SC-100 Design security operations, identity, and compliance capabilities Practice Test 11 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for ransomware attacks. Which action should you take?

Accepted Answer

Enable 'Automatic attack disruption' in the Microsoft 365 Defender portal. Automatic attack disruption is a feature of Microsoft Defender XDR that can be enabled to automatically contain attacks. It is configured in the Microsoft 365 Defender portal under Settings > Endpoints > Advanced features. The other options are not correct: disabling automated investigation reduces response, and the other portals are not for this setting.

Answer

Enable the 'Automatically investigate and respond to alerts' feature in Defender for Cloud Apps

Answer

Configure an automation rule in Microsoft Sentinel

Answer

Disable 'Automated investigation and response' in Defender for Endpoint

Question 2

You are designing identity security for a hybrid organization using Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy that requires MFA for the sensitive applications. Conditional Access policies in Entra ID are the recommended method to require MFA for specific applications. The other options are less granular or outdated: per-user MFA is legacy, Security defaults apply to all apps and cannot be scoped, and Azure AD Identity Protection focuses on risk-based policies.

Answer

Enable Security defaults

Answer

Enable per-user MFA in Entra ID

Answer

Use Azure AD Identity Protection user risk policy

Question 3

Your organization uses Microsoft Purview to protect sensitive data. You need to create a sensitivity label that automatically encrypts documents containing credit card numbers when they are shared externally. Which configuration should you use?

Accepted Answer

Create an auto-labeling policy that applies a label with encryption for external sharing. Auto-labeling in Purview can be configured to apply a sensitivity label based on sensitive info types like credit card numbers. The label should have encryption enabled for external sharing. The other options describe different scenarios: manual labeling, default labeling, or classification without encryption.

Answer

Create a trainable classifier to detect credit cards

Answer

Create a default label policy for SharePoint

Answer

Create a manual sensitivity label that users apply

Question 4

Your organization has Microsoft Sentinel. You need to create an analytics rule that detects when a user account is created outside of business hours (9 AM to 5 PM, Monday-Friday). Which KQL query should you use as the rule query?

Accepted Answer

... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) !between (9 .. 17). The query filters for events where the time is not between 9 AM and 5 PM on weekdays. The correct condition uses dayofweek() and datetimepart functions to check the hour. Option B uses the correct logic: dayofweek between 2 and 6 (Monday-Friday) and hour not between 9 and 17. Option A is incorrect for weekdays, C and D have wrong hour ranges.

Answer

... | where dayofweek(TimeGenerated) between (1 .. 5) and datetime_part("hour", TimeGenerated) !between (9 .. 17)

Answer

... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) between (9 .. 17)

Answer

... | where dayofweek(TimeGenerated) !between (2 .. 6) or datetime_part("hour", TimeGenerated) between (9 .. 17)

Question 5

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only compliant devices can access Exchange Online. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access with the 'Require device to be marked as compliant' grant. Conditional Access policies in Entra ID can require that devices be marked as compliant with Intune compliance policies before granting access to cloud apps like Exchange Online. The other options are not correct: Device Compliance is a policy in Intune, not an Entra feature; MFA is authentication; and Azure AD Join is for device identity.

Answer

Azure AD device registration

Answer

Multi-factor authentication

Answer

Intune device compliance policy

Question 6

Your organization is deploying Microsoft Defender for Cloud Apps. Which THREE capabilities are included in Defender for Cloud Apps? (Select three.)

Accepted Answer

Session controls. Defender for Cloud Apps provides Cloud Discovery (discover shadow IT), app governance (control app permissions), and session controls (protect data in real time). Conditional Access is an Entra ID feature, and DLP policies are part of Microsoft Purview, though Cloud Apps can integrate with them.

Answer

Data Loss Prevention (DLP) policies

Answer

Conditional Access

Question 7

Your organization uses Microsoft Sentinel. You need to design a solution to detect and respond to threats across on-premises and cloud workloads. Which TWO components are essential for this? (Select two.)

Accepted Answer

Analytics rules. Data connectors ingest logs from various sources, and analytics rules detect threats. Playbooks automate response, but are not essential for detection. Workbooks visualize data, and UEBA enriches analytics but is not a separate essential component.

Answer

UEBA

Answer

Workbooks

Answer

Playbooks

Question 8

Your organization is implementing Microsoft Entra ID governance. Which TWO features are part of Microsoft Entra ID Governance? (Select two.)

Accepted Answer

Entitlement management. Entitlement management and access reviews are core features of Entra ID Governance. Conditional Access is an identity protection feature, Privileged Identity Management (PIM) is part of Identity Governance, but the question asks for two of the governance features. Entitlement management and access reviews are correct. PIM is also governance, but the question limits to two. Authentication methods policy is not governance.

Answer

Privileged Identity Management

Answer

Authentication methods policy

Answer

Conditional Access

Question 9

Your organization uses Microsoft Sentinel for security operations. You need to ensure that incident investigations automatically enrich alerts with relevant user and device information from Microsoft Defender XDR and Microsoft Entra ID. What should you configure?

Accepted Answer

Enable User and Entity Behavior Analytics (UEBA) and configure entity behavior settings.. Option B is correct because Microsoft Sentinel's UEBA analytics with entity behavior settings can automatically enrich alerts by linking entities like users and devices to threat intelligence and activity data. Option A is wrong because automation rules primarily handle incident orchestration, not enrichment. Option C is wrong because watchlists are for static reference data. Option D is wrong because Fusion is for advanced multistage attack detection.

Answer

Enable Fusion detection for multistage attacks.

Answer

Create watchlists for user and device information and reference them in analytics rules.

Answer

Configure automation rules to trigger a playbook on alert creation.

Question 10

Your company uses Microsoft Purview to protect sensitive data. You need to automatically apply a retention label to documents containing credit card numbers detected in SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy for retention labels targeting sensitive info types.. Option D is correct because auto-labeling policies in Microsoft Purview can automatically apply retention labels to documents based on sensitive info types, such as credit card numbers. This allows you to enforce retention rules without manual intervention, directly targeting the detected sensitive data in SharePoint Online.

Answer

Configure a Data Loss Prevention (DLP) policy to apply the label.

Answer

Create a sensitivity label with auto-labeling for SharePoint.

Answer

Use a trainable classifier to detect credit card numbers and apply the label.

Question 11

You are designing a security operations solution for a multinational organization using Microsoft Sentinel. The organization has multiple Azure subscriptions, each with its own Log Analytics workspace. You need to centralize incident management while minimizing data egress costs. What should you recommend?

Accepted Answer

Use a single Log Analytics workspace for all subscriptions and configure Sentinel in that workspace.. Option C is correct because using a single workspace for all subscriptions centralizes data and incidents, and Microsoft Sentinel does not charge for cross-workspace querying within the same region. Option A is wrong because separate workspaces per region would not centralize incidents. Option B is wrong because a third-party SIEM adds complexity and cost. Option D is wrong because Azure Monitor cross-workspace queries are for analysis, not incident centralization.

Answer

Deploy a Sentinel workspace in each region and use cross-workspace views.

Answer

Export all logs to a third-party SIEM using Azure Event Hubs.

Answer

Configure Azure Monitor cross-workspace queries to correlate incidents.

Question 12

Your organization uses Microsoft Intune for mobile device management. You need to ensure that users can access corporate email on their personal iOS devices only if the device is enrolled in Intune and compliant with security policies. What should you configure?

Accepted Answer

Create an app protection policy for iOS requiring managed apps to be enrolled and compliant.. Option A is correct because an app protection policy with conditional launch settings can require device enrollment and compliance before allowing access. Option B is wrong because conditional access policies in Entra ID require device compliance, but they do not enforce app-level protection. Option C is wrong because a compliance policy alone does not block access. Option D is wrong because a device configuration policy sets settings but does not enforce access.

Answer

Configure a device configuration policy to enforce passcode and encryption.

Answer

Configure a conditional access policy in Microsoft Entra ID requiring compliant device.

Answer

Create a device compliance policy for iOS and assign it to all users.

Question 13

Your organization is planning to migrate from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can use the same passwords for both on-premises and cloud resources without having to change them. What should you implement?

Accepted Answer

Microsoft Entra Connect password hash synchronization.. Option B is correct because password hash synchronization (PHS) syncs password hashes to Entra ID, allowing users to use the same passwords. Option A is wrong because pass-through authentication does not sync passwords. Option C is wrong because federation does not sync passwords. Option D is wrong because AD FS is for federation, not password sync.

Answer

Microsoft Entra Cloud Sync.

Answer

Federation with on-premises AD FS.

Answer

Microsoft Entra Connect pass-through authentication.

Question 14

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and block data exfiltration from sanctioned cloud apps to personal devices. What should you configure?

Accepted Answer

Create a session policy with app governance to block download.. Option C is correct because session policies with app governance can monitor and control data transfer in real time. Option A is wrong because discovery policies identify unsanctioned apps, not block actions. Option B is wrong because file policies are for static compliance. Option D is wrong because OAuth app policies manage permissions, not data exfiltration.

Answer

Create an OAuth app policy to revoke permissions.

Answer

Create an app discovery policy to identify unsanctioned apps.

Answer

Create a file policy to detect sensitive data in sanctioned apps.

Question 15

Your organization uses Microsoft Purview to manage data governance. You need to create a unified data catalog that automatically classifies and labels data across Azure SQL Database, Amazon S3, and on-premises SQL Server. What should you configure?

Accepted Answer

Microsoft Purview account with scans for all data sources.. Option A is correct because Microsoft Purview (the unified data governance service) supports scanning and classifying data across multi-cloud and on-premises sources. Option B is wrong because Microsoft Information Protection is for labeling, not scanning. Option C is wrong because Azure Purview (now part of Microsoft Purview) is the correct service. Option D is wrong because Azure Data Catalog is legacy and limited.

Answer

Azure Data Catalog with custom classification.

Answer

Azure Purview (legacy) with multi-cloud scanning.

Answer

Microsoft Information Protection scanner on each source.