SC-100 Design security operations, identity, and compliance capabilities Practice Test 15 — 15 Questions

Question 1

A company uses Microsoft Intune to manage devices. They need to ensure that only compliant devices can access corporate email. They plan to use Conditional Access in Microsoft Entra ID. Which THREE components must be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Device registration in Entra ID. Device registration in Entra ID (A) is required because Conditional Access policies evaluate device compliance based on the device's identity in Entra ID. Without registration, the device lacks a unique identity that Entra ID can assess for compliance status, making it impossible to enforce access controls based on device state.

Answer

Windows Autopilot deployment profile

Answer

Configuration profile in Intune

Question 2

Your organization needs to enforce multi-factor authentication (MFA) for all users accessing Microsoft Entra ID integrated applications. However, users in the finance department should be exempted from MFA when accessing a specific legacy financial app that does not support modern authentication. What should you design?

Accepted Answer

Create a Conditional Access policy that requires MFA for all cloud apps except the legacy app. Conditional Access policies allow granular control over which applications require MFA. By creating a policy that requires MFA for all cloud apps except the legacy financial app, you can enforce MFA broadly while exempting the specific app that does not support modern authentication. This approach is more flexible and secure than per-user MFA or security defaults, as it can target specific applications and conditions.

Answer

Enable security defaults for all users

Answer

Enable per-user MFA and exclude the finance department

Answer

Use Microsoft Entra Identity Protection to require MFA based on risk

Question 3

Your organization is implementing a zero-trust security model. You need to design a solution that continuously verifies user identity, device compliance, and access context before granting access to corporate resources. The solution should also support risk-based policies. Which Microsoft security capability should be at the core of this design?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the core policy engine for zero-trust, enabling continuous verification of user identity, device compliance, and access context before granting resource access. It integrates with risk signals from Microsoft Entra ID Protection to enforce risk-based policies, such as requiring multi-factor authentication when sign-in risk is high. This aligns directly with the zero-trust principle of 'never trust, always verify' by evaluating conditions in real time.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 4

Your company is deploying a new line-of-business application in Azure that must comply with PCI DSS. The application uses Azure SQL Database. You need to design a solution to encrypt sensitive data at rest and in transit, and to audit access to sensitive columns. Which combination of Microsoft security capabilities should you recommend?

Accepted Answer

Transparent Data Encryption, Always Encrypted, and Azure SQL Auditing. Transparent Data Encryption (TDE) encrypts the SQL database at rest, Always Encrypted protects sensitive columns in transit and at rest by ensuring encryption keys are never exposed to the database engine, and Azure SQL Auditing logs all access to sensitive columns for compliance with PCI DSS requirements.

Answer

Dynamic Data Masking and Azure SQL Firewall rules

Answer

Azure Policy and Microsoft Defender for Cloud

Answer

Azure Storage Service Encryption and Azure Key Vault

Question 5

Your organization uses Microsoft Sentinel as its SIEM. You receive a large number of low-severity alerts from various sources, overwhelming the security operations team. You need to design a solution to reduce alert fatigue while ensuring that critical incidents are not missed. The solution should also automatically collect feedback from analysts when they close an incident. What should you implement?

Accepted Answer

Tune analytics rules to generate incidents only for high-fidelity alerts and use automation rules to collect feedback on incident closure. Tuning analytics rules to generate incidents only for high-fidelity alerts directly reduces alert volume without compromising detection of critical threats. Automation rules in Microsoft Sentinel can trigger a playbook or run a logic app on incident closure, enabling automatic collection of analyst feedback via custom fields or external systems.

Answer

Create a separate analytics rule for each severity level

Answer

Implement a playbook that automatically closes low-severity alerts and collects feedback

Answer

Increase the severity threshold for all analytics rules

Question 6

Your organization is required to retain all Microsoft Teams chat messages for 7 years due to regulatory compliance. You need to design a solution that automatically retains and, if needed, e-discovery searches these messages. What should you configure?

Accepted Answer

Microsoft Purview retention policies and eDiscovery. Microsoft Purview retention policies are designed to retain data for a specified period (e.g., 7 years) and can be applied to Microsoft Teams chat messages. eDiscovery (now part of Microsoft Purview eDiscovery) allows authorized users to search, hold, and export retained content for legal or compliance purposes. Together, they meet the regulatory requirement for retention and searchability.

Answer

Microsoft Purview Data Loss Prevention policies

Answer

Azure Policy

Answer

Sensitivity labels auto-labeling

Question 7

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud automation resource. You want the automation to trigger a playbook in Microsoft Sentinel when a high-severity security assessment is found. Based on the exhibit, what is the missing configuration?

Accepted Answer

The action type should be 'LogicApp' instead of 'EventHub'. Microsoft Defender for Cloud automation can trigger a playbook in Microsoft Sentinel only by using a LogicApp action. The exhibit shows an EventHub action type, which is used for streaming events to an event hub, not for invoking a playbook. To trigger a Sentinel playbook from a Defender for Cloud assessment, the action type must be set to 'LogicApp' and configured with the playbook's trigger URL.

Answer

The severity filter should be 'Low' to capture all assessments

Answer

The eventSource should be 'Alerts' instead of 'Assessments'

Answer

The API version should be '2020-01-01'

Question 8

You are designing an incident response plan for a company using Microsoft Defender XDR. The team needs to automatically notify the SOC via email when an incident of high severity is created. What should you use?

Accepted Answer

Configure an automation rule with an action to send an email notification.. Automation rules in Microsoft Defender XDR are specifically designed to trigger automated actions—including sending email notifications—when an incident is created or updated. Unlike playbooks, automation rules can directly send email without requiring a Logic Apps connector, and they operate natively within the Defender portal's incident lifecycle.

Answer

Modify the analytics rule to send an email when an alert fires.

Answer

Create a playbook that sends an email when an incident is created.

Answer

Use advanced hunting to query high severity incidents and send email.

Question 9

A company wants to automate incident response in Microsoft 365 Defender. Which THREE actions can be automated using automated investigation and response (AIR) capabilities? (Choose three.)

Accepted Answer

Block a file hash across the organization.. Microsoft 365 Defender's automated investigation and response (AIR) can automatically block a file hash at the tenant level using threat intelligence and cloud-delivered protection. When a malicious file is detected, AIR can create an indicator to block the hash across all endpoints via Microsoft Defender for Endpoint, preventing further execution.

Answer

Reset a user's password.

Answer

Create a new user account.

Question 10

Your organization uses Microsoft Intune for mobile device management. You need to configure a compliance policy for iOS devices that requires the device to be jailbreak-detected and have a minimum OS version. Which two settings should you configure in the compliance policy? (Choose two.)

Accepted Answer

Minimum OS version. B is correct because the compliance policy must specify a minimum OS version to ensure iOS devices meet the required security baseline, preventing outdated devices with known vulnerabilities from accessing corporate resources. D is correct because jailbreak detection is a specific compliance setting that identifies compromised devices, which are a significant security risk as they bypass iOS security controls.

Answer

Require passcode

Answer

Device encryption

Question 11

Your organization has Microsoft Sentinel. You need to create an analytics rule that detects when a user account is created outside of business hours (9 AM to 5 PM, Monday-Friday). Which KQL query should you use as the rule query?

Accepted Answer

... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) !between (9 .. 17). `dayofweek()` returns 1 for Sunday, 2 for Monday, ..., 7 for Saturday. To represent Monday (2) through Friday (6), the range must be `between (2 .. 6)`. The `!between (9 .. 17)` correctly excludes the 9 AM to 5 PM business hours, so the rule triggers only when a user account is created outside those hours on a weekday.

Answer

... | where dayofweek(TimeGenerated) between (1 .. 5) and datetime_part("hour", TimeGenerated) !between (9 .. 17)

Answer

... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) between (9 .. 17)

Answer

... | where dayofweek(TimeGenerated) !between (2 .. 6) or datetime_part("hour", TimeGenerated) between (9 .. 17)

Question 12

Your company uses Microsoft Purview to protect sensitive data. You need to automatically apply a retention label to documents containing credit card numbers detected in SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy for retention labels targeting sensitive info types.. Auto-labeling policies in Microsoft Purview can automatically apply retention labels to documents based on sensitive info types, such as credit card numbers. This allows you to enforce retention rules without manual intervention, directly targeting the detected sensitive data in SharePoint Online.

Answer

Configure a Data Loss Prevention (DLP) policy to apply the label.

Answer

Create a sensitivity label with auto-labeling for SharePoint.

Answer

Use a trainable classifier to detect credit card numbers and apply the label.

Question 13

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and block data exfiltration from sanctioned cloud apps to personal devices. What should you configure?

Accepted Answer

Create a session policy with app governance to block download.. A session policy with app governance in Microsoft Defender for Cloud Apps allows you to monitor and control user activities in real time. By configuring a session policy to block downloads, you can prevent data exfiltration from sanctioned cloud apps to personal devices, as the policy inspects HTTP/HTTPS traffic and enforces access controls based on user context and device compliance.

Answer

Create an OAuth app policy to revoke permissions.

Answer

Create an app discovery policy to identify unsanctioned apps.

Answer

Create a file policy to detect sensitive data in sanctioned apps.

Question 14

You are a security architect for a global financial services company. The company is adopting Microsoft Sentinel as its primary SIEM and Microsoft Defender XDR for endpoint, email, and identity protection. The company has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. The SOC team needs to be able to investigate incidents that involve lateral movement between on-premises and cloud resources. Additionally, the company must comply with GDPR, requiring that personal data be protected and that data residency requirements are met: all security logs for EU users must remain within the EU. The company already has a Microsoft Sentinel workspace in the West Europe region. You need to design a solution that meets these requirements while minimizing administrative overhead. What should you do?

Accepted Answer

Use the existing West Europe Sentinel workspace and ensure that all EU user logs are sent to that workspace via diagnostic settings.. A single Microsoft Sentinel workspace in West Europe can collect logs from multiple regions via diagnostic settings, satisfying GDPR data residency by keeping EU logs within the EU. This minimizes administrative overhead. Option A is incorrect because Azure Arc does not address data residency and adds unnecessary complexity. Option C is incorrect because creating a separate workspace increases overhead without benefit, as the existing workspace meets requirements. Option D is incorrect because per-region workspaces greatly increase administrative overhead.

Answer

Deploy Azure Arc on on-premises servers and use Azure Policy to enforce log collection to the West Europe workspace.

Answer

Create a new Sentinel workspace in the EU region for EU logs and a separate workspace for non-EU logs.

Answer

Deploy a separate Sentinel workspace in each region where you have users.

Question 15

Your organization uses Microsoft Intune for mobile device management and Microsoft Entra ID for identity. You are designing a solution to ensure that only devices that are compliant with security policies can access corporate resources. The requirements are: 1) Devices must have a minimum OS version. 2) Devices must have encryption enabled. 3) Devices must not be jailbroken or rooted. 4) Access to corporate apps must be blocked if the device is non-compliant. 5) The solution should automatically remediate non-compliant devices when possible. You need to recommend the minimum configuration. What should you do?

Accepted Answer

Create a device compliance policy in Intune with the required settings, and create a Conditional Access policy that requires compliant devices.. Intune device compliance policies define the required security settings (minimum OS, encryption, jailbreak/root detection) and can include actions for automatic remediation when possible. A Conditional Access policy in Entra ID then requires devices to be marked compliant before accessing corporate resources. Option A is incorrect because Microsoft Purview Compliance Manager is a compliance management tool that does not enforce real-time access control. Option B is incorrect because app protection policies (MAM) operate at the app level and do not enforce device-level compliance. Option D is incorrect because device configuration policies are for settings management, not compliance enforcement, and Entra ID Identity Protection is for risk-based policies, not device compliance checks.

Answer

Configure Microsoft Purview Compliance Manager to assess compliance and block access.

Answer

Create an app protection policy in Intune that requires minimum OS and encryption.

Answer

Create a device configuration policy in Intune for the settings, and use Azure AD Identity Protection to block access.