SC-100 Design security operations, identity, and compliance capabilities Practice Test 12 — 15 Questions

Question 1

Your organization is a large healthcare provider that uses Microsoft 365 and Azure. You need to design a compliance solution that meets HIPAA requirements. The solution must automatically classify and protect electronic protected health information (ePHI) in Exchange Online, SharePoint Online, and OneDrive for Business. It must also provide reports on data access and sharing activities for auditors. The following requirements must be met: (1) Detect ePHI using built-in sensitive info types, (2) Apply encryption automatically to emails containing ePHI, (3) Prevent unauthorized sharing of ePHI in SharePoint, (4) Generate activity reports for auditors, (5) Use machine learning to improve classification accuracy. Which Microsoft Purview capabilities should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Loss Prevention (DLP) and Audit. Microsoft Purview Data Loss Prevention (DLP) can detect ePHI using HIPAA sensitive info types, automatically encrypt emails containing ePHI, and block unauthorized sharing in SharePoint Online. Microsoft Purview Audit provides detailed activity reports for auditors. Additionally, Microsoft Purview Information Protection uses machine learning to improve classification accuracy. Option A is incorrect because Insider Risk Management focuses on insider threats, not data classification and protection. Option B is incorrect because Information Protection alone does not enforce sharing restrictions, and Compliance Manager is for assessment and posture management. Option C is incorrect because eDiscovery is designed for legal discovery and litigation, not real-time data protection and classification.

Answer

Information Protection and Insider Risk Management

Answer

Compliance Manager and eDiscovery

Answer

eDiscovery and Communication Compliance

Question 2

Your organization is a small business with 200 users using Microsoft 365 Business Premium. You need to secure user identities against common attacks like phishing and password spray. The solution must be easy to deploy and manage with minimal overhead. Requirements: (1) Enable multi-factor authentication (MFA) for all users, (2) Block legacy authentication protocols, (3) Detect and block risky sign-ins, (4) Provide security recommendations to users, (5) Integrate with Microsoft Defender for Office 365 for email protection. Which Microsoft security service should you primarily use?

Accepted Answer

Microsoft Entra ID P1 with Conditional Access and Identity Protection. Microsoft Entra ID P1 (included in Microsoft 365 Business Premium) provides Conditional Access for enforcing MFA and blocking legacy authentication, and Identity Protection for detecting and blocking risky sign-ins. Security defaults can be enabled for easy deployment. Option A (Microsoft Purview Insider Risk Management) focuses on internal data risks, not identity security. Option B (Microsoft Entra ID P2) is more advanced but not necessary for a small business and not included in Business Premium. Option D (Microsoft Defender for Cloud) is for cloud workload protection, not identity. Thus, P1 with Conditional Access and Identity Protection meets all requirements with minimal overhead.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Entra ID P2

Answer

Microsoft Defender for Cloud

Question 3

Your organization uses Microsoft Entra ID for identity management and wants to implement a least-privilege access model for administrators. You need to reduce standing privileges and ensure that admin roles are activated only when needed with approval workflow. Requirements: (1) Require approval for activation of Global Administrator role, (2) Set activation duration to 4 hours maximum, (3) Require Azure MFA for activation, (4) Receive notifications when roles are activated, (5) Audit all activations for compliance. Which Microsoft Entra ID capability should you use?

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time role activation with approval, MFA, time limits, notifications, and audit. Option A is wrong because Access Reviews are for periodic reviews, not activation workflows. Option C is wrong because Identity Protection is for risk detection, not role activation. Option D is wrong because Conditional Access enforces access policies but does not manage role activation.

Answer

Access Reviews

Answer

Identity Protection

Answer

Conditional Access

Question 4

Your organization uses Microsoft Sentinel for security operations. You need to ensure that all incidents are automatically assigned to the appropriate analyst team based on the type of threat. What should you configure?

Accepted Answer

Configure an automation rule to set the incident owner based on custom conditions.. Automation rules in Microsoft Sentinel can automatically assign incidents to specific teams based on conditions such as threat type. Option A is incorrect because watchlists are for correlation, not direct assignment. Option B is incorrect because modifying the analytics rule to include a custom field does not automatically assign ownership. Option C is incorrect because playbooks require a trigger and can perform actions, but automation rules are the designated method for incident assignment.

Answer

Use a watchlist to map threat types to teams and trigger a logic app.

Answer

Modify the analytics rule to include a custom field for the assigned team.

Answer

Create a playbook that assigns ownership based on incident properties.

Question 5

Your company uses Microsoft Entra ID. You need to implement a policy that requires all guest users to complete a terms-of-use acceptance before accessing applications. Which two components must be configured?

Accepted Answer

Conditional access policy. To require guest users to accept a terms of use before accessing applications, you must configure a terms-of-use document in Microsoft Entra ID and enforce it via a Conditional Access policy. Option B (Conditional Access policy) is correct because it can be used to require terms-of-use acceptance as a grant control. Option E (Terms-of-use document in Microsoft Entra ID) is correct because the document must be created and associated with the policy. Options A, C, and D are incorrect: Multifactor authentication registration policy enforces MFA, not terms of use; Entitlement Management access packages manage resource access, not terms-of-use enforcement; Identity Protection policy focuses on risk-based conditions.

Answer

Multifactor authentication registration policy

Answer

Entitlement Management access packages

Answer

Identity Protection policy

Question 6

Refer to the exhibit. You are reviewing a conditional access policy in Microsoft Entra ID. The policy is enabled but users report they can still sign in from high-risk sessions. What is the most likely reason?

Accepted Answer

The grant control operator is set to 'OR' instead of 'AND' with multiple controls.. The most likely reason is that the Grant control operator is set to 'OR' instead of 'AND'. When 'OR' is used, meeting any one control is sufficient for access. If the policy requires multiple controls (e.g., MFA and device compliance) to block high-risk sessions, using 'OR' allows a user who meets only one control to still sign in, even from a high-risk session. Option C is correct.

Answer

The policy is not applied to all cloud apps.

Answer

The policy is in report-only mode.

Answer

The policy excludes guest users by default.

Question 7

Your organization, Contoso Ltd., uses Microsoft 365 E5 licenses and has deployed Microsoft Sentinel in Azure. The security operations center (SOC) receives thousands of alerts daily from Microsoft Defender for Cloud, Microsoft Defender for Office 365, and Microsoft Defender for Endpoint. The SOC team is overwhelmed and needs to prioritize incidents effectively. You need to design a solution that uses Microsoft Sentinel to automatically classify incidents as true positive, false positive, or benign positive based on threat intelligence and analytics. Additionally, the solution should automatically close low-confidence false positive incidents after 24 hours if no analyst interaction occurs. You must minimize manual effort and ensure that critical incidents are escalated immediately. What should you do?

Accepted Answer

Create automation rules that trigger on incident creation to classify incidents using custom properties and run a playbook for escalation.. Automation rules trigger on incident creation and can classify incidents using conditions and custom properties, and trigger playbooks for immediate escalation of critical incidents. To handle the 24-hour delayed closure of low-confidence false positives, a playbook should be used (triggered by the automation rule or a separate scheduled playbook) that waits 24 hours and closes the incident if no analyst interaction occurred. This combination of automation rules and playbooks minimizes manual effort and meets all requirements.

Answer

Build a workbook that displays incident classification and assign analysts to review and close low-confidence incidents.

Answer

Use watchlists to define known false positive indicators and configure a playbook to run hourly to close matching incidents.

Answer

Modify the analytics rules to automatically close incidents based on a threshold of false positive indicators.

Question 8

Your organization, Fabrikam Inc., uses Microsoft Intune for device management and Microsoft Entra ID for identity. You need to design a solution to ensure that only compliant and healthy devices can access corporate resources. The solution must require that devices are either enrolled in Intune and compliant, or joined to Azure AD with a health attestation. Additionally, you need to block access from devices that are rooted or jailbroken. You have the following requirements: 1) Enforce conditional access policies to check device compliance and health. 2) Use Microsoft Defender for Endpoint integration for device health signals. 3) Provide a fallback option for unmanaged devices to access only web apps via browser with app protection policies. Which combination of actions should you take?

Accepted Answer

Configure conditional access policies: one requiring device compliance or Azure AD joined with health attestation, and another for unmanaged devices requiring app protection policies.. It satisfies all requirements: the first conditional access policy checks device compliance or Azure AD join with health attestation to ensure only healthy managed devices access corporate resources, and the second policy applies app protection policies to unmanaged devices as a fallback for web app access via browser. Option A is incorrect because requiring MFA for all devices does not verify device compliance or health. Option B is incorrect because it lacks a fallback for unmanaged devices. Option C is incorrect because blocking unknown locations does not address device health, and requiring enrollment for all users is too restrictive.

Answer

Configure conditional access to require MFA for all devices, and use device filters to exclude non-compliant devices.

Answer

Configure conditional access to require device compliance, and enable device health attestation via Intune.

Answer

Configure conditional access to block access from unknown locations, and require device enrollment for all users.

Question 9

Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents. Which feature should you configure?

Accepted Answer

Configure an automation rule to run a playbook automatically. Automation rules in Microsoft Sentinel allow you to define automated responses that trigger when an incident is created or updated, including running playbooks (Azure Logic Apps workflows) automatically. This is the correct approach for automatically responding to high-severity incidents because it eliminates manual intervention and ensures consistent, immediate action based on incident properties like severity.

Answer

Create a playbook and run it manually for each incident

Answer

Set up an analytics rule with automatic response

Answer

Use a workbook to trigger a playbook

Question 10

A company plans to implement Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from sharing credit card numbers via email. What should they configure?

Accepted Answer

Create a DLP policy that detects and blocks credit card numbers in Exchange Online. Microsoft Purview Data Loss Prevention (DLP) policies can be configured to detect sensitive data types, such as credit card numbers, in Exchange Online emails. When a DLP policy is created with a rule that identifies credit card numbers and blocks the email from being sent, it directly prevents users from sharing that data via email. This is the native mechanism for enforcing DLP on email traffic in Microsoft 365.

Answer

Create a sensitivity label and apply it to emails

Answer

Enable communication compliance policies

Answer

Configure a retention policy for email

Question 11

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) resources are assessed against the same security baseline. What should you do?

Accepted Answer

Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark. Microsoft Defender for Cloud's multi-cloud CSPM capabilities allow you to connect AWS and GCP accounts directly, and then apply Azure Policy to enforce the Microsoft Cloud Security Benchmark (MCSB) across all connected clouds. This ensures a unified security baseline assessment for Azure, AWS, and GCP resources, as MCSB is the default policy initiative in Defender for Cloud.

Answer

Configure AWS Config and GCP Security Command Center to export findings to Microsoft Sentinel

Answer

Use regulatory compliance standards for each cloud separately

Answer

Enable the Cloud Security Posture Management (CSPM) plan and configure AWS and GCP connectors

Question 12

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires compliant device. A Conditional Access policy in Microsoft Entra ID (formerly Azure AD) can enforce the requirement that only devices marked as compliant by Intune can access corporate email. This policy evaluates the device compliance status at authentication time and blocks or grants access based on that signal, ensuring that only managed and compliant devices can connect to services like Exchange Online.

Answer

Set up enrollment restrictions in Intune

Answer

Create a device configuration policy that blocks non-compliant devices

Answer

Configure an app protection policy for email apps

Question 13

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Users have smartphones. Which method should you recommend as the primary authentication method?

Accepted Answer

Microsoft Authenticator app with passwordless sign-in. The Microsoft Authenticator app with passwordless sign-in is the correct primary method because it leverages the user's smartphone to provide a seamless, phishing-resistant authentication experience using public/private key cryptography (FIDO2/WebAuthn). This method aligns with the organization's goal of eliminating passwords while utilizing existing smartphone hardware, and it supports a simple user experience by requiring only a biometric or PIN verification on the phone.

Answer

FIDO2 security keys

Answer

SMS-based authentication

Answer

Windows Hello for Business

Question 14

Your organization uses Microsoft Entra ID and needs to ensure that external partners can access only specific applications for 30 days. What should you configure?

Accepted Answer

Entitlement management and create an access package with an expiration of 30 days. Entitlement management in Microsoft Entra ID allows you to create access packages that govern external partner access to specific applications. By configuring an access package with a 30-day expiration, you enforce time-limited access, ensuring partners can only access the designated applications for the required duration. This directly meets the requirement of restricting access to specific apps with a defined expiry.

Answer

B2B direct connect

Answer

Self-service group management

Answer

Conditional Access policy with session control

Question 15

Your organization uses Microsoft Defender XDR for detection and response. You need to create a custom detection rule that alerts when a user performs more than 10 failed sign-ins from different countries within 5 minutes. Which component should you use?

Accepted Answer

Custom detection rule in Microsoft 365 Defender. Custom detection rules in Microsoft 365 Defender allow you to define advanced hunting queries that trigger alerts based on specific event patterns, such as more than 10 failed sign-ins from different countries within 5 minutes. This is the correct component because it operates directly on data within the Defender XDR ecosystem (e.g., AADSignInEventsBeta) without requiring data ingestion into Sentinel.

Answer

Automation rule in Microsoft Sentinel

Answer

Analytics rule in Microsoft Sentinel

Answer

Attack simulation training