtual machine is deployed without just-in-time (JIT) access enabled. What should you do?

Accepted Answer

Use the built-in Defender for Cloud recommendation for JIT access. Microsoft Defender for Cloud provides a built-in security recommendation specifically for just-in-time (JIT) VM access. This recommendation continuously assesses your VMs and generates an alert when a VM is deployed without JIT enabled, without requiring custom rules or manual configuration. It directly addresses the requirement to receive alerts for non-compliant VMs.

Answer

Create a custom alert rule in Microsoft Sentinel

Answer

Configure JIT access on the VM and monitor via activity logs

Answer

Enable JIT access on all VMs

Question 17

A company uses Microsoft Sentinel for security operations. The security team wants to automatically create an incident in Microsoft Sentinel when Microsoft Defender for Cloud detects a high-severity vulnerability on a virtual machine. What should the security team configure?

Accepted Answer

Create an analytics rule with a rule template that maps to the Defender for Cloud alert.. Microsoft Sentinel can ingest high-severity vulnerability alerts from Microsoft Defender for Cloud via the SecurityAlert analytics rule template. When you enable this built-in rule template, Sentinel automatically creates an incident for each Defender for Cloud alert that matches the configured severity (e.g., High). This is the native, out-of-the-box method to convert Defender for Cloud alerts into Sentinel incidents without requiring custom logic or external orchestration.

Answer

Create an automation rule in Microsoft Sentinel.

Answer

Create a playbook in Microsoft Sentinel.

Answer

Create a watchlist in Microsoft Sentinel.

Question 18

A global organization uses Microsoft Entra ID with Conditional Access policies. They want to enforce multifactor authentication (MFA) for all users accessing sensitive apps from outside the corporate network, but allow access without MFA from trusted IPs. What should they configure?

Accepted Answer

Create a Conditional Access policy that includes 'All users' and 'All cloud apps', with conditions for locations: include 'All trusted' and exclude 'All trusted'? Wait, correct approach: include 'All locations' and exclude 'Trusted IPs', and require MFA.. It configures a Conditional Access policy that includes 'All locations' as a condition and excludes 'Trusted IPs' (defined as named locations in Entra ID), then requires MFA as a grant control. This enforces MFA for all access attempts from outside the corporate network while allowing access without MFA from trusted IPs, precisely matching the requirement.

Answer

Create a Conditional Access policy that grants access, requiring MFA for all locations.

Answer

Create a Conditional Access policy that requires MFA for all users and all locations.

Answer

Create a Conditional Access policy that blocks access from all locations except trusted IPs.

Question 19

A company uses Microsoft Purview to enforce Data Loss Prevention (DLP) policies. They want to prevent users from sharing credit card numbers via email. Which action should they configure in the DLP policy?

Accepted Answer

Block with override.. Configuring 'Block with override' allows the DLP policy to block the email containing credit card numbers while permitting users to override the block with a business justification. This balances security with operational flexibility, ensuring sensitive data is not shared without authorization while avoiding unnecessary disruption.

Answer

Audit only.

Answer

Notify only.

Answer

Block.

Question 20

Refer to the exhibit. An organization uses Microsoft Entra ID Governance. This access review policy is intended to review guest users created after January 1, 2025. The reviewers are users with job title 'Manager'. However, the review is not starting automatically. What is the most likely cause?

Accepted Answer

The recurrence is not configured.. The recurrence is not configured. In Microsoft Entra ID Governance access reviews, a review only starts automatically when a recurrence (for example, quarterly or annually) is defined in the review's schedule settings; without a recurrence, the review must be started manually and will never launch on its own. The other options do not fit this scenario: A would prevent reviewers from being assigned but would not stop the review from starting, C is not a real Entra access review setting, and D would typically cause a configuration error or an empty scope rather than silently preventing the automatic start.

Answer

The reviewer query returns no users.

Answer

The autoReviewEnabled setting is false.

Answer

The scope query syntax is incorrect.