SC-100 Design security operations, identity, and compliance capabilities Practice Test 2 — 15 Questions

Question 1

Your company is deploying Microsoft Intune for mobile device management. You need to ensure that corporate data on personally owned devices is protected without affecting the user's personal data. Which Intune feature should you use?

Accepted Answer

App Protection Policies (MAM). App Protection Policies (MAM) are the correct choice because they allow you to manage and protect corporate data within applications on personally owned devices without requiring device enrollment. This ensures that corporate data is encrypted, can be selectively wiped, and is prevented from being copied to personal apps, while leaving the user's personal data untouched.

Answer

Device compliance policies

Answer

Conditional Access for app control

Answer

Windows Autopilot

Question 2

Your organization is implementing a data loss prevention (DLP) strategy using Microsoft Purview. The compliance team needs to automatically classify and label sensitive data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Purview feature should you use?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct choice because it provides unified data governance across hybrid and multi-cloud environments, including Microsoft 365, Azure SQL Database, and Amazon S3. It automatically scans, classifies, and labels sensitive data using built-in classifiers and sensitivity labels, enabling consistent DLP policies across these disparate data sources.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Records Management

Answer

Microsoft Defender for Cloud Apps

Question 3

Your organization uses Microsoft Defender XDR to detect and respond to threats. The SOC team wants to automatically isolate a device when a high-severity incident is confirmed. Which automation feature should you configure?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender XDR is designed to automatically respond to confirmed high-severity incidents, including isolating devices, without manual intervention. This feature leverages playbooks and machine learning to contain threats rapidly, aligning with the SOC's requirement for automatic isolation upon incident confirmation.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Manual device isolation from Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint's endpoint detection and response (EDR)

Question 4

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate using their existing on-premises credentials while gradually moving to cloud-only authentication. Which authentication method should you implement first?

Accepted Answer

Password Hash Synchronization (PHS) with Seamless SSO. Password Hash Synchronization (PHS) quickly syncs password hashes and allows Seamless SSO. Option B is correct. Option A requires more infrastructure. Option C is for federation. Option D is a broader strategy, not a method.

Answer

Azure AD Connect

Answer

Active Directory Federation Services (AD FS)

Answer

Pass-through Authentication (PTA)

Question 5

Your organization uses Microsoft Sentinel as a SIEM. The security team wants to use Microsoft Copilot for Security to assist in incident investigation. You need to ensure that Copilot can access Sentinel data while meeting compliance requirements. Which integration should you configure?

Accepted Answer

Enable Microsoft Copilot for Security plugin for Sentinel. The Microsoft Copilot for Security plugin for Sentinel is the correct integration because it enables Copilot to directly query and analyze Sentinel data through a native, compliant connection. This plugin uses Sentinel's API and role-based access control (RBAC) to ensure that Copilot only accesses data the user is authorized to see, meeting compliance requirements without additional data movement.

Answer

Deploy a playbook to query Sentinel data

Answer

Enable Sentinel's Threat Intelligence connectors

Answer

Use Microsoft Defender for Cloud

Question 6

Your organization needs to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. You plan to use Microsoft Entra ID Conditional Access. Which grant control should you configure?

Accepted Answer

Require multi-factor authentication. The question specifies a requirement to enforce MFA for all users accessing sensitive applications. In Microsoft Entra ID Conditional Access, the 'Require multi-factor authentication' grant control directly enforces Azure AD MFA (e.g., via Microsoft Authenticator, OATH tokens, or SMS) as the primary authentication method. This is the simplest and most direct control to meet the stated goal of requiring MFA, without adding additional constraints like device compliance or authentication strength levels.

Answer

Require authentication strength (e.g., phishing-resistant MFA)

Answer

Require device to be marked as compliant

Answer

Use app enforced restrictions

Question 7

Your organization is implementing a privileged access strategy using Microsoft Entra ID. You need to provide just-in-time (JIT) access to Azure resources for administrators. Which TWO features should you use?

Accepted Answer

Privileged Identity Management (PIM) for Azure AD roles. Privileged Identity Management (PIM) for Azure AD roles enables just-in-time (JIT) activation of Azure AD roles, providing time-bound approval-based elevated access to Azure resources. Privileged Access Groups (PAG) extend JIT capabilities by allowing Azure AD roles and Azure RBAC roles to be assigned to groups, enabling JIT membership activation for granular resource access.

Answer

Identity Protection user risk policy

Answer

Azure RBAC roles

Answer

Access reviews

Question 8

Your organization is using Microsoft Sentinel to detect advanced threats. You need to ensure that alerts from Microsoft Defender XDR are automatically synchronized with Sentinel and that incidents are created. Which THREE components are required?

Accepted Answer

Microsoft Defender XDR data connector. The Microsoft Defender XDR data connector (Option B) is required because it is the specific integration point that ingests alerts and raw signals from Microsoft 365 Defender into Microsoft Sentinel. Without this connector, there is no automated synchronization of Defender XDR alerts into the Sentinel workspace.

Answer

Entity behavior analytics (UEBA)

Answer

Automation rule to trigger playbook

Question 9

Your organization uses Microsoft Purview Information Protection to label sensitive emails. You need to ensure that labels are applied automatically based on content. Which THREE methods can you use?

Accepted Answer

Sensitive information types. Sensitive information types (C) are predefined or custom patterns that detect sensitive data such as credit card numbers or social security numbers, enabling automatic label application. Auto-labeling policies in Microsoft Purview (D) apply labels automatically to emails and files based on conditions like sensitive information types or trainable classifiers. Trainable classifiers (E) use machine learning to identify content patterns and automatically apply labels without requiring explicit pattern definitions.

Answer

Manual labeling by users

Answer

File plan (for records management)

Question 10

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. The policy is intended to block legacy authentication. However, users are still able to access email using Outlook (modern auth). What is the most likely reason?

Accepted Answer

The clientAppTypes list does not include 'modernAuth'. Option B is correct because the 'clientAppTypes' list in the Conditional Access policy must include 'modernAuth' to explicitly target and block modern authentication clients. Without this entry, the policy only applies to legacy authentication protocols (e.g., POP, IMAP, SMTP), leaving modern auth flows (like Outlook using OAuth 2.0) unaffected. The JSON snippet shows 'clientAppTypes': ['exchangeActiveSync', 'other'], which omits 'modernAuth', so Outlook (modern auth) bypasses the block.

Answer

The policy does not include 'Microsoft Office 365' in applications

Answer

The grant control should be 'require MFA' instead of 'block'

Answer

The policy state is set to 'enabled' incorrectly

Question 11

Refer to the exhibit. A KQL query is used in Microsoft Sentinel to detect brute-force attacks. The query returns no results despite known brute-force attempts. What is the most likely issue?

Accepted Answer

The EventID 4625 may not cover all authentication failures. EventID 4625 in Windows Security logs specifically records failed logon attempts, but brute-force attacks may target other authentication protocols (e.g., RDP, SMB, or network-level authentication) that generate different EventIDs (such as 4648, 4776, or 5156). Additionally, some brute-force attempts might be blocked at the network layer or use non-Windows authentication methods, so relying solely on EventID 4625 will miss those events. Therefore, the query returns no results because it does not capture all authentication failure scenarios.

Answer

The query lacks a time filter

Answer

The 'IPAddress' field does not exist in SecurityEvent

Answer

The 'count()' aggregation is incorrect

Question 12

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. The security team requires that only HTTPS traffic is allowed and that TLS 1.2 is enforced. Does this template meet the requirements?

Accepted Answer

Yes, the template correctly enforces HTTPS and TLS 1.2. Option D is correct because the ARM template sets 'supportsHttpsTrafficOnly' to true, which enforces HTTPS-only traffic, and 'minimumTlsVersion' to 'TLS1_2', which enforces TLS 1.2 as the minimum protocol version. These two properties together fully satisfy the security team's requirement that only HTTPS traffic is allowed and TLS 1.2 is enforced.

Answer

No, because 'minimumTlsVersion' should be 'TLS1_0'

Answer

No, because 'supportsHttpsTrafficOnly' should be false

Answer

No, because 'defaultAction': 'Deny' blocks all traffic including HTTPS

Question 13

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). The security team receives an alert for a user who has failed authentication 10 times in 5 minutes. What should you configure to reduce false positives while ensuring legitimate brute-force attacks are still detected?

Accepted Answer

Customize the anomaly threshold in UEBA. Customizing the anomaly threshold in UEBA allows you to adjust the sensitivity of the behavioral baseline, reducing false positives for users who legitimately fail authentication multiple times while still detecting true brute-force attacks. UEBA learns normal behavior patterns and flags deviations; by raising the threshold, you require a higher deviation from the baseline before an alert fires, preserving detection of actual attacks.

Answer

Disable UEBA for that user

Answer

Modify the analytics rule that triggered the alert

Answer

Create a playbook to auto-acknowledge the alert

Question 14

A company uses Microsoft Defender for Cloud to assess the security posture of their hybrid environment. They need to ensure that all Azure subscriptions are evaluated against the same set of regulatory compliance standards. What should they configure?

Accepted Answer

Assign the regulatory compliance standard to the management group containing all subscriptions. Option C is correct because regulatory compliance standards in Microsoft Defender for Cloud are assigned at the management group scope, which automatically applies the standard to all subscriptions within that management group. This ensures consistent evaluation across the entire hybrid environment without needing per-subscription configuration. The assignment inherits down the hierarchy, so all subscriptions under the management group are assessed against the same compliance framework.

Answer

Assign the standard to each subscription individually

Answer

Create an Azure Policy initiative and assign it to the management group

Answer

Use Microsoft Defender for Cloud's default policy

Question 15

Your organization uses Microsoft Intune to manage devices. You need to ensure that corporate data on personally owned devices is removed when a user leaves the company, but personal data remains intact. What should you use?

Accepted Answer

Selective wipe (retire). Selective wipe (retire) is the correct choice because it removes only corporate data from a personally owned device enrolled in Microsoft Intune, while preserving the user's personal data. This is achieved by targeting managed app data and corporate profiles, leaving personal apps, photos, and settings intact. It aligns with the requirement to protect corporate information upon employee departure without affecting the user's personal property.

Answer

Conditional Access policy

Answer

Full wipe

Answer

Device compliance policy