SC-100 Design security operations, identity, and compliance capabilities — 20 Questions

Question 1

Your organization uses Microsoft Sentinel to aggregate logs from on-premises and cloud sources. You need to reduce the cost of data ingestion while ensuring security-critical logs are retained for at least one year. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ingress security-critical logs to the Analytics logs tier with 365-day retention, and other logs to the Auxiliary logs tier with shorter retention. Use the Analytics logs tier for security-critical logs because it provides full KQL query capabilities and supports setting 365-day retention to meet compliance. For other logs, use the Auxiliary logs tier (or Basic logs) to reduce ingestion costs while accepting shorter retention and limited query capabilities. This tiered approach balances cost and security requirements.

Answer

Archive all logs to Azure Storage after 90 days

Answer

Use the Basic logs tier for all logs and set retention to 365 days

Answer

Set the default retention to 30 days and export logs to Log Analytics Workspace

Question 2

Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in emails. What should you configure?

Accepted Answer

Safe Links policy. Safe Links policy is the correct answer because it specifically protects users from malicious links in emails by scanning URLs at the time of click, checking against Microsoft's threat intelligence, and optionally rewriting links to route clicks through the Safe Links service. This is the dedicated Defender for Office 365 feature designed to mitigate link-based attacks in email messages.

Answer

Anti-malware policy

Answer

Anti-phishing policy

Answer

Safe Attachments policy

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a unified security operations platform. Which THREE capabilities should you enable?

Accepted Answer

Microsoft Defender XDR incident integration with Sentinel. Microsoft Defender XDR incident integration with Sentinel creates a unified security operations platform by automatically synchronizing high-fidelity alerts and incidents from Defender XDR into Sentinel. This enables security teams to correlate endpoint, email, identity, and cloud app signals within a single SIEM, reducing alert fatigue and accelerating incident response through automated orchestration.

Answer

Azure Policy for security controls

Answer

Microsoft Purview Information Protection

Question 4

Your organization uses Microsoft Entra ID and needs to implement a Zero Trust identity strategy. Which THREE principles should you apply?

Accepted Answer

Use least privilege access. Least privilege access is a core Zero Trust principle that ensures users, devices, and services are granted only the minimum permissions necessary to perform their tasks. In Microsoft Entra ID, this is implemented through features like Privileged Identity Management (PIM), Conditional Access policies, and role-based access control (RBAC) to reduce the attack surface and limit lateral movement.

Answer

Trust implicitly

Answer

Use a single authentication method

Question 5

Your company uses Microsoft Defender for Cloud to manage security posture across hybrid workloads. You need to ensure that critical vulnerabilities found on Azure VMs are automatically remediated without manual intervention. Which feature should you enable?

Accepted Answer

Enable 'Remediate' for security recommendations in Defender for Cloud. Microsoft Defender for Cloud's 'Remediate' feature allows you to automatically apply the necessary configuration changes or deploy the required patches to fix critical vulnerabilities on Azure VMs without manual intervention. This is achieved by enabling the 'Remediate' option on specific security recommendations, which triggers an automated workflow (often using Azure Policy or a custom script) to resolve the identified issue. This directly addresses the requirement for automatic remediation of critical vulnerabilities.

Answer

File Integrity Monitoring (FIM)

Answer

Microsoft Defender for Cloud's Regulatory Compliance dashboard

Answer

Azure Automation Update Management

Question 6

Your organization uses Microsoft Sentinel to aggregate logs from on-premises and cloud sources. You need to reduce the cost of data ingestion while ensuring security-critical logs are retained for at least one year. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Entity behavior analytics (UEBA) with automated investigation. Entity behavior analytics (UEBA) with automated investigation is the correct choice because it profiles normal user and entity behavior, then automatically investigates low-fidelity alerts by correlating them with historical baselines. When the investigation confirms malicious activity, it escalates to an incident, reducing noise and manual triage.

Answer

Automation rules with playbooks

Answer

Machine Learning (ML) based anomaly detection

Answer

Custom analytic rules

Question 7

Your company is deploying Microsoft Intune for mobile device management. You need to ensure that corporate data on personally owned devices is protected without affecting the user's personal data. Which Intune feature should you use?

Accepted Answer

App Protection Policies (MAM). App Protection Policies (MAM) are the correct choice because they allow you to manage and protect corporate data within applications on personally owned devices without requiring device enrollment. This ensures that corporate data is encrypted, can be selectively wiped, and is prevented from being copied to personal apps, while leaving the user's personal data untouched.

Answer

Device compliance policies

Answer

Conditional Access for app control

Answer

Windows Autopilot

Question 8

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate using their existing on-premises credentials while gradually moving to cloud-only authentication. Which authentication method should you implement first?

Accepted Answer

Password Hash Synchronization (PHS) with Seamless SSO. Password Hash Synchronization (PHS) with Seamless SSO is the best first step because it syncs password hashes to Microsoft Entra ID, enabling users to authenticate with their on-premises credentials while providing a seamless sign-on experience. It requires minimal infrastructure and supports a gradual transition to cloud-only authentication. Option A (Azure AD Connect) is the tool for synchronization, not an authentication method. Option B (AD FS) is a federation service that is more complex and not needed initially. Option C (Pass-through Authentication) validates passwords on-premises, which is suitable for some scenarios but does not facilitate a gradual move to cloud-only authentication as effectively as PHS with Seamless SSO.

Answer

Azure AD Connect

Answer

Active Directory Federation Services (AD FS)

Answer

Pass-through Authentication (PTA)

Question 9

Your organization is implementing a privileged access strategy using Microsoft Entra ID. You need to provide just-in-time (JIT) access to Azure resources for administrators. Which TWO features should you use?

Accepted Answer

Privileged Access Groups (PAG). Privileged Access Groups (PAG) provide just-in-time activation of group membership that can be assigned to Azure RBAC roles, enabling JIT access to Azure resources. PIM for Azure AD roles is specifically for Azure AD roles and does not directly manage Azure resource access.

Answer

Identity Protection user risk policy

Answer

Privileged Identity Management (PIM) for Azure AD roles

Answer

Azure RBAC roles

Answer

Access reviews

Question 10

Your organization is using Microsoft Sentinel to detect advanced threats. You need to ensure that alerts from Microsoft Defender XDR are automatically synchronized with Sentinel and that incidents are created. Which THREE components are required?

Accepted Answer

Microsoft Defender XDR data connector. The Microsoft Defender XDR data connector (Option B) is required because it is the specific integration point that ingests alerts and raw signals from Microsoft 365 Defender into Microsoft Sentinel. Without this connector, there is no automated synchronization of Defender XDR alerts into the Sentinel workspace.

Answer

Entity behavior analytics (UEBA)

Answer

Automation rule to trigger playbook

Question 11

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. The policy is intended to block legacy authentication. However, users are still able to access email using Outlook (modern auth). What is the most likely reason?

Accepted Answer

The clientAppTypes list does not include 'modernAuth'. The 'clientAppTypes' list in the Conditional Access policy must include 'modernAuth' to explicitly target and block modern authentication clients. Without this entry, the policy only applies to legacy authentication protocols (e.g., POP, IMAP, SMTP), leaving modern auth flows (like Outlook using OAuth 2.0) unaffected. The JSON snippet shows 'clientAppTypes': ['exchangeActiveSync', 'other'], which omits 'modernAuth', so Outlook (modern auth) bypasses the block.

Answer

The policy does not include 'Microsoft Office 365' in applications

Answer

The grant control should be 'require MFA' instead of 'block'

Answer

The policy state is set to 'enabled' incorrectly

Question 12

Refer to the exhibit. A KQL query is used in Microsoft Sentinel to detect brute-force attacks. The query returns no results despite known brute-force attempts. What is the most likely issue?

Accepted Answer

The EventID 4625 may not cover all authentication failures. EventID 4625 in Windows Security logs specifically records failed logon attempts, but brute-force attacks may target other authentication protocols (e.g., RDP, SMB, or network-level authentication) that generate different EventIDs (such as 4648, 4776, or 5156). Additionally, some brute-force attempts might be blocked at the network layer or use non-Windows authentication methods, so relying solely on EventID 4625 will miss those events. Therefore, the query returns no results because it does not capture all authentication failure scenarios.

Answer

The query lacks a time filter

Answer

The 'IPAddress' field does not exist in SecurityEvent

Answer

The 'count()' aggregation is incorrect

Question 13

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. The security team requires that only HTTPS traffic is allowed and that TLS 1.2 is enforced. Does this template meet the requirements?

Accepted Answer

Yes, the template correctly enforces HTTPS and TLS 1.2. The ARM template sets 'supportsHttpsTrafficOnly' to true, which enforces HTTPS-only traffic, and 'minimumTlsVersion' to 'TLS1_2', which enforces TLS 1.2 as the minimum protocol version. These two properties together fully satisfy the security team's requirement that only HTTPS traffic is allowed and TLS 1.2 is enforced.

Answer

No, because 'minimumTlsVersion' should be 'TLS1_0'

Answer

No, because 'supportsHttpsTrafficOnly' should be false

Answer

No, because 'defaultAction': 'Deny' blocks all traffic including HTTPS

Question 14

A company uses Microsoft Defender for Cloud to assess the security posture of their hybrid environment. They need to ensure that all Azure subscriptions are evaluated against the same set of regulatory compliance standards. What should they configure?

Accepted Answer

Assign the regulatory compliance standard to the management group containing all subscriptions. Regulatory compliance standards in Microsoft Defender for Cloud are assigned at the management group scope, which automatically applies the standard to all subscriptions within that management group. This ensures consistent evaluation across the entire hybrid environment without needing per-subscription configuration. The assignment inherits down the hierarchy, so all subscriptions under the management group are assessed against the same compliance framework.

Answer

Assign the standard to each subscription individually

Answer

Create an Azure Policy initiative and assign it to the management group

Answer

Use Microsoft Defender for Cloud's default policy

Question 15

Your organization uses Microsoft Intune to manage devices. You need to ensure that corporate data on personally owned devices is removed when a user leaves the company, but personal data remains intact. What should you use?

Accepted Answer

Selective wipe (retire). Selective wipe (retire) is the correct choice because it removes only corporate data from a personally owned device enrolled in Microsoft Intune, while preserving the user's personal data. This is achieved by targeting managed app data and corporate profiles, leaving personal apps, photos, and settings intact. It aligns with the requirement to protect corporate information upon employee departure without affecting the user's personal property.

Answer

Conditional Access policy

Answer

Full wipe

Answer

Device compliance policy

Question 16

Your organization has Microsoft Entra ID (Azure AD) and uses Privileged Identity Management (PIM). You need to ensure that when a user activates a privileged role, they must provide a reason and a ticket number. What should you configure?

Accepted Answer

PIM role settings requiring justification and approval on activation. PIM role settings allow you to configure activation requirements, including mandatory justification (reason) and ticket number. By editing the role settings in PIM, you can enforce that users provide both a reason and a ticket number when activating a privileged role, ensuring auditability and compliance.

Answer

Conditional Access policy requiring multi-factor authentication

Answer

An access review for the privileged role

Answer

Microsoft Entra Identity Protection user risk policy

Question 17

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. Based on the JSON snippet, what is the most likely outcome when a user with high user risk attempts to sign in?

Accepted Answer

The sign-in is blocked because user risk is high. The Conditional Access policy shown in the JSON snippet includes a condition for 'userRiskLevels' set to 'high', and the grant control is 'block'. When a user with high user risk attempts to sign in, the policy evaluates the user risk level and, since it matches the condition, applies the block action, preventing the sign-in entirely.

Answer

The sign-in is blocked only if sign-in risk is also high

Answer

The sign-in is allowed because sign-in risk is not high

Answer

The user is prompted for multi-factor authentication

Question 18

Refer to the exhibit. You are analyzing a Microsoft Sentinel analytics rule. What does this rule detect?

Accepted Answer

Brute-force attack against a single account. This rule detects a brute-force attack against a single account by triggering when the number of failed logons for a specific user exceeds a threshold within a given time window, followed by a successful logon. The condition `FailedLogons > 5` and `SuccessfulLogon > 0` for the same account indicates that the attacker has guessed the correct password after multiple failed attempts, which is a classic sign of a successful brute-force attack.

Answer

Multiple successful logons for the same account

Answer

Multiple failed logons from the same source IP address

Answer

Overall number of failed logons across all accounts

Question 19

Refer to the exhibit. You are configuring a Microsoft Purview sensitivity label. When a user applies this label to an email, what happens?

Accepted Answer

The email is encrypted and cannot be forwarded, printed, or copied. The sensitivity label is configured with encryption that includes the 'Do Not Forward' option. This applies Azure Rights Management (Azure RMS) protection, which encrypts the email and restricts the recipient from forwarding, printing, or copying the content. The label enforces these restrictions at the message level, regardless of the email client used.

Answer

The email is encrypted but can be forwarded

Answer

The email is not encrypted but cannot be forwarded

Answer

The email is encrypted and the recipient cannot reply

Question 20

Your organization uses Microsoft Sentinel to aggregate logs from on-premises and cloud sources. You need to reduce the cost of data ingestion while ensuring security-critical logs are retained for at least one year. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the analytics connector to ingest these events as basic logs. Microsoft Sentinel supports 'basic logs' ingestion, which is a lower-cost tier designed for high-volume, verbose logs like Windows Event ID 4624. Basic logs are stored in the same table but with a reduced retention period (default 30 days) and still retain the full event data, enabling cost savings while preserving the ability to query for security incidents. This approach avoids the need to filter or drop events entirely, ensuring compliance with security monitoring requirements.

Answer

Reduce the retention period for all logs to 30 days

Answer

Ingest the events into a separate Log Analytics workspace with a shorter retention

Answer

Filter out Event ID 4624 at the source using Windows Event Forwarding