SC-100 Design security operations, identity, and compliance capabilities Practice Test 14 — 15 Questions

Question 1

Your organization uses Microsoft Purview to manage data governance. You need to design a solution that allows data owners to classify sensitive data in their Microsoft SharePoint Online sites and generate a data catalog. Which Purview tool should you use?

Accepted Answer

Microsoft Purview Data Map. Option A is correct because Microsoft Purview Data Map is used to scan data sources, classify sensitive information, and build a data catalog. Option B (Data Loss Prevention) is for policy enforcement, not cataloging. Option C (Information Protection) is for labeling and protection. Option D (Audit) is for logging activities.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Loss Prevention

Question 2

Your organization needs to meet regulatory requirements that mandate keeping security audit logs for at least seven years. Which Microsoft Sentinel feature should you configure to comply with this requirement?

Accepted Answer

Adjust the data retention settings in the Log Analytics workspace used by Microsoft Sentinel.. Option B is correct because retention settings in the Log Analytics workspace allow you to specify how long data is kept, up to seven years (or longer with archive). Option A (data connectors) are for ingestion, not retention. Option C (workbooks) are for visualization. Option D (playbooks) are for automation.

Answer

Configure data connectors to collect logs from all sources.

Answer

Develop a playbook to export logs to Azure Blob Storage.

Answer

Create a workbook to archive logs to a storage account.

Question 3

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows corporate users to access a sensitive internal application only from managed devices that are compliant with company security policies. The solution should block access from personal devices. Which two components should you use? (Choose TWO.)

Accepted Answer

Microsoft Intune device compliance policy. Options A and C are correct because Intune compliance policies define the security requirements (e.g., encryption, OS version), and Conditional Access policies in Entra ID use the device compliance status to grant or block access. Option B (CA policies) is redundant with A. Option D (app protection policy) is for app-level protection, not device management. Option E (device enrollment) is a prerequisite but not the enforcement mechanism.

Answer

Microsoft Intune app protection policy

Answer

Microsoft Entra ID Conditional Access policy that requires hybrid Azure AD join

Answer

Microsoft Intune device enrollment

Question 4

Your organization uses Microsoft Purview. You need to design a solution that automatically detects and classifies sensitive data such as passport numbers stored in Microsoft OneDrive. The solution should apply a 'Highly Confidential' sensitivity label without user intervention. What should you configure?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that targets OneDrive and includes the 'Passport Number' sensitive info type.. Option B is correct because auto-labeling policies in Microsoft Purview can scan content for sensitive info types and automatically apply labels. Option A (manual labeling) requires user action. Option C (DLP) blocks sharing but does not label. Option D (audit) only logs.

Answer

Create a Data Loss Prevention (DLP) policy that blocks sharing of files with passport numbers.

Answer

Enable auditing in Microsoft Purview to track where passport numbers are stored.

Answer

Configure a manual sensitivity label and train users to apply it.

Question 5

Your organization uses Microsoft Sentinel. You need to design a solution that automatically responds to a detected ransomware incident by isolating the affected device in Microsoft Defender for Endpoint. Which tool should you use to create the automated response?

Accepted Answer

Create a playbook in Microsoft Sentinel using Azure Logic Apps.. Option C is correct because a playbook in Microsoft Sentinel (based on Azure Logic Apps) can automate responses like device isolation. Option A (automation rule) triggers the playbook but does not contain the logic. Option B (hunting query) is for detection. Option D (workbook) is for visualization.

Answer

Create a workbook in Microsoft Sentinel.

Answer

Create an automation rule in Microsoft Sentinel.

Answer

Create a hunting query in Microsoft Sentinel.

Question 6

Your organization uses Microsoft Entra ID. You need to design a solution that requires users to perform multifactor authentication when accessing a critical application from an untrusted network. The solution should not require additional licensing beyond Microsoft Entra ID P1. What should you use?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID.. Option A is correct because Conditional Access policies are included with Microsoft Entra ID P1 and can enforce MFA based on network location. Option B (ID Protection) requires P2 licensing. Option C (Intune) is for device management. Option D (per-user MFA) is legacy and less flexible.

Answer

Configure a risk-based policy in Microsoft Entra ID Protection.

Answer

Enable per-user MFA in Microsoft Entra ID.

Answer

Deploy a device compliance policy in Microsoft Intune.

Question 7

Your organization uses Microsoft Purview and Microsoft Sentinel. You need to design a solution that alerts the security team when a user tries to share a file labeled 'Highly Confidential' with an external email address. The alert should include the file name, user, and external recipient. Which two components should you use? (Choose TWO.)

Accepted Answer

Microsoft Sentinel analytics rule that queries DLP audit logs. Options B and D are correct because Microsoft Purview DLP can detect and alert on sharing of sensitive files, and Microsoft Sentinel can ingest those DLP alerts and provide a central interface for investigation. Option A (auto-labeling) applies labels but does not generate alerts. Option C (Information Protection) is for labeling, not monitoring. Option E (audit) logs events but does not generate proactive alerts.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Answer

Microsoft Purview auto-labeling policy

Question 8

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to design a solution that automatically remediates non-compliant devices by running a remediation script. Which Intune component should you use?

Accepted Answer

Remediation policy in Microsoft Intune. Option D is correct because Intune remediation policies (part of device management) allow you to automatically run scripts to fix non-compliant settings. Option A (compliance policy) sets rules but does not run scripts. Option B (configuration profile) deploys settings. Option C (app protection policy) is for app data.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 9

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to design a solution that collects security events from Azure virtual machines and sends them to Microsoft Sentinel. The solution must minimize cost and management overhead. Which data connector should you use?

Accepted Answer

Windows Security Events via the Log Analytics agent (AMA). Option C is correct because the Azure Windows VM (or Linux VM) connector via the Log Analytics agent is the standard, cost-effective way to collect security events. Option A (Azure Activity) is for subscription-level logs. Option B (Defender for Cloud) requires additional licensing. Option D (Azure AD) is for identity logs.

Answer

Microsoft Defender for Cloud data connector

Answer

Azure Activity data connector

Answer

Microsoft Entra ID (Azure AD) data connector

Question 10

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows only hybrid Azure AD joined devices to access a sensitive application. The solution must also require that the device is compliant with company policies. Which two components should you configure? (Choose TWO.)

Accepted Answer

Conditional Access policy with 'Require hybrid Azure AD joined device'. Options A and C are correct because Conditional Access policies can require hybrid Azure AD join as a grant control, and Intune compliance policies define the compliance rules. Option B (MFA) is not required by the scenario. Option D (app protection) is for app-level protection. Option E (device enrollment) is a prerequisite but not an access control.

Answer

Intune app protection policy

Answer

Conditional Access policy with 'Require multifactor authentication'

Answer

Intune device enrollment

Question 11

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that investigates and responds to a ransomware incident. Which three actions should you take? (Choose THREE.)

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint.. Options A, C, and D are correct because running a hunting query can identify the scope, isolating devices prevents further spread, and reviewing the incident timeline in Defender XDR provides context. Option B (new workbook) is for reporting, not investigation. Option E (delete log data) would destroy evidence.

Answer

Create a new workbook to visualize the incident.

Answer

Delete all log data older than 24 hours to improve performance.

Question 12

Your organization uses Microsoft Purview. You need to design a solution that discovers and classifies sensitive data across Microsoft 365 services. Which two services should you include in your data map? (Choose TWO.)

Accepted Answer

SharePoint Online. Options A and C are correct because Microsoft Purview Data Map can scan SharePoint Online and OneDrive for sensitive data. Option B (Azure SQL Database) is not a Microsoft 365 service. Option D (Azure Blob Storage) is not Microsoft 365. Option E (Power BI) is a Microsoft 365 service but is not typically scanned for sensitive data classification in the same way; however, it can be included, but the question asks for data across Microsoft 365 services, and SharePoint and OneDrive are the primary sources.

Answer

Power BI

Answer

Azure SQL Database

Answer

Azure Blob Storage

Question 13

You are a security architect for a large organization that uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Entra ID. The organization has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD. The security team needs to detect and automatically respond to a specific attack pattern: an attacker compromises a user's credentials and then uses a new device to sign in to a critical application from an unusual location. The response should block the user's account for one hour and reset the user's password. You have already configured Microsoft Sentinel to receive sign-in logs from Azure AD. You need to design the detection and automated response. What should you do?

Accepted Answer

Enable the Microsoft Entra ID Protection data connector in Microsoft Sentinel, create an analytics rule from the 'Sign-in from new device' template, and configure a playbook to block the user and reset password.. Option C is correct because the Microsoft Entra ID Protection connector provides risk detections that can be ingested into Sentinel, and a playbook can be triggered to block the user and reset the password via the Azure AD API. Option A is incorrect because ID Protection can detect risky sign-ins, but the requirement is to use Sentinel for detection and response. Option B is incorrect because a scheduled query would be less efficient and not leverage ID Protection's risk assessments. Option D is incorrect because custom detection rules are less accurate than ID Protection's machine learning.

Answer

Create a Microsoft Sentinel scheduled analytics rule that queries sign-in logs for unusual location and new device, then trigger a playbook to block the user and reset password.

Answer

Create a custom detection rule in Microsoft Defender XDR for the attack pattern and configure an automated action to block the user.

Answer

Enable Microsoft Entra ID Protection and configure a risk-based Conditional Access policy to block access and require password change.

Question 14

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to design a solution that ensures all Windows 10 devices are running the latest security updates and have real-time protection enabled. If a device is non-compliant, it should be blocked from accessing corporate resources. You have already created a Conditional Access policy that requires compliant devices. You need to configure the compliance requirements and automatic remediation. What should you do?

Accepted Answer

Create an Intune device compliance policy that requires minimum OS version and real-time protection, and create a remediation policy that automatically enables real-time protection if disabled.. Option B is correct because Intune compliance policies can check for minimum OS version and require Defender for Endpoint health status, and remediation policies can automatically enforce settings. Option A is incorrect because it does not address automatic remediation. Option C is incorrect because configuration profiles deploy settings but do not enforce compliance. Option D is incorrect because app protection policies are for app-level data.

Answer

Create an Intune device configuration profile that enforces the minimum OS version and enables real-time protection.

Answer

Create an Intune app protection policy that requires the device to have the latest updates and real-time protection.

Answer

Create an Intune device compliance policy that requires minimum OS version and real-time protection, and use the Conditional Access policy to block non-compliant devices.

Question 15

Your organization uses Microsoft Purview to manage data governance. The compliance team needs to be able to search for and investigate whether any sensitive data (e.g., credit card numbers) is stored in Microsoft Teams messages. They also need to place a legal hold on specific user's Teams messages for eDiscovery. You need to design the solution. What should you configure?

Accepted Answer

Use Microsoft Purview eDiscovery (Premium) to create a case, search for credit card numbers in Teams messages, and place a hold on the user's mailbox and Teams data.. Option A is correct because Microsoft Purview eDiscovery (Premium) can search across Teams messages and place legal holds. Option B (audit) logs activities but does not allow content search. Option C (DLP) prevents sharing but does not search. Option D (Information Protection) applies labels but does not provide eDiscovery capabilities.

Answer

Configure a sensitivity label for credit card numbers and apply it to Teams messages.

Answer

Create a Data Loss Prevention policy that monitors Teams messages for credit card numbers.

Answer

Enable Microsoft Purview Audit to search the audit log for Teams messages containing credit card numbers.