SC-100 Design security operations, identity, and compliance capabilities Practice Test 11 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that investigates and responds to a ransomware incident. Which three actions should you take? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint.. Options A, B, and E are correct. Isolating affected devices using Microsoft Defender for Endpoint (A) contains the incident by preventing lateral movement. Reviewing the incident timeline in Microsoft Defender XDR (B) provides a cohesive view of all alerts and actions across the kill chain, which is essential for understanding the attack. Running a hunting query in Microsoft Sentinel (E) helps identify all affected devices and the full scope of the compromise. Option C is incorrect because creating a new workbook is for custom reporting and visualization, not for immediate investigation and response; workbooks are used after the fact for analysis. Option D is incorrect because deleting log data would destroy forensic evidence and hinder the investigation.

Answer

Create a new workbook to visualize the incident.

Answer

Delete all log data older than 24 hours to improve performance.

Question 2

Your organization uses Microsoft Purview. You need to design a solution that discovers and classifies sensitive data across Microsoft 365 services. Which two services should you include in your data map? (Choose TWO.)

Accepted Answer

SharePoint Online. The correct answers are B (SharePoint Online) and D (OneDrive for Business). Microsoft Purview Data Map can scan SharePoint Online and OneDrive for Business to discover and classify sensitive data, as they are Microsoft 365 services that commonly store sensitive documents. Power BI (A) is a Microsoft 365 service but is not typically scanned for sensitive data classification in the same way; it is primarily used for analytics and reporting. Azure SQL Database (C) and Azure Blob Storage (E) are Azure services, not Microsoft 365 services, and are not part of a Microsoft 365 data map.

Answer

Power BI

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 3

You are a security architect for a large organization that uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Entra ID. The organization has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD. The security team needs to detect and automatically respond to a specific attack pattern: an attacker compromises a user's credentials and then uses a new device to sign in to a critical application from an unusual location. The response should block the user's account for one hour and reset the user's password. You have already configured Microsoft Sentinel to receive sign-in logs from Azure AD. You need to design the detection and automated response. What should you do?

Accepted Answer

Enable the Microsoft Entra ID Protection data connector in Microsoft Sentinel, create an analytics rule from the 'Sign-in from new device' template, and configure a playbook to block the user and reset password.. It enables the Microsoft Entra ID Protection data connector in Sentinel, allowing Sentinel to ingest risk detections. The 'Sign-in from new device' template analytics rule can detect the described pattern, and a playbook can be triggered to block the user and reset the password via Microsoft Graph API. Option A is incorrect because a scheduled analytics rule based solely on sign-in logs would not leverage ID Protection's risk assessments, leading to lower accuracy. Option B is incorrect because Microsoft Defender XDR's custom detection rules are not as well-suited for this scenario; the detection is more reliable using ID Protection risk signals within Sentinel. Option D is incorrect because while Conditional Access can block access, it cannot automatically reset the user's password, and the requirement specifies using Sentinel for detection and response.

Answer

Create a Microsoft Sentinel scheduled analytics rule that queries sign-in logs for unusual location and new device, then trigger a playbook to block the user and reset password.

Answer

Create a custom detection rule in Microsoft Defender XDR for the attack pattern and configure an automated action to block the user.

Answer

Enable Microsoft Entra ID Protection and configure a risk-based Conditional Access policy to block access and require password change.

Question 4

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to design a solution that ensures all Windows 10 devices are running the latest security updates and have real-time protection enabled. If a device is non-compliant, it should be blocked from accessing corporate resources. You have already created a Conditional Access policy that requires compliant devices. You need to configure the compliance requirements and automatic remediation. What should you do?

Accepted Answer

Create an Intune device compliance policy that requires minimum OS version and real-time protection, and create a remediation policy that automatically enables real-time protection if disabled.. Intune device compliance policies can define requirements such as minimum OS version and real-time protection status, and remediation policies can automatically enable real-time protection if disabled. This ensures devices are compliant and can be blocked by the existing Conditional Access policy. Option A is incorrect because device configuration profiles deploy settings but do not enforce compliance or trigger blocking. Option B is incorrect because app protection policies focus on app-level data protection, not device-level compliance checks like OS version or real-time protection. Option D is incorrect because while it uses a compliance policy, it does not include automatic remediation, which is explicitly requested.

Answer

Create an Intune device configuration profile that enforces the minimum OS version and enables real-time protection.

Answer

Create an Intune app protection policy that requires the device to have the latest updates and real-time protection.

Answer

Create an Intune device compliance policy that requires minimum OS version and real-time protection, and use the Conditional Access policy to block non-compliant devices.

Question 5

Your organization uses Microsoft Purview to manage data governance. The compliance team needs to be able to search for and investigate whether any sensitive data (e.g., credit card numbers) is stored in Microsoft Teams messages. They also need to place a legal hold on specific user's Teams messages for eDiscovery. You need to design the solution. What should you configure?

Accepted Answer

Use Microsoft Purview eDiscovery (Premium) to create a case, search for credit card numbers in Teams messages, and place a hold on the user's mailbox and Teams data.. Microsoft Purview eDiscovery (Premium) allows you to create a case, search for sensitive data like credit card numbers in Microsoft Teams messages, and place a legal hold on the user's mailbox and Teams data. Option A (sensitivity labels) is for classifying and protecting data, not for searching or eDiscovery. Option B (DLP) prevents unauthorized sharing but does not enable content search or holds. Option D (Audit) logs activities but does not allow searching message content for specific data patterns.

Answer

Configure a sensitivity label for credit card numbers and apply it to Teams messages.

Answer

Create a Data Loss Prevention policy that monitors Teams messages for credit card numbers.

Answer

Enable Microsoft Purview Audit to search the audit log for Teams messages containing credit card numbers.

Question 6

Your organization uses Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. You need to design a solution that centralizes security alerts and automates remediation across all clouds. Which security operations capability should you prioritize?

Accepted Answer

Use Microsoft Sentinel as a single SIEM and SOAR platform with connectors for AWS and GCP. Microsoft Sentinel is a cloud-native SIEM and SOAR platform that can ingest security alerts from AWS and GCP via connectors, enabling centralized monitoring and automated remediation across a multi-cloud environment. Option A is incorrect because Microsoft Purview Compliance Manager is a data governance and compliance tool, not a security operations solution. Option B is incorrect because Microsoft Defender for Cloud's multi-cloud connector aggregates security posture data, not alerts, and does not provide SOAR capabilities. Option D is incorrect because Microsoft Defender for Identity focuses on detecting identity-based threats in on-premises Active Directory, not multi-cloud alert aggregation.

Answer

Configure Microsoft Purview Compliance Manager for regulatory assessments

Answer

Enable Microsoft Defender for Cloud's multi-cloud connector to aggregate alerts

Answer

Deploy Microsoft Defender for Identity to monitor hybrid identities

Question 7

Your organization is planning to use Microsoft Entra ID for identity management. You need to design a solution that enforces conditional access policies for sensitive applications while minimizing user friction. The solution must support offline access for mobile devices and require step-up authentication only when accessing high-risk data. What should you recommend?

Accepted Answer

Use Conditional Access session controls with app-enforced restrictions and grant controls for high-risk sign-ins. Session controls in Conditional Access allow for continuous access evaluation (CAE) and step-up authentication based on risk, while app-based conditional access provides offline access. Option A is wrong because Microsoft Entra ID Protection is a risk detection and remediation service, not a conditional access enforcement policy; it does not directly enforce step-up authentication or support offline access. Option C is wrong because risk-based policies alone do not handle offline scenarios. Option D is wrong because requiring device compliance via Intune enforces device health but does not natively support offline access and does not provide step-up authentication based on risk.

Answer

Implement Microsoft Entra ID Protection to automatically remediate risky users

Answer

Configure risk-based Conditional Access policies with user risk and sign-in risk

Answer

Require device compliance via Intune and block non-compliant devices

Question 8

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy appears to block all legacy authentication. However, some users report that they can still access Exchange Online using Outlook 2010 (which uses basic authentication). What is the most likely reason the policy is not blocking these connections?

Accepted Answer

The policy is configured in 'report-only' mode. The policy is configured in 'report-only' mode, which logs but does not enforce blocks. This is the most common reason for a Conditional Access policy appearing to not block connections. Option B is incorrect because report-only mode applies to all users, not just Global Administrators. Option C is incorrect because Outlook 2010 using basic authentication falls under 'otherClients' in the clientAppTypes condition, and the policy includes that category. Option D is incorrect because the policy state shown in the exhibit is 'enabled', not 'disabled'.

Answer

The policy excludes all users in the 'Global Administrators' group

Answer

The clientAppTypes condition does not include 'mobileAppsAndDesktopClients'

Answer

The policy state is 'disabled'

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that investigates and responds to a ransomware incident. Which three actions should you take? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fusion. (Fusion) is correct because Fusion uses machine learning to correlate alerts from multiple sources and detect multi-stage attacks, reducing false positives. Option A is incorrect because ML Behavior Analytics is not a distinct analytics rule type in Microsoft Sentinel; it is a component of Fusion. Option C is incorrect because Anomaly detection rules are designed for individual data source anomalies and do not correlate across multiple sources. Option D is incorrect because Scheduled query rules are rule-based and do not utilize machine learning for correlation.

Answer

ML Behavior Analytics

Answer

Anomaly detection rules

Answer

Scheduled query rules

Question 10

Your organization is implementing Microsoft Entra ID Governance. You need to design a solution that automates user access reviews for cloud applications. Which TWO capabilities should you include?

Accepted Answer

Entitlement Management with access packages. Options B and D are correct because Entitlement Management provides automated assignment and removal of access packages, which can trigger reviews, and Access Reviews automate periodic review of access. Option A is wrong because Identity Protection is for risk detection. Option C is wrong because Terms of Use is for consent. Option E is wrong because Privileged Identity Management (PIM) is for privileged roles, not general access reviews.

Answer

Identity Protection

Answer

Terms of Use

Answer

Privileged Identity Management (PIM)

Question 11

Your organization uses Microsoft 365 and wants to implement a data loss prevention (DLP) strategy. You need to ensure that sensitive data is protected both at rest and in transit, and that incidents are automatically reported to the security team. Which THREE actions should you take?

Accepted Answer

Enable Endpoint DLP for Windows 10/11 devices. To protect sensitive data at rest and in transit in Microsoft 365, you need DLP policies covering Exchange, SharePoint, and OneDrive (Option D). Endpoint DLP (Option C) protects data on Windows 10/11 devices. Automatically reporting incidents to the security team is achieved by configuring DLP incident reports via email or Teams (Option E). Option A (Microsoft Intune) focuses on device management, not DLP. Option B (Conditional Access) controls access but does not report DLP incidents.

Answer

Deploy Microsoft Intune to control app permissions on mobile devices

Answer

Implement Conditional Access policies to block external sharing of sensitive data

Question 12

Your organization needs to meet compliance requirements for GDPR. You need to design a solution that uses Microsoft Purview to classify and protect personal data. Which TWO capabilities should you include?

Accepted Answer

Data Subject Requests (DSR) tool. (Data Subject Requests tool) is correct because it provides a mechanism to respond to data subject requests under GDPR. Option B (Data Classification and labeling) is correct because it enables the identification and protection of personal data. Option C (eDiscovery (Premium)) is incorrect as it is used for legal discovery, not GDPR classification. Option D (Insider Risk Management) is incorrect as it focuses on insider threats, not GDPR compliance. Option E (Communication Compliance) is incorrect as it monitors communications, not for GDPR classification.

Answer

eDiscovery (Premium)

Answer

Insider Risk Management

Answer

Communication Compliance

Question 13

Your organization uses Microsoft Defender for Cloud and Microsoft Sentinel. You need to design a solution that automates incident response for critical security alerts. Which THREE components should you include?

Accepted Answer

Playbooks built on Azure Logic Apps. Options A, C, and D are correct. Playbooks built on Azure Logic Apps (A) provide automated response actions for security incidents. Microsoft Sentinel automation rules (C) trigger these playbooks based on critical alerts, enabling consistent response. The Microsoft Teams connector (D) facilitates collaboration among responders during incidents. Option B (Microsoft Intune compliance policies) is incorrect because it manages device compliance, not incident response. Option E (Conditional Access policies) is incorrect because it controls access based on conditions, not automation of incident response.

Answer

Microsoft Intune compliance policies

Answer

Conditional Access policies

Question 14

Your organization is designing a Zero Trust architecture using Microsoft 365 security features. You need to ensure that all access requests are verified and least-privilege principles are applied. Which TWO capabilities should you implement?

Accepted Answer

Privileged Identity Management (PIM). The two correct capabilities are Privileged Identity Management (PIM) and Conditional Access. PIM provides just-in-time privileged access and enforces least-privilege by allowing users to activate roles only when needed. Conditional Access verifies every access request based on signals like user identity, device state, and location, ensuring that access is granted only if conditions are met. Microsoft Entra ID is the identity provider but not a specific verification or least-privilege mechanism. Microsoft Defender for Cloud Apps is a CASB for cloud app security, not primarily for identity verification. Microsoft Purview is for data governance and compliance.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID

Answer

Microsoft Purview

Question 15

You are a security architect for a global financial services company that uses Microsoft 365 E5 and Azure. The company has 50,000 users across 10 regions. The security team needs to detect and respond to identity-based threats in real-time, automate remediation for compromised accounts, and meet regulatory requirements for audit logging. The following requirements must be met: (1) Detect risky sign-ins and user anomalies, (2) Automatically block sign-ins when risk level is high, (3) Provide a centralized dashboard for security analysts to investigate incidents, (4) Retain logs for at least one year for compliance, (5) Minimize false positives by using machine learning. You have the following services available: Microsoft Entra ID P2, Microsoft Sentinel, Microsoft Defender for Identity, Microsoft Purview, and Microsoft Intune. Which combination of services should you use to meet all requirements?

Accepted Answer

Microsoft Entra ID Protection (P2) and Microsoft Sentinel. Microsoft Entra ID Protection (included in P2 license) detects risky sign-ins and user anomalies, and can automatically block high-risk sign-ins via conditional access policies. Microsoft Sentinel ingests logs from Entra ID and other sources, provides a centralized SIEM dashboard for investigation, supports long-term log retention (up to two years) for compliance, and uses machine learning to reduce false positives. Option A is wrong because Microsoft Intune is for mobile device and app management, not identity threat detection, and Defender for Cloud focuses on cloud workload protection. Option C is wrong because Defender for Identity is designed for on-premises Active Directory, not cloud-only identity, and Purview is for data governance. Option D is wrong because Purview is for data governance, not identity threat detection; Sentinel alone cannot provide the risk-based conditional access controls that Entra ID Protection offers.

Answer

Microsoft Intune and Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity and Microsoft Purview

Answer

Microsoft Purview and Microsoft Sentinel