SC-100 Design security operations, identity, and compliance capabilities Practice Test 10 — 15 Questions

Question 1

A multinational company uses Microsoft Purview for data governance. They need to automatically classify sensitive data in Microsoft 365 and apply retention labels. The solution must use pattern-based detection for credit card numbers and support custom keywords. What should they configure?

Accepted Answer

Create a custom sensitive info type with a regex pattern and keyword list.. Option D is correct because sensitive info types can be custom-defined with patterns and keywords. Option A is wrong because retention labels are applied after classification. Option B is wrong because trainable classifiers use machine learning, not fixed patterns. Option C is wrong because DLP policies enforce actions but don't classify.

Answer

Use a trainable classifier for credit card numbers.

Answer

Configure a DLP policy with a rule for credit card numbers.

Answer

Create a retention label with auto-labeling policy.

Question 2

You need to design a security operations strategy for a hybrid environment using Microsoft Sentinel. Your environment includes on-premises servers and Azure VMs. Which data connector should you use to collect security events from both sources?

Accepted Answer

Windows Security Events via AMA connector. Option C is correct because the Windows Security Events via AMA connector works for both on-prem and Azure VMs. Option A is wrong because the Azure Activity log covers Azure resource operations, not security events. Option B is wrong because Syslog is for Linux. Option D is wrong because Office 365 is for cloud apps.

Answer

Azure Activity log connector

Answer

Office 365 connector

Answer

Syslog connector

Question 3

Your organization uses Microsoft Defender for Endpoint (MDE) and wants to implement automated investigation and response (AIR) for ransomware. You need to ensure that when a suspicious file is detected, the investigation is automatically started and the file is contained. What should you configure?

Accepted Answer

Configure the automated investigation and response capabilities in MDE.. Option B is correct because AIR automates investigation and containment actions. Option A is wrong because attack surface reduction rules prevent but don't automate response. Option C is wrong because indicators of compromise are for blocking known threats. Option D is wrong because custom detections create alerts but don't automate response.

Answer

Create a custom detection rule in Microsoft 365 Defender.

Answer

Enable attack surface reduction rules.

Answer

Add the file hash to the indicators of compromise list.

Question 4

A company uses Microsoft Entra ID with P2 licenses and wants to implement a zero-trust identity security model. They need to require multi-factor authentication (MFA) for all external users accessing internal applications. The solution should not require external users to have Entra ID licenses. What should you configure?

Accepted Answer

Create a conditional access policy for external users requiring MFA.. Option C is correct because Entra ID B2B collaboration allows external users to use their own identities and MFA can be enforced via conditional access. Option A is wrong because external identities feature includes B2B collaboration. Option B is wrong because identity protection is for risk detection. Option D is wrong because PIM manages privileged access, not external user authentication.

Answer

Configure Privileged Identity Management (PIM) for external users.

Answer

Enable identity protection for external users.

Answer

Use Entra ID B2B collaboration and configure MFA enforcement.

Question 5

You are designing an incident response plan for a company using Microsoft Defender XDR. The team needs to automatically notify the SOC via email when an incident of high severity is created. What should you use?

Accepted Answer

Configure an automation rule with an action to send an email notification.. Option B is correct because automated investigation and response can be configured to send email notifications. Option A is wrong because playbooks are run manually or via automation rules. Option C is wrong because analytics rules generate alerts. Option D is wrong because hunting queries are for proactive threat hunting.

Answer

Modify the analytics rule to send an email when an alert fires.

Answer

Create a playbook that sends an email when an incident is created.

Answer

Use advanced hunting to query high severity incidents and send email.

Question 6

Your organization uses Microsoft Purview Information Protection to label sensitive documents. You need to ensure that documents containing personally identifiable information (PII) are automatically labeled when saved in SharePoint Online. What should you configure?

Accepted Answer

Configure an auto-labeling policy for sensitivity labels targeting SharePoint.. Option C is correct because auto-labeling policies can scan content in SharePoint and apply labels automatically. Option A is wrong because sensitivity labels require manual application or client-side auto-labeling. Option B is wrong because retention labels are for retention, not sensitivity. Option D is wrong because DLP policies enforce actions but don't label.

Answer

Create a retention label with auto-labeling rule.

Answer

Publish a sensitivity label with auto-labeling for SharePoint.

Answer

Set up a DLP policy to detect PII and apply a label.

Question 7

Which TWO actions should you take to implement a least-privilege identity security model using Microsoft Entra ID? (Choose two.)

Accepted Answer

Create conditional access policies to restrict access based on user, device, and location.. Option A is correct because PIM provides just-in-time privileged access. Option C is correct because conditional access policies enforce access controls. Option B is wrong because permanent assignment contradicts least-privilege. Option D is wrong because guest review is about governance, not least-privilege directly. Option E is wrong because MFA is a security control, not least-privilege.

Answer

Enable Azure AD Identity Governance for guest user access reviews.

Answer

Require multi-factor authentication for all users.

Answer

Assign global administrator role to all IT staff for simplicity.

Question 8

Your company uses Microsoft Sentinel to manage security incidents. You need to design a solution that automatically triages low-severity incidents and enriches them with threat intelligence. Which THREE capabilities would you include? (Choose three.)

Accepted Answer

Playbooks to perform enrichment actions like querying threat intelligence.. Option A is correct because automation rules can take actions on incident creation. Option B is correct because playbooks can run complex workflows. Option C is correct because watchlists can be used for enrichment data. Option D is wrong because analytics rules create incidents, not triage. Option E is wrong because hunting queries are for proactive hunting, not triage.

Answer

Advanced hunting queries to investigate incidents.

Answer

Analytics rules to generate alerts for low-severity incidents.

Question 9

Which THREE are valid methods to secure privileged access in Microsoft Entra ID? (Choose three.)

Accepted Answer

Use privileged access groups to manage elevated access to resources.. Option A is correct because PIM enables just-in-time access. Option B is correct because conditional access can enforce MFA for admins. Option D is correct because privileged access groups manage group membership elevation. Option C is wrong because self-service password reset is for end users. Option E is wrong because device enrollment is for device management, not privileged access.

Answer

Require device enrollment via Microsoft Intune.

Answer

Enable self-service password reset for all users.

Question 10

You need to design a compliance solution using Microsoft Purview that automatically detects and protects credit card numbers in emails and documents. Which TWO features should you include? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policies to detect and block credit card numbers.. Option A is correct because DLP policies can detect sensitive data and enforce actions. Option B is correct because auto-labeling can apply sensitivity labels. Option C is wrong because retention labels are for retention, not protection. Option D is wrong because trainable classifiers are for pattern detection, but DLP and auto-labeling are more direct. Option E is wrong because eDiscovery is for search and legal hold.

Answer

Retention labels to retain credit card data for a specified period.

Answer

Trainable classifiers to identify credit card numbers.

Answer

eDiscovery to search for credit card numbers.

Question 11

A company wants to automate incident response in Microsoft 365 Defender. Which THREE actions can be automated using automated investigation and response (AIR) capabilities? (Choose three.)

Accepted Answer

Block a file hash across the organization.. Option A is correct because AIR can isolate devices automatically. Option B is correct because AIR can delete malicious emails. Option C is correct because AIR can block file hashes. Option D is wrong because resetting passwords is not an AIR action; it requires a playbook. Option E is wrong because creating users is not a security response action.

Answer

Reset a user's password.

Answer

Create a new user account.

Question 12

You are analyzing a custom detection rule in Microsoft 365 Defender. Based on the exhibit, what is a potential operational issue with this rule?

Accepted Answer

The threshold is too low, leading to alert fatigue.. Option D is correct because high severity with a low threshold (5) will generate many alerts. Option A is wrong because the query is valid. Option B is wrong because the severity is set to High. Option C is wrong because the query includes both powershell.exe and pwsh.exe.

Answer

The query syntax is invalid.

Answer

The severity should be Medium instead of High.

Answer

The rule does not cover PowerShell 7 (pwsh.exe).

Question 13

Your organization uses Microsoft Sentinel to centralize security events. You need to ensure that alerts from Microsoft Defender for Cloud are automatically ingested into Sentinel. Which data connector should you enable?

Accepted Answer

Microsoft Defender for Cloud connector. The Microsoft Defender for Cloud connector (formerly Azure Security Center) is specifically designed to ingest alerts and recommendations from Defender for Cloud into Sentinel. The other options are unrelated: Office 365 connector ingests Office logs, Azure Activity logs track Azure resource operations, and DNS connector ingests DNS queries.

Answer

DNS connector

Answer

Office 365 connector

Answer

Azure Activity connector

Question 14

A company is implementing Microsoft Purview Compliance Manager to manage compliance activities. They need to assign a specific control action to a compliance officer. Which role should be assigned to the user in Purview Compliance Manager?

Accepted Answer

Compliance Manager. The Compliance Manager role provides permissions to manage compliance assessments and actions. The other roles do not have the necessary permissions to assign control actions within Compliance Manager.

Answer

Security Operator

Answer

Global Administrator

Answer

Compliance Administrator

Question 15

Your organization uses Microsoft Intune for mobile device management. You need to configure a compliance policy for iOS devices that requires the device to be jailbreak-detected and have a minimum OS version. Which two settings should you configure in the compliance policy? (Choose two.)

Accepted Answer

Minimum OS version. B is correct because the compliance policy must specify a minimum OS version to ensure iOS devices meet the required security baseline, preventing outdated devices with known vulnerabilities from accessing corporate resources. D is correct because jailbreak detection is a specific compliance setting that identifies compromised devices, which are a significant security risk as they bypass iOS security controls.

Answer

Require passcode

Answer

Device encryption