SC-100 Design security operations, identity, and compliance capabilities Practice Test 15 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. You need to design a solution that centralizes security alerts and automates remediation across all clouds. Which security operations capability should you prioritize?

Accepted Answer

Use Microsoft Sentinel as a single SIEM and SOAR platform with connectors for AWS and GCP. Option D is correct because Microsoft Sentinel provides a centralized SIEM and SOAR solution that ingests security alerts from multiple clouds and can automate remediation. Option A is wrong because Defender for Cloud does not natively ingest alerts from AWS/GCP into a single SIEM. Option B is wrong because Defender for Identity is focused on on-premises identity threats. Option C is wrong because Microsoft Purview is for data governance, not security operations.

Answer

Configure Microsoft Purview Compliance Manager for regulatory assessments

Answer

Enable Microsoft Defender for Cloud's multi-cloud connector to aggregate alerts

Answer

Deploy Microsoft Defender for Identity to monitor hybrid identities

Question 2

Your organization is planning to use Microsoft Entra ID for identity management. You need to design a solution that enforces conditional access policies for sensitive applications while minimizing user friction. The solution must support offline access for mobile devices and require step-up authentication only when accessing high-risk data. What should you recommend?

Accepted Answer

Use Conditional Access session controls with app-enforced restrictions and grant controls for high-risk sign-ins. Option B is correct because session controls in Conditional Access allow for continuous access evaluation (CAE) and step-up authentication based on risk, while app-based conditional access provides offline access. Option A is wrong because device compliance policies do not support offline access natively. Option C is wrong because risk-based policies alone do not handle offline scenarios. Option D is wrong because identity protection requires online connectivity.

Answer

Implement Microsoft Entra ID Protection to automatically remediate risky users

Answer

Configure risk-based Conditional Access policies with user risk and sign-in risk

Answer

Require device compliance via Intune and block non-compliant devices

Question 3

Your organization has a Microsoft 365 E5 subscription and wants to detect insider data exfiltration attempts. You need to design a solution that can identify users copying sensitive data to personal cloud storage services. Which Microsoft Purview capability should you use?

Accepted Answer

Insider Risk Management. Option A is correct because Insider Risk Management in Microsoft Purview is designed to detect insider data exfiltration scenarios, including copying data to personal cloud storage. Option B is wrong because Data Loss Prevention (DLP) prevents data from being shared but does not detect exfiltration attempts from user activities. Option C is wrong because Communication Compliance focuses on inappropriate communications. Option D is wrong because eDiscovery is for legal discovery.

Answer

Data Loss Prevention (DLP) policies

Answer

eDiscovery (Premium)

Answer

Communication Compliance

Question 4

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy appears to block all legacy authentication. However, some users report that they can still access Exchange Online using Outlook 2010 (which uses basic authentication). What is the most likely reason the policy is not blocking these connections?

Accepted Answer

The policy is configured in 'report-only' mode. Option B is correct because the policy is in 'report-only' mode, which logs but does not block connections. The exhibit shows 'enabled' but not 'enabledForReportingButNotEnforced'. However, the question implies the policy is not blocking, so the most common reason is that it's in report-only mode. Option A is wrong because 'otherClients' covers Outlook 2010. Option C is wrong because the policy is enabled. Option D is wrong because there is no exclusion for specific users.

Answer

The policy excludes all users in the 'Global Administrators' group

Answer

The clientAppTypes condition does not include 'mobileAppsAndDesktopClients'

Answer

The policy state is 'disabled'

Question 5

Your organization uses Microsoft Sentinel as a SIEM. You need to design a solution to detect advanced persistent threats (APTs) by correlating data from multiple sources, including network logs, endpoint data, and threat intelligence feeds. The solution must use machine learning to identify anomalies and reduce false positives. Which analytics rule type should you configure?

Accepted Answer

Fusion. Option A is correct because Fusion uses ML to correlate alerts from multiple sources and detect multi-stage attacks, reducing false positives. Option B is wrong because Scheduled query rules are rule-based and do not use ML. Option C is wrong because Anomaly detection rules are for individual data source anomalies. Option D is wrong because ML Behavior Analytics is not an analytics rule type in Sentinel.

Answer

ML Behavior Analytics

Answer

Anomaly detection rules

Answer

Scheduled query rules

Question 6

Your organization is implementing Microsoft Entra ID Governance. You need to design a solution that automates user access reviews for cloud applications. Which TWO capabilities should you include?

Accepted Answer

Entitlement Management with access packages. Option A and Option C are correct because Access Reviews automate periodic review of access, and Entitlement Management provides automated assignment and removal of access packages, which can trigger reviews. Option B is wrong because Privileged Identity Management (PIM) is for privileged roles, not general access reviews. Option D is wrong because Identity Protection is for risk detection. Option E is wrong because Terms of Use is for consent.

Answer

Identity Protection

Answer

Terms of Use

Answer

Privileged Identity Management (PIM)

Question 7

Your organization uses Microsoft 365 and wants to implement a data loss prevention (DLP) strategy. You need to ensure that sensitive data is protected both at rest and in transit, and that incidents are automatically reported to the security team. Which THREE actions should you take?

Accepted Answer

Enable Endpoint DLP for Windows 10/11 devices. Option A, Option C, and Option D are correct. DLP policies in Microsoft Purview can scan data in Exchange, SharePoint, and OneDrive (at rest) and in emails (in transit). Endpoint DLP covers data in use on devices. Incident reports can be sent to the security team. Option B is wrong because Microsoft Intune is for device management, not DLP. Option E is wrong because Conditional Access controls access but does not report DLP incidents.

Answer

Deploy Microsoft Intune to control app permissions on mobile devices

Answer

Implement Conditional Access policies to block external sharing of sensitive data

Question 8

Your organization needs to meet compliance requirements for GDPR. You need to design a solution that uses Microsoft Purview to classify and protect personal data. Which TWO capabilities should you include?

Accepted Answer

Data Subject Requests (DSR) tool. Option A and Option D are correct. Data Classification in Purview helps identify personal data, and Data Subject Requests (DSR) tool helps respond to GDPR requests. Option B is wrong because Insider Risk Management is for insider threats, not GDPR. Option C is wrong because Communication Compliance is for communication monitoring. Option E is wrong because eDiscovery is for legal discovery, not GDPR-specific classification.

Answer

eDiscovery (Premium)

Answer

Insider Risk Management

Answer

Communication Compliance

Question 9

Your organization uses Microsoft Defender for Cloud and Microsoft Sentinel. You need to design a solution that automates incident response for critical security alerts. Which THREE components should you include?

Accepted Answer

Playbooks built on Azure Logic Apps. Option B, Option C, and Option D are correct. Automation rules in Sentinel trigger playbooks (Azure Logic Apps) for incident response. Microsoft Teams can be used for communication during response. Option A is wrong because Conditional Access is for identity, not incident response automation. Option E is wrong because Microsoft Intune is for device management.

Answer

Microsoft Intune compliance policies

Answer

Conditional Access policies

Question 10

Your organization is designing a Zero Trust architecture using Microsoft 365 security features. You need to ensure that all access requests are verified and least-privilege principles are applied. Which TWO capabilities should you implement?

Accepted Answer

Privileged Identity Management (PIM). Option B and Option D are correct. Conditional Access verifies access requests based on conditions, and Privileged Identity Management (PIM) provides just-in-time access for least privilege. Option A is wrong because Microsoft Entra ID is the identity provider, not a specific verification mechanism. Option C is wrong because Microsoft Defender for Cloud Apps is a CASB, not primarily for identity verification. Option E is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID

Answer

Microsoft Purview

Question 11

You are a security architect for a global financial services company that uses Microsoft 365 E5 and Azure. The company has 50,000 users across 10 regions. The security team needs to detect and respond to identity-based threats in real-time, automate remediation for compromised accounts, and meet regulatory requirements for audit logging. The following requirements must be met: (1) Detect risky sign-ins and user anomalies, (2) Automatically block sign-ins when risk level is high, (3) Provide a centralized dashboard for security analysts to investigate incidents, (4) Retain logs for at least one year for compliance, (5) Minimize false positives by using machine learning. You have the following services available: Microsoft Entra ID P2, Microsoft Sentinel, Microsoft Defender for Identity, Microsoft Purview, and Microsoft Intune. Which combination of services should you use to meet all requirements?

Accepted Answer

Microsoft Entra ID Protection (P2) and Microsoft Sentinel. Option D is correct because Microsoft Entra ID Protection (included in P2) detects risky sign-ins and user anomalies, and can automatically block high-risk sign-ins. Microsoft Sentinel ingests logs from Entra ID and other sources, provides a centralized SIEM dashboard for investigation, and retains logs for up to two years. Machine learning in both Entra ID Protection and Sentinel helps minimize false positives. Option A is wrong because Intune does not provide identity threat detection or centralized SIEM. Option B is wrong because Defender for Identity is for on-premises AD, not cloud-only identity. Option C is wrong because Purview is for data governance, not identity threat detection.

Answer

Microsoft Intune and Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity and Microsoft Purview

Answer

Microsoft Purview and Microsoft Sentinel

Question 12

Your organization is a large healthcare provider that uses Microsoft 365 and Azure. You need to design a compliance solution that meets HIPAA requirements. The solution must automatically classify and protect electronic protected health information (ePHI) in Exchange Online, SharePoint Online, and OneDrive for Business. It must also provide reports on data access and sharing activities for auditors. The following requirements must be met: (1) Detect ePHI using built-in sensitive info types, (2) Apply encryption automatically to emails containing ePHI, (3) Prevent unauthorized sharing of ePHI in SharePoint, (4) Generate activity reports for auditors, (5) Use machine learning to improve classification accuracy. Which Microsoft Purview capabilities should you use?

Accepted Answer

Data Loss Prevention (DLP) and Audit. Option C is correct because Microsoft Purview Data Loss Prevention (DLP) can detect ePHI using HIPAA sensitive info types, automatically encrypt emails, and block unauthorized sharing in SharePoint. Audit logs in Purview provide activity reports. Machine learning in Purview Information Protection improves classification. Option A is wrong because Compliance Manager is for assessments, not protection. Option B is wrong because Information Protection alone does not prevent sharing. Option D is wrong because eDiscovery is for legal discovery, not real-time protection.

Answer

Information Protection and Insider Risk Management

Answer

Compliance Manager and eDiscovery

Answer

eDiscovery and Communication Compliance

Question 13

Your organization is a small business with 200 users using Microsoft 365 Business Premium. You need to secure user identities against common attacks like phishing and password spray. The solution must be easy to deploy and manage with minimal overhead. Requirements: (1) Enable multi-factor authentication (MFA) for all users, (2) Block legacy authentication protocols, (3) Detect and block risky sign-ins, (4) Provide security recommendations to users, (5) Integrate with Microsoft Defender for Office 365 for email protection. Which Microsoft security service should you primarily use?

Accepted Answer

Microsoft Entra ID P1 with Conditional Access and Identity Protection. Option B is correct because Microsoft Entra ID P1 (included in Business Premium) provides Conditional Access for MFA and blocking legacy authentication, Identity Protection for risky sign-ins, and security defaults for easy deployment. Option A is wrong because Entra ID P2 is overkill for small business. Option C is wrong because Microsoft Defender for Cloud is for cloud workloads. Option D is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Entra ID P2

Answer

Microsoft Defender for Cloud

Question 14

Your organization is a multi-national corporation that uses Microsoft 365 E5 and Azure. You need to design a security operations center (SOC) to detect and respond to threats across identities, endpoints, and cloud apps. The SOC team will use a single pane of glass for incident management. Requirements: (1) Centralize alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, (2) Automate incident response playbooks, (3) Use advanced hunting across all data sources, (4) Integrate with external threat intelligence feeds, (5) Provide role-based access control for SOC analysts. Which Microsoft solution should you implement?

Accepted Answer

Microsoft Sentinel. Option B is correct because Microsoft Sentinel is a cloud-native SIEM/SOAR that ingests alerts from all Microsoft Defender products, supports automation playbooks, advanced hunting via KQL, threat intelligence connectors, and RBAC. Option A is wrong because Defender for Cloud is for cloud workload protection, not unified SIEM. Option C is wrong because Microsoft 365 Defender portal provides visibility but limited automation and external TI integration. Option D is wrong because Microsoft Purview is for data governance.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Cloud

Question 15

Your organization uses Microsoft Entra ID for identity management and wants to implement a least-privilege access model for administrators. You need to reduce standing privileges and ensure that admin roles are activated only when needed with approval workflow. Requirements: (1) Require approval for activation of Global Administrator role, (2) Set activation duration to 4 hours maximum, (3) Require Azure MFA for activation, (4) Receive notifications when roles are activated, (5) Audit all activations for compliance. Which Microsoft Entra ID capability should you use?

Accepted Answer

Privileged Identity Management (PIM). Option C is correct because Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time role activation with approval, MFA, time limits, notifications, and audit. Option A is wrong because Conditional Access does not manage role activation. Option B is wrong because Identity Protection is for risk detection. Option D is wrong because Access Reviews are for periodic reviews, not activation workflows.

Answer

Access Reviews

Answer

Identity Protection

Answer

Conditional Access