SC-100 Design security operations, identity, and compliance capabilities Practice Test 13 — 15 Questions

Question 1

Your organization uses Microsoft Purview to classify sensitive data. You need to automatically apply a sensitivity label to documents that contain personally identifiable information (PII). Which TWO components should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Auto-labeling policy. Auto-labeling policy (A) is correct because it automatically applies sensitivity labels to documents based on conditions such as the presence of sensitive data types (e.g., PII). Sensitivity label (D) is correct because it defines the classification and protection settings (e.g., encryption, markings) that are applied to the content. Together, they enable automatic classification of PII documents without manual user intervention.

Answer

Retention label

Answer

Data Loss Prevention (DLP) policy

Answer

Trainable classifier

Question 2

Your organization is implementing a zero-trust security model and needs to ensure that all access to cloud resources is verified in real-time. You plan to use Microsoft Entra ID Conditional Access. Which policy component enforces real-time verification of user identity and device compliance before granting access?

Accepted Answer

Conditional Access policy with conditions and grant controls. Conditional Access policies with conditions and grant controls enforce real-time verification by evaluating signals such as user identity, device compliance (via Microsoft Intune), and location before allowing access to cloud resources. The grant controls block or require multi-factor authentication (MFA) or device compliance, ensuring zero-trust principles of explicit verification and least privilege.

Answer

Enable Microsoft Secure Score

Answer

Use Azure AD Application Proxy

Answer

Assign users and groups to the policy

Question 3

Your organization is implementing a data loss prevention (DLP) strategy using Microsoft Purview. The compliance team needs to automatically classify and label sensitive data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct choice because it provides unified data governance across hybrid and multi-cloud environments, including Microsoft 365, Azure SQL Database, and Amazon S3. It automatically scans, classifies, and labels sensitive data using built-in classifiers and sensitivity labels, enabling consistent DLP policies across these disparate data sources.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Records Management

Answer

Microsoft Defender for Cloud Apps

Question 4

Your organization uses Microsoft Defender XDR to detect and respond to threats. The SOC team wants to automatically isolate a device when a high-severity incident is confirmed. Which automation feature should you configure?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender XDR is designed to automatically respond to confirmed high-severity incidents, including isolating devices, without manual intervention. This feature leverages playbooks and machine learning to contain threats rapidly, aligning with the SOC's requirement for automatic isolation upon incident confirmation.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Manual device isolation from Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint's endpoint detection and response (EDR)

Question 5

Your organization uses Microsoft Sentinel as a SIEM. The security team wants to use Microsoft Copilot for Security to assist in incident investigation. You need to ensure that Copilot can access Sentinel data while meeting compliance requirements. Which integration should you configure?

Accepted Answer

Enable Microsoft Copilot for Security plugin for Sentinel. The Microsoft Copilot for Security plugin for Sentinel is the correct integration because it enables Copilot to directly query and analyze Sentinel data through a native, compliant connection. This plugin uses Sentinel's API and role-based access control (RBAC) to ensure that Copilot only accesses data the user is authorized to see, meeting compliance requirements without additional data movement.

Answer

Deploy a playbook to query Sentinel data

Answer

Enable Sentinel's Threat Intelligence connectors

Answer

Use Microsoft Defender for Cloud

Question 6

Your organization needs to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. You plan to use Microsoft Entra ID Conditional Access. Which grant control should you configure?

Accepted Answer

Require multi-factor authentication. The question specifies a requirement to enforce MFA for all users accessing sensitive applications. In Microsoft Entra ID Conditional Access, the 'Require multi-factor authentication' grant control directly enforces Azure AD MFA (e.g., via Microsoft Authenticator, OATH tokens, or SMS) as the primary authentication method. This is the simplest and most direct control to meet the stated goal of requiring MFA, without adding additional constraints like device compliance or authentication strength levels.

Answer

Require authentication strength (e.g., phishing-resistant MFA)

Answer

Require device to be marked as compliant

Answer

Use app enforced restrictions

Question 7

Your organization uses Microsoft Purview Information Protection to label sensitive emails. You need to ensure that labels are applied automatically based on content. Which THREE methods can you use?

Accepted Answer

Sensitive information types. Sensitive information types (C) are predefined or custom patterns that detect sensitive data such as credit card numbers or social security numbers, enabling automatic label application. Auto-labeling policies in Microsoft Purview (D) apply labels automatically to emails and files based on conditions like sensitive information types or trainable classifiers. Trainable classifiers (E) use machine learning to identify content patterns and automatically apply labels without requiring explicit pattern definitions.

Answer

Manual labeling by users

Answer

File plan (for records management)

Question 8

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). The security team receives an alert for a user who has failed authentication 10 times in 5 minutes. What should you configure to reduce false positives while ensuring legitimate brute-force attacks are still detected?

Accepted Answer

Customize the anomaly threshold in UEBA. Customizing the anomaly threshold in UEBA allows you to adjust the sensitivity of the behavioral baseline, reducing false positives for users who legitimately fail authentication multiple times while still detecting true brute-force attacks. UEBA learns normal behavior patterns and flags deviations; by raising the threshold, you require a higher deviation from the baseline before an alert fires, preserving detection of actual attacks.

Answer

Disable UEBA for that user

Answer

Modify the analytics rule that triggered the alert

Answer

Create a playbook to auto-acknowledge the alert

Question 9

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from sharing credit card numbers in email but allow sharing via encrypted email. What should they configure?

Accepted Answer

Configure a DLP rule that blocks sharing unless the email is encrypted, with user override. Microsoft Purview DLP can enforce a policy that blocks sharing of credit card numbers unless the email is encrypted, with a user override option to allow legitimate encrypted sharing. This directly meets the requirement to prevent unencrypted sharing while permitting encrypted email transmission, leveraging DLP's ability to inspect email content and conditionally apply actions based on encryption status.

Answer

Assign a sensitivity label that encrypts the email automatically

Answer

Create a Microsoft Purview Message Encryption policy

Answer

Use Exchange mail flow rules to block unencrypted credit card data

Question 10

Your organization uses Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. You need to create a custom detection rule that triggers when a user receives a phishing email and then attempts to log in from a new location. Which approach should you use?

Accepted Answer

Use Advanced Hunting to create a custom detection rule. Advanced Hunting in Microsoft Defender XDR allows you to write Kusto Query Language (KQL) queries that correlate events across multiple data tables (e.g., EmailEvents, IdentityLogonEvents). You can then create a custom detection rule from that query, which will trigger an alert when a user receives a phishing email and subsequently logs in from a new location, enabling cross-domain correlation within Defender XDR.

Answer

Create a custom detection rule in Microsoft Defender for Endpoint

Answer

Use an automation rule in Microsoft Defender XDR

Answer

Create an analytics rule in Microsoft Sentinel

Question 11

Which TWO actions should you take to implement a zero-trust identity strategy in Microsoft Entra ID?

Accepted Answer

Require multi-factor authentication for all users. For a zero-trust identity strategy in Microsoft Entra ID, requiring multi-factor authentication (MFA) for all users (option B) is a fundamental control to verify identity. Configuring Conditional Access policies based on user risk and device compliance (option E) enforces adaptive, context-aware access. Option A (single sign-on) improves user experience but does not directly enforce zero-trust. Option C (passwordless authentication) enhances security but is not a specific zero-trust action; MFA is more critical. Option D (synchronizing identities) supports hybrid scenarios but does not advance zero-trust principles.

Answer

Enable single sign-on for all applications

Answer

Implement passwordless authentication for all users

Answer

Synchronize all on-premises identities to the cloud

Question 12

Which THREE capabilities does Microsoft Purview provide for compliance management?

Accepted Answer

Information protection with sensitivity labels. Microsoft Purview provides compliance management capabilities including information protection with sensitivity labels, which allow organizations to classify and protect sensitive data across Microsoft 365 services, endpoints, and third-party apps. Sensitivity labels enforce encryption, visual markings, and access restrictions based on policy, directly supporting data loss prevention and governance.

Answer

Identity protection and risk detection

Answer

Endpoint detection and response

Question 13

Which TWO configurations are required to enable Microsoft Defender for Cloud Apps to monitor cloud app usage?

Accepted Answer

Add app connectors for the cloud apps you want to monitor. A is correct because Microsoft Defender for Cloud Apps requires app connectors to establish API-based connections with cloud applications (e.g., Office 365, Salesforce, AWS). These connectors enable the service to ingest activity logs, file metadata, and user sessions for monitoring and threat detection. Without app connectors, Defender for Cloud Apps cannot access the cloud app's data plane to perform its core monitoring functions.

Answer

Configure Microsoft Intune device compliance policies

Answer

Deploy Azure Information Protection scanner

Answer

Synchronize with Microsoft Entra ID

Question 14

Your company uses Microsoft Defender for Cloud Apps and wants to prevent users from uploading sensitive files to personal cloud storage apps. What should you configure?

Accepted Answer

Session policy. Session policy in Microsoft Defender for Cloud Apps allows real-time monitoring and control of user activities based on app and content inspection. By configuring a session policy, you can block or restrict uploads of sensitive files to personal cloud storage apps like Dropbox or Google Drive during the user's session, leveraging reverse proxy capabilities to inspect and intervene in traffic.

Answer

Activity policy

Answer

App connector

Answer

File policy

Question 15

You need to design a solution to synchronize on-premises Active Directory users to Microsoft Entra ID for hybrid identity. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID for hybrid identity because it provides a comprehensive, full-featured synchronization engine that supports password hash synchronization, pass-through authentication, and federation integration. It is the primary tool for hybrid identity scenarios where you need to synchronize a single on-premises AD forest to a single Entra ID tenant, handling attributes, password writeback, and device synchronization.

Answer

Microsoft Identity Manager (MIM)

Answer

Microsoft Entra Connect Cloud Sync

Answer

Active Directory Federation Services (AD FS)