SC-100 Design security operations, identity, and compliance capabilities Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing the Azure portal. What is the simplest way to configure this?

Accepted Answer

Create a conditional access policy targeting the Azure portal app requiring MFA.. Option C is correct because a conditional access policy can be targeted to the Azure portal app and require MFA. Option A is wrong because per-user MFA is legacy and less flexible. Option B is wrong because MFA registration policy ensures registration but does not enforce MFA. Option D is wrong because security defaults apply to all apps, not just Azure portal, and may be too broad.

Answer

Enable per-user MFA for all users.

Answer

Enable security defaults.

Answer

Configure Microsoft Entra ID MFA registration policy.

Question 2

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to automatically create incidents in Sentinel for high-severity alerts from Defender XDR. You also want to suppress low-severity alerts to reduce noise. What should you configure?

Accepted Answer

Create a scheduled analytics rule that queries Defender XDR alerts with severity filter and creates incidents.. Option B is correct because you can create an analytics rule that filters by severity and maps alerts to incidents. Option A is wrong because automation rules can create incidents but are not the primary method for ingesting alerts. Option C is wrong because a playbook would be reactive. Option D is wrong because the incident creation rule is not a thing.

Answer

Configure the Microsoft Defender XDR connector to create incidents only for high severity.

Answer

Configure an automation rule to create incidents for all alerts.

Answer

Create a playbook that triggers on alerts and creates incidents.

Question 3

Your organization uses Microsoft 365 and wants to protect against phishing attacks. Which TWO configurations should you recommend?

Accepted Answer

Enable anti-spoofing protection in Exchange Online Protection.. Option A is correct because Safe Links and Safe Attachments in Defender for Office 365 protect against malicious links and attachments. Option C is correct because anti-spoofing protection in Exchange Online Protection helps prevent phishing. Option B is wrong because DMARC is for email authentication, not phishing protection. Option D is wrong because MFA is for authentication, not phishing. Option E is wrong because DLP is for data protection.

Answer

Configure DMARC policy to reject spoofed emails.

Answer

Require MFA for all external email access.

Answer

Configure DLP policies to detect sensitive data in email.

Question 4

Your organization is implementing Microsoft Entra ID governance. Which THREE capabilities should you include to manage the identity lifecycle and access reviews?

Accepted Answer

Microsoft Entra Access Reviews.. Option B is correct because Entitlement Management automates access requests and lifecycle. Option D is correct because Access Reviews allow periodic review of access. Option E is correct because Lifecycle Workflows automate joiner/mover/leaver processes. Option A is wrong because Privileged Identity Management is for privileged access. Option C is wrong because Identity Protection is for risk detection.

Answer

Microsoft Entra Identity Protection.

Answer

Privileged Identity Management (PIM).

Question 5

Your organization uses Microsoft Purview to comply with regulatory requirements. Which TWO features should you use to manage data retention and deletion?

Accepted Answer

Data lifecycle management policies (retention policies).. Data lifecycle management policies (retention policies) in Microsoft Purview allow you to automatically retain or delete data at the container level (e.g., SharePoint sites, Exchange mailboxes, Teams channel messages) based on regulatory requirements. They enforce retention and deletion actions without user intervention, making them essential for compliance with data governance mandates.

Answer

Sensitivity labels.

Answer

Data Loss Prevention (DLP) policies.

Answer

Trainable classifiers.

Question 6

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. What does this policy accomplish?

Accepted Answer

Blocks all users when sign-in risk is high.. Option C is correct because the policy blocks all users when sign-in risk is high. Option A is wrong because it does not require MFA. Option B is wrong because it does not target specific apps. Option D is wrong because it blocks all users, not just external.

Answer

Requires MFA for high-risk sign-ins.

Answer

Blocks external users from high-risk sign-ins.

Answer

Blocks sign-ins from specific applications.

Question 7

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

To enrich Mimikatz alerts with user account names.. Option B is correct because the query joins security alerts with identity info to get the account name for alerts about Mimikatz detection. Option A is wrong because it does not investigate lateral movement. Option C is wrong because it does not trigger an automation rule. Option D is wrong because it does not summarize data.

Answer

To summarize Mimikatz alerts by account.

Answer

To create an automation rule based on the query.

Answer

To detect lateral movement after a Mimikatz alert.

Question 8

Refer to the exhibit. You are reviewing a Microsoft Purview Data Map resource pattern for scanning. What is this pattern intended to do?

Accepted Answer

Automatically apply sensitivity labels to resources matching the pattern.. Option C is correct because the pattern targets all *.onmicrosoft.com resources in Global and USGov regions and applies sensitivity labels. Option A is wrong because it applies labels, not just scans. Option B is wrong because it does not block access. Option D is wrong because it does not enforce retention.

Answer

Scan all resources in the onmicrosoft.com domain for classification.

Answer

Block access to resources in USGov regions.

Answer

Enforce retention policies on scanned resources.

Question 9

Your organization uses Microsoft Sentinel for security operations. You need to ensure that all incidents related to a specific critical asset are automatically assigned to the senior SOC analyst. The assignment should occur as soon as the incident is created. What should you configure?

Accepted Answer

Create an automation rule that sets the incident owner to the senior SOC analyst.. Option B is correct because automation rules in Microsoft Sentinel can be used to assign incidents to specific owners automatically upon creation. Option A is incorrect because playbooks can automate responses but are not the simplest method for assignment. Option C is incorrect because analytics rules create alerts, not assign incidents. Option D is incorrect because workbooks are for visualization.

Answer

Modify the analytics rule to include a custom details field for owner.

Answer

Create a playbook and trigger it from an automation rule.

Answer

Configure a workbook to display incidents and manually assign them.

Question 10

Your company uses Microsoft Purview Compliance Manager to track compliance with regulatory standards. You need to generate a report that shows the percentage of controls that are not yet implemented for the PCI DSS standard. What should you do?

Accepted Answer

In Compliance Manager, open the PCI DSS assessment and view the control status.. Option C is correct because Compliance Manager provides pre-built assessments for standards like PCI DSS, and you can view the control status. Option A is incorrect because Data Lifecycle Management is for retention policies. Option B is incorrect because Communication Compliance is for internal risk detection. Option D is incorrect because risk assessments in Compliance Manager are built-in, not created manually for this purpose.

Answer

Create a Data Lifecycle Management policy for PCI DSS.

Answer

Create a custom risk assessment in Compliance Manager for PCI DSS.

Answer

Configure a Communication Compliance policy to monitor PCI DSS compliance.

Question 11

You are designing a security operations strategy for a multinational organization. The SOC team needs to correlate alerts from multiple sources including Microsoft Defender for Cloud, Microsoft Sentinel, and third-party firewalls. Which solution should you use as the primary platform for correlation?

Accepted Answer

Microsoft Sentinel. Option B is correct because Microsoft Sentinel is a SIEM that can ingest logs from multiple sources and correlate alerts. Option A is incorrect because Defender for Cloud is a CSPM, not a SIEM. Option C is incorrect because Microsoft 365 Defender is for endpoint and email, not for third-party firewalls. Option D is incorrect because Azure Monitor is for infrastructure monitoring, not SIEM.

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 Defender

Answer

Azure Monitor

Question 12

Your organization uses Microsoft Entra ID. You need to ensure that when a user's risk level is assessed as high by Identity Protection, the user is automatically blocked from signing in. The block should apply immediately. What should you configure?

Accepted Answer

Configure a Conditional Access policy that blocks access when sign-in risk is high.. Option A is correct because a Conditional Access policy with a session control can block access based on sign-in risk. Option B is incorrect because Identity Protection user risk policy can block sign-in, but Conditional Access is the more common method. Option C is incorrect because an access review does not block sign-ins. Option D is incorrect because MFA registration does not block based on risk.

Answer

Enable self-service password reset for high-risk users.

Answer

Create an access review to require re-certification of high-risk users.

Answer

Configure a user risk policy in Identity Protection to block sign-in.

Question 13

Refer to the exhibit. You have deployed the automation shown in the exhibit in Microsoft Defender for Cloud. The automation triggers a Logic App when a high-severity alert is generated. Users report that the Logic App is not being triggered for some high-severity alerts. What is the most likely cause?

Accepted Answer

Some high-severity alerts are generated from a different event source not included in the 'sources' array.. Option B is correct because the automation is configured to trigger on 'Alerts' source, but Defender for Cloud also generates 'RegulatoryComplianceAssessment' and other sources. Some high-severity alerts may come from a different event source that is not included. Option A is incorrect because the event source is 'Alerts', not 'SecurityPolicies'. Option C is incorrect because severity value is correct. Option D is incorrect because the trigger condition is correct.

Answer

The trigger condition uses 'Equals' instead of 'Contains' for severity.

Answer

The Logic App resource ID is incorrect.

Answer

The automation is configured to trigger on 'Alerts' but should be 'SecurityPolicies'.

Question 14

Your organization uses Microsoft Intune for mobile device management. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device.. Option C is correct because Conditional Access in Microsoft Entra ID can enforce device compliance for access. Option A is incorrect because configuration policies set settings but don't control access. Option B is incorrect because compliance policies define compliance, but Conditional Access enforces it. Option D is incorrect because app protection policies protect data within apps, not device access.

Answer

Configure an app protection policy in Intune.

Answer

Create a device configuration policy in Intune.

Answer

Create a device compliance policy in Intune.

Question 15

Your company uses Microsoft 365 Copilot for Security. You need to ensure that only users in the 'SecurityAnalysts' group can access the Copilot for Security portal. All other users should not see the portal in their Microsoft 365 app launcher. What should you configure?

Accepted Answer

In the Copilot for Security settings, restrict access to the 'SecurityAnalysts' group.. Option D is correct because Copilot for Security has a licensing and access control that can be restricted to specific groups. Option A is incorrect because Conditional Access controls sign-in but does not hide the app launcher. Option B is incorrect because SharePoint permissions are irrelevant. Option C is incorrect because Entra ID groups can be used for licensing assignment, which controls visibility.

Answer

Remove the Copilot for Security license from all users and assign only to the group.

Answer

Create a Conditional Access policy to block access to Copilot for Security for users not in the group.

Answer

Configure an Entra ID administrative unit to restrict access.