SC-100 Design security operations, identity, and compliance capabilities Practice Test 10 — 15 Questions

Question 1

Which THREE are valid sources for ingesting data into Microsoft Sentinel? (Choose three.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is a valid data source for Microsoft Sentinel because Sentinel supports ingesting AWS service logs via the AWS CloudTrail data connector. This connector uses the AWS S3 bucket to collect CloudTrail logs, which are then pulled into Sentinel for analysis. This allows organizations to monitor and detect threats across their AWS environment alongside other cloud and on-premises data sources.

Answer

Adobe Analytics

Answer

Google BigQuery

Question 2

Your company uses Microsoft 365 E5 licenses and has deployed Microsoft Defender for Office 365. The security team wants to be alerted when a user reports a phishing email using the built-in report message button in Outlook. The alert should be sent to the security team's email address. You need to configure this in the Microsoft 365 Defender portal. What should you do?

Accepted Answer

Configure the User reported messages settings to send alerts to the security team.. User-reported messages settings in the Microsoft 365 Defender portal allow you to configure alerts when users report phishing emails using the built-in report message button. Option A is incorrect because anti-phishing policies handle detection and prevention, not user submissions. Option C is incorrect because Safe Attachments policies are for scanning email attachments, not for user-reported messages. Option D is incorrect because Safe Links policies protect against malicious URLs, not for handling user-reported phishing emails.

Answer

Create an anti-phishing policy that notifies users about phishing.

Answer

Create a Safe Attachments policy to detect phishing attachments.

Answer

Create a Safe Links policy that alerts on phishing URLs.

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that automatically creates an incident in Microsoft Sentinel when a Defender for Endpoint alert of severity 'High' is triggered for any device. The solution should minimize latency and administrative overhead. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel and ensure the 'Create incidents' toggle is enabled.. Microsoft Sentinel has a built-in data connector for Microsoft Defender XDR that enables automatic incident creation with low latency and minimal configuration. Option A (custom logic app) would add latency and complexity. Option C (manual ingestion) would not be automatic. Option D (Azure AD Identity Protection) is for identity-based alerts, not device alerts.

Answer

Enable the Azure AD Identity Protection connector in Microsoft Sentinel to ingest sign-in and user risk alerts.

Answer

Configure a scheduled analytics rule in Microsoft Sentinel that runs every hour and queries the Defender for Endpoint logs via API.

Answer

Create a custom Azure Logic App that queries the Microsoft Defender for Endpoint APIs and pushes alerts to a custom log table in Log Analytics.

Question 4

Your organization uses Microsoft Intune to manage devices. You need to design a compliance policy that requires devices to have a minimum OS version and be encrypted. Which policy type should you use?

Accepted Answer

Create a device compliance policy in Microsoft Intune.. Device compliance policies in Microsoft Intune define the rules that devices must meet to be considered compliant, such as minimum OS version and encryption requirements. Option A (device configuration profile) is used for configuring device settings like Wi-Fi or VPN, not for compliance rules. Option B (Conditional Access policy) is a feature of Microsoft Entra ID that enforces access controls based on compliance status, but it does not define the compliance rules themselves. Option C (app protection policy) is used to protect data at the app level, not to enforce device-level requirements like OS version or encryption.

Answer

Create a device configuration profile in Microsoft Intune.

Answer

Create a Conditional Access policy in Microsoft Entra ID.

Answer

Create an app protection policy in Microsoft Intune.

Question 5

Refer to the exhibit. You receive an alert from Microsoft Defender for Cloud Apps. You need to investigate this alert in Microsoft Sentinel. Which Microsoft Sentinel feature should you use to visualize the relationship between the user account and the IP address?

Accepted Answer

Use the Investigation graph to explore the entities involved.. The Investigation graph in Microsoft Sentinel provides a visual representation of entities and their relationships, which is ideal for understanding connections between a user and an IP address. Option A (automation rule) is for automated responses. Option B (hunting query) is for proactive threat hunting. Option D (workbook) is for dashboards.

Answer

Configure an automation rule to trigger a playbook.

Answer

Run a hunting query to search for similar alerts.

Answer

Create a new workbook to display the alert details.

Question 6

Your organization plans to use Microsoft Sentinel and Microsoft Defender XDR to manage security incidents. You need to design a solution that ensures all Defender for Cloud Apps alerts are automatically synchronized to Microsoft Sentinel as incidents with the least administrative effort. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel and set incident creation to 'All alerts'.. Enabling the Microsoft Defender XDR connector in Sentinel automatically ingests alerts from all Defender workloads, including Defender for Cloud Apps, and creates incidents. Option A (Defender for Cloud Apps data connector) is legacy and duplicates effort, as it only ingests Cloud Apps alerts. Option B (custom Azure Function) requires manual API polling, which is not minimal effort. Option C (Azure AD connector) does not include Defender for Cloud Apps alerts.

Answer

Enable the Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel.

Answer

Create a custom Azure Function that polls the Defender for Cloud Apps API and sends alerts to Sentinel via a custom Log Analytics table.

Answer

Enable the Microsoft Entra ID (Azure AD) data connector in Microsoft Sentinel.

Question 7

Your organization uses Microsoft Purview to manage data governance. You need to design a solution that allows data owners to classify sensitive data in their Microsoft SharePoint Online sites and generate a data catalog. Which Purview tool should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is used to scan data sources, classify sensitive information, and build a data catalog for SharePoint Online. Option A (Information Protection) focuses on labeling and protection, not cataloging. Option B (Audit) logs activities but does not classify or catalog data. Option C (Data Loss Prevention) enforces policies to prevent data leaks, not data classification and cataloging.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Loss Prevention

Question 8

Your organization needs to meet regulatory requirements that mandate keeping security audit logs for at least seven years. Which Microsoft Sentinel feature should you configure to comply with this requirement?

Accepted Answer

Adjust the data retention settings in the Log Analytics workspace used by Microsoft Sentinel.. Retention settings in the Log Analytics workspace allow you to specify how long data is kept, up to seven years (or longer with archive). Option A (data connectors) are for ingestion, not retention. Option C (playbooks) are for automation. Option D (workbooks) are for visualization.

Answer

Configure data connectors to collect logs from all sources.

Answer

Develop a playbook to export logs to Azure Blob Storage.

Answer

Create a workbook to archive logs to a storage account.

Question 9

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows corporate users to access a sensitive internal application only from managed devices that are compliant with company security policies. The solution should block access from personal devices. Which two components should you use? (Choose TWO.)

Accepted Answer

Microsoft Intune device compliance policy. To block access from personal devices and allow only managed, compliant devices, you need both a device compliance policy (D) to define security requirements and a Conditional Access policy (E) that requires a compliant device. Intune device compliance policy enforces conditions like encryption and OS version, and Entra ID Conditional Access uses the compliance status to grant or block access. App protection policies (A) are for app-level protection, not device-level. Hybrid Azure AD join (B) is not required; a compliant device can be cloud-joined. Enrollment (C) is a prerequisite but not the enforcement mechanism itself.

Answer

Microsoft Intune app protection policy

Answer

Microsoft Entra ID Conditional Access policy that requires hybrid Azure AD join

Answer

Microsoft Intune device enrollment

Question 10

Your organization uses Microsoft Purview. You need to design a solution that automatically detects and classifies sensitive data such as passport numbers stored in Microsoft OneDrive. The solution should apply a 'Highly Confidential' sensitivity label without user intervention. What should you configure?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that targets OneDrive and includes the 'Passport Number' sensitive info type.. Auto-labeling policies in Microsoft Purview can automatically scan content for sensitive info types like 'Passport Number' and apply a sensitivity label (e.g., 'Highly Confidential') without user intervention. This meets the requirement for automatic detection and classification. Option B (DLP policy) blocks sharing but does not apply labels. Option C (audit) only logs activities. Option D (manual labeling) requires user action, which is not automatic.

Answer

Create a Data Loss Prevention (DLP) policy that blocks sharing of files with passport numbers.

Answer

Enable auditing in Microsoft Purview to track where passport numbers are stored.

Answer

Configure a manual sensitivity label and train users to apply it.

Question 11

Your organization uses Microsoft Sentinel. You need to design a solution that automatically responds to a detected ransomware incident by isolating the affected device in Microsoft Defender for Endpoint. Which tool should you use to create the automated response?

Accepted Answer

Create a playbook in Microsoft Sentinel using Azure Logic Apps.. A playbook in Microsoft Sentinel (based on Azure Logic Apps) can automate responses like isolating a device in Microsoft Defender for Endpoint. Automation rules (option C) trigger playbooks based on conditions but do not contain the response logic themselves. Workbooks (option A) are for visualization, and hunting queries (option D) are for threat hunting, not automated response. Therefore, to create an automated response action, you must create a playbook.

Answer

Create a workbook in Microsoft Sentinel.

Answer

Create an automation rule in Microsoft Sentinel.

Answer

Create a hunting query in Microsoft Sentinel.

Question 12

Your organization uses Microsoft Entra ID. You need to design a solution that requires users to perform multifactor authentication when accessing a critical application from an untrusted network. The solution should not require additional licensing beyond Microsoft Entra ID P1. What should you use?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID.. Conditional Access policies are included with Microsoft Entra ID P1 and can enforce MFA based on network location. Option B (ID Protection) requires P2 licensing. Option C (per-user MFA) is legacy and less flexible. Option D (Intune) is for device management.

Answer

Configure a risk-based policy in Microsoft Entra ID Protection.

Answer

Enable per-user MFA in Microsoft Entra ID.

Answer

Deploy a device compliance policy in Microsoft Intune.

Question 13

Your organization uses Microsoft Purview and Microsoft Sentinel. You need to design a solution that alerts the security team when a user tries to share a file labeled 'Highly Confidential' with an external email address. The alert should include the file name, user, and external recipient. Which two components should you use? (Choose TWO.)

Accepted Answer

Microsoft Sentinel analytics rule that queries DLP audit logs. Options B and E. Microsoft Purview Data Loss Prevention (DLP) policy (E) detects and alerts when a user attempts to share a file labeled 'Highly Confidential' with an external email address, and can include the file name, user, and external recipient in the alert. Microsoft Sentinel analytics rule that queries DLP audit logs (B) ingests the DLP alerts and provides centralized investigation and alerting. Option A (Microsoft Purview Information Protection) is for labeling, not monitoring. Option C (Microsoft Purview Audit) logs events but does not generate proactive alerts. Option D (auto-labeling policy) applies labels but does not generate alerts.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Answer

Microsoft Purview auto-labeling policy

Question 14

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to design a solution that automatically remediates non-compliant devices by running a remediation script. Which Intune component should you use?

Accepted Answer

Remediation policy in Microsoft Intune. Intune remediation policies allow you to automatically execute scripts to detect and fix non-compliant settings on devices. Option B (Device compliance policy) sets compliance rules but does not run scripts. Option C (App protection policy) manages app-level data protection, not device remediation. Option D (Device configuration profile) deploys settings but does not include script execution for remediation.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to design a solution that collects security events from Azure virtual machines and sends them to Microsoft Sentinel. The solution must minimize cost and management overhead. Which data connector should you use?

Accepted Answer

Windows Security Events via the Log Analytics agent (AMA). The Windows Security Events via the Log Analytics agent (AMA) data connector is specifically designed to collect security events from Azure VMs and send them to Microsoft Sentinel using the Azure Monitor Agent (AMA). AMA is the current recommended agent, offering lower cost and management overhead compared to the legacy Log Analytics agent. Option B (Microsoft Defender for Cloud data connector) requires additional Defender for Cloud plans and licenses, increasing cost. Option C (Azure Activity data connector) only captures subscription-level activity logs, not VM security events. Option D (Microsoft Entra ID data connector) collects identity and sign-in logs, which are irrelevant to VM security events.

Answer

Microsoft Defender for Cloud data connector

Answer

Azure Activity data connector

Answer

Microsoft Entra ID (Azure AD) data connector