SC-100 Design security operations, identity, and compliance capabilities Practice Test 2 — 15 Questions

Question 1

Your organization has Microsoft Entra ID (Azure AD) and uses Privileged Identity Management (PIM). You need to ensure that when a user activates a privileged role, they must provide a reason and a ticket number. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

PIM role settings requiring justification and approval on activation. PIM role settings allow you to configure activation requirements, including mandatory justification (reason) and ticket number. By editing the role settings in PIM, you can enforce that users provide both a reason and a ticket number when activating a privileged role, ensuring auditability and compliance.

Answer

Conditional Access policy requiring multi-factor authentication

Answer

An access review for the privileged role

Answer

Microsoft Entra Identity Protection user risk policy

Question 2

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. Based on the JSON snippet, what is the most likely outcome when a user with high user risk attempts to sign in?

Accepted Answer

The sign-in is blocked because user risk is high. The Conditional Access policy shown in the JSON snippet includes a condition for 'userRiskLevels' set to 'high', and the grant control is 'block'. When a user with high user risk attempts to sign in, the policy evaluates the user risk level and, since it matches the condition, applies the block action, preventing the sign-in entirely.

Answer

The sign-in is blocked only if sign-in risk is also high

Answer

The sign-in is allowed because sign-in risk is not high

Answer

The user is prompted for multi-factor authentication

Question 3

Refer to the exhibit. You are analyzing a Microsoft Sentinel analytics rule. What does this rule detect?

Accepted Answer

Brute-force attack against a single account. This rule detects a brute-force attack against a single account by triggering when the number of failed logons for a specific user exceeds a threshold within a given time window, followed by a successful logon. The condition `FailedLogons > 5` and `SuccessfulLogon > 0` for the same account indicates that the attacker has guessed the correct password after multiple failed attempts, which is a classic sign of a successful brute-force attack.

Answer

Multiple successful logons for the same account

Answer

Multiple failed logons from the same source IP address

Answer

Overall number of failed logons across all accounts

Question 4

Refer to the exhibit. You are configuring a Microsoft Purview sensitivity label. When a user applies this label to an email, what happens?

Accepted Answer

The email is encrypted and cannot be forwarded, printed, or copied. The sensitivity label is configured with encryption that includes the 'Do Not Forward' option. This applies Azure Rights Management (Azure RMS) protection, which encrypts the email and restricts the recipient from forwarding, printing, or copying the content. The label enforces these restrictions at the message level, regardless of the email client used.

Answer

The email is encrypted but can be forwarded

Answer

The email is not encrypted but cannot be forwarded

Answer

The email is encrypted and the recipient cannot reply

Question 5

Your organization uses Microsoft Sentinel as a SIEM. You need to reduce the cost of data ingestion while ensuring that security-relevant events are retained. You have identified that Windows Event ID 4624 (successful logon) produces a high volume of logs. What should you do?

Accepted Answer

Configure the analytics connector to ingest these events as basic logs. Microsoft Sentinel supports 'basic logs' ingestion, which is a lower-cost tier designed for high-volume, verbose logs like Windows Event ID 4624. Basic logs are stored in the same table but with a reduced retention period (default 30 days) and still retain the full event data, enabling cost savings while preserving the ability to query for security incidents. This approach avoids the need to filter or drop events entirely, ensuring compliance with security monitoring requirements.

Answer

Reduce the retention period for all logs to 30 days

Answer

Ingest the events into a separate Log Analytics workspace with a shorter retention

Answer

Filter out Event ID 4624 at the source using Windows Event Forwarding

Question 6

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only devices with a TPM (Trusted Platform Module) version 2.0 can access corporate resources. What should you configure?

Accepted Answer

Create a device compliance policy that requires TPM 2.0 and use Conditional Access to block non-compliant devices. A device compliance policy in Microsoft Intune can check for TPM 2.0 presence and version. When combined with a Conditional Access policy that blocks non-compliant devices, only devices meeting the TPM 2.0 requirement can access corporate resources. This is the correct approach because Conditional Access enforces the compliance check at the authentication and authorization layer.

Answer

Use Windows Update for Business to ensure TPM firmware is updated

Answer

Configure device enrollment restrictions to require TPM 2.0

Answer

Deploy a device configuration profile that enables TPM 2.0

Question 7

Your organization uses Microsoft Defender for Cloud to manage the security posture of Azure resources. You need to receive alerts when a virtual machine is deployed without just-in-time (JIT) access enabled. What should you do?

Accepted Answer

Use the built-in Defender for Cloud recommendation for JIT access. Microsoft Defender for Cloud provides a built-in security recommendation specifically for just-in-time (JIT) VM access. This recommendation continuously assesses your VMs and generates an alert when a VM is deployed without JIT enabled, without requiring custom rules or manual configuration. It directly addresses the requirement to receive alerts for non-compliant VMs.

Answer

Create a custom alert rule in Microsoft Sentinel

Answer

Configure JIT access on the VM and monitor via activity logs

Answer

Enable JIT access on all VMs

Question 8

A company uses Microsoft Sentinel for security operations. The security team wants to automatically create an incident in Microsoft Sentinel when Microsoft Defender for Cloud detects a high-severity vulnerability on a virtual machine. What should the security team configure?

Accepted Answer

Create an analytics rule with a rule template that maps to the Defender for Cloud alert.. Microsoft Sentinel can ingest high-severity vulnerability alerts from Microsoft Defender for Cloud via the SecurityAlert analytics rule template. When you enable this built-in rule template, Sentinel automatically creates an incident for each Defender for Cloud alert that matches the configured severity (e.g., High). This is the native, out-of-the-box method to convert Defender for Cloud alerts into Sentinel incidents without requiring custom logic or external orchestration.

Answer

Create an automation rule in Microsoft Sentinel.

Answer

Create a playbook in Microsoft Sentinel.

Answer

Create a watchlist in Microsoft Sentinel.

Question 9

A global organization uses Microsoft Entra ID with Conditional Access policies. They want to enforce multifactor authentication (MFA) for all users accessing sensitive apps from outside the corporate network, but allow access without MFA from trusted IPs. What should they configure?

Accepted Answer

Create a Conditional Access policy that includes 'All users' and 'All cloud apps', with conditions for locations: include 'All trusted' and exclude 'All trusted'? Wait, correct approach: include 'All locations' and exclude 'Trusted IPs', and require MFA.. It configures a Conditional Access policy that includes 'All locations' as a condition and excludes 'Trusted IPs' (defined as named locations in Entra ID), then requires MFA as a grant control. This enforces MFA for all access attempts from outside the corporate network while allowing access without MFA from trusted IPs, precisely matching the requirement.

Answer

Create a Conditional Access policy that grants access, requiring MFA for all locations.

Answer

Create a Conditional Access policy that requires MFA for all users and all locations.

Answer

Create a Conditional Access policy that blocks access from all locations except trusted IPs.

Question 10

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. The query returns a list of users and IP addresses with failed sign-ins due to 'User Account Disabled' (ResultType 50057). The analyst wants to create a scheduled analytics rule that generates an incident when a user exceeds 5 such failures from the same IP in an hour. Which setting is missing from the query to meet the requirement?

Accepted Answer

Add a 'bin' or 'bin_at' to group by time windows.. The query currently returns all failed sign-ins due to 'User Account Disabled' but does not aggregate them into time-based windows. To meet the requirement of generating an incident when a user exceeds 5 failures from the same IP in an hour, the query must group the results into 1-hour time buckets using 'bin' or 'bin_at' on the timestamp column, then count the failures per user and IP per bucket, and filter for counts greater than 5. Without this time-windowing, the query cannot enforce the 'in an hour' condition.

Answer

Add a 'let' statement to define the threshold.

Answer

Add a 'project' to select columns.

Answer

Add a 'where' clause to filter by ResultType.

Question 11

A company uses Microsoft Purview to enforce Data Loss Prevention (DLP) policies. They want to prevent users from sharing credit card numbers via email. Which action should they configure in the DLP policy?

Accepted Answer

Block with override.. Configuring 'Block with override' allows the DLP policy to block the email containing credit card numbers while permitting users to override the block with a business justification. This balances security with operational flexibility, ensuring sensitive data is not shared without authorization while avoiding unnecessary disruption.

Answer

Audit only.

Answer

Notify only.

Answer

Block.

Question 12

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices compliant with security baselines can access corporate email via Microsoft Outlook. The solution should use existing Microsoft 365 security features. What should they implement?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device.. Conditional Access policies in Microsoft Entra ID evaluate device compliance status before granting access to cloud apps like Exchange Online. By requiring a compliant device, the policy enforces that only devices meeting security baselines can access corporate email via Outlook, leveraging existing Microsoft 365 identity and access management capabilities.

Answer

Configure an app protection policy in Microsoft Intune.

Answer

Create a device compliance policy in Microsoft Intune.

Answer

Configure a device configuration profile in Microsoft Intune.

Question 13

Refer to the exhibit. An organization uses Microsoft Entra ID Governance. This access review policy is intended to review guest users created after January 1, 2025. The reviewers are users with job title 'Manager'. However, the review is not starting automatically. What is the most likely cause?

Accepted Answer

The recurrence is not configured.. The access review policy snippet does not include any recurrence configuration. Without a defined recurrence (e.g., monthly or quarterly), the review will not start automatically. Access reviews in Microsoft Entra ID Governance require a recurrence schedule to trigger the review process. Option A is incorrect because the reviewer query returns users with job title 'Manager', which is valid. Option C is incorrect because autoReviewEnabled controls whether decisions are applied automatically after the review period ends, not whether the review starts. Option D is incorrect because the scope query syntax is correctly filtering guest users created after January 1, 2025.

Answer

The reviewer query returns no users.

Answer

The autoReviewEnabled setting is false.

Answer

The scope query syntax is incorrect.

Question 14

A company wants to monitor and respond to threats across their entire digital estate, including on-premises servers, cloud workloads, and identities. Which Microsoft solution should they use as a central security information and event management (SIEM) and extended detection and response (XDR) platform?

Accepted Answer

Microsoft Sentinel and Microsoft Defender XDR. Microsoft Sentinel is a cloud-native SIEM and SOAR solution, while Microsoft Defender XDR provides extended detection and response (XDR) across identities, endpoints, and cloud apps. Together they form a central SIEM and XDR platform. Option A is wrong because Microsoft Intune is a mobile device management (MDM) and mobile application management (MAM) tool, not a SIEM/XDR platform. Option B is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection (CWP) tool, not a SIEM. Option D is wrong because Microsoft Purview is a data governance and compliance solution.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud

Answer

Microsoft Purview

Question 15

A company uses Microsoft Defender for Cloud Apps to discover and control cloud apps. They want to receive alerts when a user accesses a sanctioned app from an unusual location. Which feature should they configure?

Accepted Answer

Anomaly detection policies. Anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify behavioral deviations, such as a user accessing a sanctioned app from an unusual geographic location. These policies leverage machine learning to establish a baseline of normal user activity and trigger alerts when access patterns deviate from that baseline, enabling detection of potential account compromise or insider threats.

Answer

Session policies

Answer

File policies

Answer

App discovery policies