SC-100 Design security operations, identity, and compliance capabilities — 20 Questions

Question 1

Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents. Which feature should you configure?

Accepted Answer

Configure an automation rule to run a playbook automatically. Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, including running playbooks (Azure Logic Apps workflows) automatically. This is the correct approach for automatically responding to high-severity incidents because it eliminates manual intervention and ensures consistent, immediate action based on incident properties like severity.

Answer

Create a playbook and run it manually for each incident

Answer

Set up an analytics rule with automatic response

Answer

Use a workbook to trigger a playbook

Question 2

A company plans to implement Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from sharing credit card numbers via email. What should they configure?

Accepted Answer

Create a DLP policy that detects and blocks credit card numbers in Exchange Online. Option C is correct because Microsoft Purview Data Loss Prevention (DLP) policies can be configured to detect sensitive data types, such as credit card numbers, in Exchange Online emails. When a DLP policy is created with a rule that identifies credit card numbers and blocks the email from being sent, it directly prevents users from sharing that data via email. This is the native mechanism for enforcing DLP on email traffic in Microsoft 365.

Answer

Create a sensitivity label and apply it to emails

Answer

Enable communication compliance policies

Answer

Configure a retention policy for email

Question 3

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) resources are assessed against the same security baseline. What should you do?

Accepted Answer

Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark. Microsoft Defender for Cloud can assess resources from Azure, AWS, and GCP using security policies. By default, Azure Policy is used for Azure resources. To assess AWS and GCP, you need to connect those cloud accounts to Defender for Cloud and then use Azure Policy to enforce standards like Microsoft Cloud Security Benchmark. Option A is wrong because the CSPM plan assesses posture but does not use a single baseline across clouds. Option C is wrong because regulatory compliance standards apply to specific regulations, not custom baselines. Option D is wrong because AWS Config and GCP Security Command Center are separate tools, not integrated into a single baseline.

Answer

Configure AWS Config and GCP Security Command Center to export findings to Microsoft Sentinel

Answer

Use regulatory compliance standards for each cloud separately

Answer

Enable the Cloud Security Posture Management (CSPM) plan and configure AWS and GCP connectors

Question 4

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires compliant device. Option A is correct because a Conditional Access policy in Microsoft Entra ID (formerly Azure AD) can enforce the requirement that only devices marked as compliant by Intune can access corporate email. This policy evaluates the device compliance status at authentication time and blocks or grants access based on that signal, ensuring that only managed and compliant devices can connect to services like Exchange Online.

Answer

Set up enrollment restrictions in Intune

Answer

Create a device configuration policy that blocks non-compliant devices

Answer

Configure an app protection policy for email apps

Question 5

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Users have smartphones. Which method should you recommend as the primary authentication method?

Accepted Answer

Microsoft Authenticator app with passwordless sign-in. The Microsoft Authenticator app with passwordless sign-in is the correct primary method because it leverages the user's smartphone to provide a seamless, phishing-resistant authentication experience using public/private key cryptography (FIDO2/WebAuthn). This method aligns with the organization's goal of eliminating passwords while utilizing existing smartphone hardware, and it supports a simple user experience by requiring only a biometric or PIN verification on the phone.

Answer

FIDO2 security keys

Answer

SMS-based authentication

Answer

Windows Hello for Business

Question 6

Your organization uses Microsoft Sentinel to aggregate logs from on-premises and cloud sources. You need to reduce the cost of data ingestion while ensuring security-critical logs are retained for at least one year. What should you do?

Accepted Answer

Ingress security-critical logs to the Analytics logs tier with 365-day retention, and other logs to the Auxiliary logs tier with shorter retention. Option B is correct because it leverages the Analytics logs tier for security-critical logs, which supports full KQL query capabilities and allows setting a 365-day retention period to meet compliance requirements. Other logs can be sent to the Auxiliary logs tier (formerly Basic logs), which offers lower ingestion costs and shorter retention, reducing overall data ingestion expenses while still retaining necessary logs for security analysis.

Answer

Archive all logs to Azure Storage after 90 days

Answer

Use the Basic logs tier for all logs and set retention to 365 days

Answer

Set the default retention to 30 days and export logs to Log Analytics Workspace

Question 7

Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in emails. What should you configure?

Accepted Answer

Safe Links policy. Safe Links policy is the correct answer because it specifically protects users from malicious links in emails by scanning URLs at the time of click, checking against Microsoft's threat intelligence, and optionally rewriting links to route clicks through the Safe Links service. This is the dedicated Defender for Office 365 feature designed to mitigate link-based attacks in email messages.

Answer

Anti-malware policy

Answer

Anti-phishing policy

Answer

Safe Attachments policy

Question 8

Your organization uses Microsoft Entra ID and needs to ensure that external partners can access only specific applications for 30 days. What should you configure?

Accepted Answer

Entitlement management and create an access package with an expiration of 30 days. Option A is correct because entitlement management in Microsoft Entra ID allows you to create access packages that govern external partner access to specific applications. By configuring an access package with a 30-day expiration, you enforce time-limited access, ensuring partners can only access the designated applications for the required duration. This directly meets the requirement of restricting access to specific apps with a defined expiry.

Answer

B2B direct connect

Answer

Self-service group management

Answer

Conditional Access policy with session control

Question 9

Your organization uses Microsoft Defender XDR for detection and response. You need to create a custom detection rule that alerts when a user performs more than 10 failed sign-ins from different countries within 5 minutes. Which component should you use?

Accepted Answer

Custom detection rule in Microsoft 365 Defender. Custom detection rules in Microsoft 365 Defender allow you to define advanced hunting queries that trigger alerts based on specific event patterns, such as more than 10 failed sign-ins from different countries within 5 minutes. This is the correct component because it operates directly on data within the Defender XDR ecosystem (e.g., AADSignInEventsBeta) without requiring data ingestion into Sentinel.

Answer

Automation rule in Microsoft Sentinel

Answer

Analytics rule in Microsoft Sentinel

Answer

Attack simulation training

Question 10

Your organization uses Microsoft Purview to classify sensitive data. You need to automatically apply a sensitivity label to documents that contain personally identifiable information (PII). Which TWO components should you configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policy (A) is correct because it automatically applies sensitivity labels to documents based on conditions such as the presence of sensitive data types (e.g., PII). Sensitivity label (D) is correct because it defines the classification and protection settings (e.g., encryption, markings) that are applied to the content. Together, they enable automatic classification of PII documents without manual user intervention.

Answer

Retention label

Answer

Data Loss Prevention (DLP) policy

Answer

Trainable classifier

Question 11

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a unified security operations platform. Which THREE capabilities should you enable?

Accepted Answer

Microsoft Defender XDR incident integration with Sentinel. Option C is correct because Microsoft Defender XDR incident integration with Sentinel creates a unified security operations platform by automatically synchronizing high-fidelity alerts and incidents from Defender XDR into Sentinel. This enables security teams to correlate endpoint, email, identity, and cloud app signals within a single SIEM, reducing alert fatigue and accelerating incident response through automated orchestration.

Answer

Azure Policy for security controls

Answer

Microsoft Purview Information Protection

Question 12

Your organization uses Microsoft Entra ID and needs to implement a Zero Trust identity strategy. Which THREE principles should you apply?

Accepted Answer

Use least privilege access. Option A is correct because least privilege access is a core Zero Trust principle that ensures users, devices, and services are granted only the minimum permissions necessary to perform their tasks. In Microsoft Entra ID, this is implemented through features like Privileged Identity Management (PIM), Conditional Access policies, and role-based access control (RBAC) to reduce the attack surface and limit lateral movement.

Answer

Trust implicitly

Answer

Use a single authentication method

Question 13

Your organization is implementing a zero-trust security model and needs to ensure that all access to cloud resources is verified in real-time. You plan to use Microsoft Entra ID Conditional Access. Which policy component enforces real-time verification of user identity and device compliance before granting access?

Accepted Answer

Conditional Access policy with conditions and grant controls. Conditional Access policies with conditions and grant controls enforce real-time verification by evaluating signals such as user identity, device compliance (via Microsoft Intune), and location before allowing access to cloud resources. The grant controls block or require multi-factor authentication (MFA) or device compliance, ensuring zero-trust principles of explicit verification and least privilege.

Answer

Enable Microsoft Secure Score

Answer

Use Azure AD Application Proxy

Answer

Assign users and groups to the policy

Question 14

Your company uses Microsoft Defender for Cloud to manage security posture across hybrid workloads. You need to ensure that critical vulnerabilities found on Azure VMs are automatically remediated without manual intervention. Which feature should you enable?

Accepted Answer

Enable 'Remediate' for security recommendations in Defender for Cloud. Option A is correct because Microsoft Defender for Cloud's 'Remediate' feature allows you to automatically apply the necessary configuration changes or deploy the required patches to fix critical vulnerabilities on Azure VMs without manual intervention. This is achieved by enabling the 'Remediate' option on specific security recommendations, which triggers an automated workflow (often using Azure Policy or a custom script) to resolve the identified issue. This directly addresses the requirement for automatic remediation of critical vulnerabilities.

Answer

File Integrity Monitoring (FIM)

Answer

Microsoft Defender for Cloud's Regulatory Compliance dashboard

Answer

Azure Automation Update Management

Question 15

Your organization uses Microsoft Sentinel to centralize security logs from multiple clouds. The security team needs a solution that automatically investigates low-fidelity alerts and creates incidents only when confirmed malicious. Which Microsoft Sentinel feature should you configure?

Accepted Answer

Entity behavior analytics (UEBA) with automated investigation. Entity behavior analytics (UEBA) with automated investigation is the correct choice because it profiles normal user and entity behavior, then automatically investigates low-fidelity alerts by correlating them with historical baselines. When the investigation confirms malicious activity, it escalates to an incident, reducing noise and manual triage.

Answer

Automation rules with playbooks

Answer

Machine Learning (ML) based anomaly detection

Answer

Custom analytic rules

Question 16

Your company is deploying Microsoft Intune for mobile device management. You need to ensure that corporate data on personally owned devices is protected without affecting the user's personal data. Which Intune feature should you use?

Accepted Answer

App Protection Policies (MAM). App Protection Policies (MAM) are the correct choice because they allow you to manage and protect corporate data within applications on personally owned devices without requiring device enrollment. This ensures that corporate data is encrypted, can be selectively wiped, and is prevented from being copied to personal apps, while leaving the user's personal data untouched.

Answer

Device compliance policies

Answer

Conditional Access for app control

Answer

Windows Autopilot

Question 17

Your organization is implementing a data loss prevention (DLP) strategy using Microsoft Purview. The compliance team needs to automatically classify and label sensitive data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct choice because it provides unified data governance across hybrid and multi-cloud environments, including Microsoft 365, Azure SQL Database, and Amazon S3. It automatically scans, classifies, and labels sensitive data using built-in classifiers and sensitivity labels, enabling consistent DLP policies across these disparate data sources.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Records Management

Answer

Microsoft Defender for Cloud Apps

Question 18

Your organization uses Microsoft Defender XDR to detect and respond to threats. The SOC team wants to automatically isolate a device when a high-severity incident is confirmed. Which automation feature should you configure?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender XDR is designed to automatically respond to confirmed high-severity incidents, including isolating devices, without manual intervention. This feature leverages playbooks and machine learning to contain threats rapidly, aligning with the SOC's requirement for automatic isolation upon incident confirmation.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Manual device isolation from Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint's endpoint detection and response (EDR)

Question 19

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate using their existing on-premises credentials while gradually moving to cloud-only authentication. Which authentication method should you implement first?

Accepted Answer

Password Hash Synchronization (PHS) with Seamless SSO. Password Hash Synchronization (PHS) quickly syncs password hashes and allows Seamless SSO. Option B is correct. Option A requires more infrastructure. Option C is for federation. Option D is a broader strategy, not a method.

Answer

Azure AD Connect

Answer

Active Directory Federation Services (AD FS)

Answer

Pass-through Authentication (PTA)

Question 20

Your organization uses Microsoft Sentinel as a SIEM. The security team wants to use Microsoft Copilot for Security to assist in incident investigation. You need to ensure that Copilot can access Sentinel data while meeting compliance requirements. Which integration should you configure?

Accepted Answer

Enable Microsoft Copilot for Security plugin for Sentinel. The Microsoft Copilot for Security plugin for Sentinel is the correct integration because it enables Copilot to directly query and analyze Sentinel data through a native, compliant connection. This plugin uses Sentinel's API and role-based access control (RBAC) to ensure that Copilot only accesses data the user is authorized to see, meeting compliance requirements without additional data movement.

Answer

Deploy a playbook to query Sentinel data

Answer

Enable Sentinel's Threat Intelligence connectors

Answer

Use Microsoft Defender for Cloud