SC-100 Design security operations, identity, and compliance capabilities Practice Test 13 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You need to create an analytics rule that generates an incident when a user is reported as compromised by Microsoft Defender for Identity. The rule should use the most efficient method to get this data. What should you use as the data source?

Accepted Answer

The SecurityAlert table with a filter for Defender for Identity.. Option B is correct because Defender for Identity alerts are ingested via the Microsoft 365 Defender connector and can be queried using the SecurityAlert table. Option A is incorrect because IdentityInfo does not contain alerts. Option C is incorrect because the Advanced Hunting schema is not directly available in Sentinel tables. Option D is incorrect because the OfficeActivity table is for audit logs, not security alerts.

Answer

The DeviceEvents table from Advanced Hunting.

Answer

The OfficeActivity table.

Answer

The IdentityInfo table.

Question 2

Your company uses Microsoft Purview Data Loss Prevention (DLP). You need to ensure that credit card numbers are not shared externally via email. What should you configure?

Accepted Answer

Create a DLP policy that detects credit card numbers and blocks external sharing.. Option A is correct because DLP policies can detect sensitive information like credit card numbers and block external sharing. Option B is incorrect because sensitivity labels are for classification, not blocking. Option C is incorrect because retention policies manage retention, not sharing. Option D is incorrect because auto-labeling applies labels, but DLP enforces actions.

Answer

Create a sensitivity label that applies encryption to emails containing credit card numbers.

Answer

Configure auto-labeling for credit card numbers in Microsoft 365.

Answer

Create a retention policy for credit card data.

Question 3

Your organization uses Microsoft Defender for Cloud Apps. You need to identify users who are downloading large amounts of data from a sanctioned cloud app in a short period. What should you configure?

Accepted Answer

Create an anomaly detection policy for impossible travel or unusual activity.. Option B is correct because anomaly detection policies in Defender for Cloud Apps can detect unusual download activity. Option A is incorrect because file policies are for specific file attributes, not volume. Option C is incorrect because app permissions are about OAuth apps. Option D is incorrect because activity policies can be used, but anomaly detection is more specific for this scenario.

Answer

Create an app permission policy to block downloads.

Answer

Create an activity policy to monitor downloads.

Answer

Create a file policy to detect mass download.

Question 4

Which TWO actions should you take to implement a Zero Trust security strategy for identity and access? (Choose two.)

Accepted Answer

Require Multi-Factor Authentication for all users.. Options A and D are correct. Option A is correct because Multi-Factor Authentication is a fundamental Zero Trust control. Option D is correct because Conditional Access enforces policies based on signals. Option B is incorrect because VPN is a perimeter-based approach, not Zero Trust. Option C is incorrect because shared accounts violate the principle of least privilege. Option E is incorrect because passwords alone are not sufficient.

Answer

Use VPN for remote access to the corporate network.

Answer

Rely on strong passwords only.

Answer

Create shared accounts for temporary workers.

Question 5

Which THREE capabilities are part of Microsoft Purview's insider risk management solution? (Choose three.)

Accepted Answer

Forensic evidence capturing user activity on devices.. Options A, C, and E are correct. Option A is correct because indicators for data leaks are core. Option C is correct because forensic evidence captures user activity. Option E is correct because policy templates exist for data theft. Option B is incorrect because DLP is separate. Option D is incorrect because communication compliance is a different solution.

Answer

Communication compliance policies for monitoring emails.

Answer

Data Loss Prevention policies that block sensitive data.

Question 6

Which THREE are valid sources for ingesting data into Microsoft Sentinel? (Choose three.)

Accepted Answer

AWS CloudTrail. Options A, B, and D are correct. Option A is correct because Azure Activity logs are a built-in connector. Option B is correct because Microsoft 365 Defender is a connector. Option D is correct because AWS CloudTrail can be ingested via connector. Option C is incorrect because Google BigQuery is not a direct connector. Option E is incorrect because Adobe Analytics is not supported.

Answer

Adobe Analytics

Answer

Google BigQuery

Question 7

You are a security architect for a global financial services company. The company is adopting Microsoft Sentinel as its primary SIEM and Microsoft Defender XDR for endpoint, email, and identity protection. The company has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. The SOC team needs to be able to investigate incidents that involve lateral movement between on-premises and cloud resources. Additionally, the company must comply with GDPR, requiring that personal data be protected and that data residency requirements are met: all security logs for EU users must remain within the EU. The company already has a Microsoft Sentinel workspace in the West Europe region. You need to design a solution that meets these requirements while minimizing administrative overhead. What should you do?

Accepted Answer

Use the existing West Europe Sentinel workspace and ensure that all EU user logs are sent to that workspace via diagnostic settings.. Option B is correct because a single Sentinel workspace can handle logs from multiple regions, and using the same workspace across regions is simpler. For GDPR data residency, you can configure diagnostics settings to send logs to the workspace without needing separate workspaces. Option A is incorrect because multiple workspaces increase overhead. Option C is incorrect because Azure Arc doesn't change data residency. Option D is incorrect because a separate workspace for EU data adds complexity.

Answer

Deploy Azure Arc on on-premises servers and use Azure Policy to enforce log collection to the West Europe workspace.

Answer

Create a new Sentinel workspace in the EU region for EU logs and a separate workspace for non-EU logs.

Answer

Deploy a separate Sentinel workspace in each region where you have users.

Question 8

Your organization uses Microsoft Intune for mobile device management and Microsoft Entra ID for identity. You are designing a solution to ensure that only devices that are compliant with security policies can access corporate resources. The requirements are: 1) Devices must have a minimum OS version. 2) Devices must have encryption enabled. 3) Devices must not be jailbroken or rooted. 4) Access to corporate apps must be blocked if the device is non-compliant. 5) The solution should automatically remediate non-compliant devices when possible. You need to recommend the minimum configuration. What should you do?

Accepted Answer

Create a device compliance policy in Intune with the required settings, and create a Conditional Access policy that requires compliant devices.. Option A is correct because Intune compliance policies define the requirements, and Conditional Access enforces access. Automatic remediation can be configured in compliance policies for some settings. Option B is incorrect because app protection policies do not enforce device-level compliance. Option C is incorrect because configuration policies do not enforce compliance. Option D is incorrect because only using Compliance Manager does not enforce access.

Answer

Configure Microsoft Purview Compliance Manager to assess compliance and block access.

Answer

Create an app protection policy in Intune that requires minimum OS and encryption.

Answer

Create a device configuration policy in Intune for the settings, and use Azure AD Identity Protection to block access.

Question 9

Your company uses Microsoft 365 E5 licenses and has deployed Microsoft Defender for Office 365. The security team wants to be alerted when a user reports a phishing email using the built-in report message button in Outlook. The alert should be sent to the security team's email address. You need to configure this in the Microsoft 365 Defender portal. What should you do?

Accepted Answer

Configure the User reported messages settings to send alerts to the security team.. Option C is correct because user-reported messages can be configured in the Microsoft 365 Defender portal under Policies & rules > Threat policies > User reported messages settings. Option A is incorrect because Safe Links policies are for URL protection. Option B is incorrect because Safe Attachments policies are for attachments. Option D is incorrect because anti-phishing policies handle detection, not user submissions.

Answer

Create an anti-phishing policy that notifies users about phishing.

Answer

Create a Safe Attachments policy to detect phishing attachments.

Answer

Create a Safe Links policy that alerts on phishing URLs.

Question 10

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that automatically creates an incident in Microsoft Sentinel when a Defender for Endpoint alert of severity 'High' is triggered for any device. The solution should minimize latency and administrative overhead. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel and ensure the 'Create incidents' toggle is enabled.. Option B is correct because Microsoft Sentinel has a built-in data connector for Microsoft Defender XDR that enables automatic incident creation with low latency and minimal configuration. Option A (custom logic app) would add latency and complexity. Option C (manual ingestion) would not be automatic. Option D (Azure AD Identity Protection) is for identity-based alerts, not device alerts.

Answer

Enable the Azure AD Identity Protection connector in Microsoft Sentinel to ingest sign-in and user risk alerts.

Answer

Configure a scheduled analytics rule in Microsoft Sentinel that runs every hour and queries the Defender for Endpoint logs via API.

Answer

Create a custom Azure Logic App that queries the Microsoft Defender for Endpoint APIs and pushes alerts to a custom log table in Log Analytics.

Question 11

Your organization uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to design a solution that automatically applies a 'Confidential' sensitivity label to documents that contain credit card numbers and are shared externally. The solution should also generate an alert when this occurs. Which two configurations should you implement? (Choose TWO.)

Accepted Answer

Create a Microsoft Purview auto-labeling policy that includes the 'Credit Card Number' sensitive info type and specifies the 'Confidential' label.. Options A and B are correct because an auto-labeling policy in Microsoft Purview can scan for sensitive info types (credit card numbers) and apply labels; an app governance policy in Defender for Cloud Apps can detect sharing to external domains and trigger alerts. Option C (data loss prevention) is for blocking, not labeling. Option D (conditional access) controls access, not labeling. Option E (Microsoft Sentinel analytics rule) could generate alerts but is not the primary mechanism for labeling.

Answer

Configure a Microsoft Sentinel analytics rule that queries audit logs for external sharing of labeled documents and generates an incident.

Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance when accessing documents labeled 'Confidential'.

Answer

Configure a Microsoft Purview Data Loss Prevention (DLP) policy that blocks the sharing of documents containing credit card numbers.

Question 12

Your organization uses Microsoft Sentinel. You need to design a solution to detect and automatically respond to a potential brute-force attack against an on-premises application that is published via Azure AD Application Proxy. The solution should block the attacker's IP address in Azure AD Conditional Access for one hour after detecting more than 10 failed login attempts within 5 minutes. What should you implement?

Accepted Answer

Create a Microsoft Sentinel analytics rule that triggers on a KQL query detecting the failed logins, then use a playbook to add the IP to a Conditional Access block list via the Azure AD API.. Option C is correct because you can create a Microsoft Sentinel analytics rule to detect the suspicious activity, and then use a playbook that invokes the Azure AD Conditional Access custom control (block action) to block the IP. Option A is incorrect because Microsoft Entra ID Protection does not cover on-premises apps published via App Proxy with custom logic. Option B is incorrect because a DLP policy is not for authentication. Option D is incorrect because a WAF operates at the network layer and does not integrate directly with Conditional Access.

Answer

Create a Microsoft Purview Data Loss Prevention policy to block the IP address based on the login pattern.

Answer

Deploy a web application firewall (WAF) in front of the application and configure rate limiting to block the IP.

Answer

Configure a Microsoft Entra ID Protection sign-in risk policy to automatically block the user's sign-in after detecting anomalous activity.

Question 13

Your organization uses Microsoft Intune to manage devices. You need to design a compliance policy that requires devices to have a minimum OS version and be encrypted. Which policy type should you use?

Accepted Answer

Create a device compliance policy in Microsoft Intune.. Option A is correct because compliance policies in Intune define the rules devices must meet to be considered compliant, such as minimum OS version and encryption. Option B (configuration policy) is for settings like Wi-Fi. Option C (conditional access) is a separate Entra ID feature. Option D (app protection policy) is for app-level data protection.

Answer

Create a device configuration profile in Microsoft Intune.

Answer

Create a Conditional Access policy in Microsoft Entra ID.

Answer

Create an app protection policy in Microsoft Intune.

Question 14

Refer to the exhibit. You receive an alert from Microsoft Defender for Cloud Apps. You need to investigate this alert in Microsoft Sentinel. Which Microsoft Sentinel feature should you use to visualize the relationship between the user account and the IP address?

Accepted Answer

Use the Investigation graph to explore the entities involved.. Option B is correct because the investigation graph in Microsoft Sentinel provides a visual representation of entities and their relationships, which is ideal for understanding connections between a user and an IP address. Option A (workbook) is for dashboards. Option C (hunting query) is for proactive threat hunting. Option D (automation rule) is for automated responses.

Answer

Configure an automation rule to trigger a playbook.

Answer

Run a hunting query to search for similar alerts.

Answer

Create a new workbook to display the alert details.

Question 15

Your organization plans to use Microsoft Sentinel and Microsoft Defender XDR to manage security incidents. You need to design a solution that ensures all Defender for Cloud Apps alerts are automatically synchronized to Microsoft Sentinel as incidents with the least administrative effort. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel and set incident creation to 'All alerts'.. Option D is correct because enabling the Microsoft Defender XDR connector in Sentinel automatically ingests alerts from all Defender workloads, including Defender for Cloud Apps, and creates incidents. Option A (manual API) is not minimal effort. Option B (Defender for Cloud Apps connector) is legacy and duplicates effort. Option C (Azure AD connector) does not include Defender for Cloud Apps alerts.

Answer

Enable the Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel.

Answer

Create a custom Azure Function that polls the Defender for Cloud Apps API and sends alerts to Sentinel via a custom Log Analytics table.

Answer

Enable the Microsoft Entra ID (Azure AD) data connector in Microsoft Sentinel.