SC-100 Design security operations, identity, and compliance capabilities Practice Test 3 — 15 Questions

Question 1

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from sharing credit card numbers in email but allow sharing via encrypted email. What should they configure?

Accepted Answer

Configure a DLP rule that blocks sharing unless the email is encrypted, with user override. Option A is correct because the DLP rule can be set to block with override allowing encrypted email. Option B is wrong because encryption policies don't block unencrypted sharing. Option C is wrong because sensitivity labels are for classification, not DLP enforcement. Option D is wrong because mail flow rules are separate from DLP.

Answer

Assign a sensitivity label that encrypts the email automatically

Answer

Create a Microsoft Purview Message Encryption policy

Answer

Use Exchange mail flow rules to block unencrypted credit card data

Question 2

Your organization has Microsoft Entra ID (Azure AD) and uses Privileged Identity Management (PIM). You need to ensure that when a user activates a privileged role, they must provide a reason and a ticket number. What should you configure?

Accepted Answer

PIM role settings requiring justification and approval on activation. Option A is correct because PIM role settings allow you to configure activation requirements, including mandatory justification (reason) and ticket number. By editing the role settings in PIM, you can enforce that users provide both a reason and a ticket number when activating a privileged role, ensuring auditability and compliance.

Answer

Conditional Access policy requiring multi-factor authentication

Answer

An access review for the privileged role

Answer

Microsoft Entra Identity Protection user risk policy

Question 3

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. Based on the JSON snippet, what is the most likely outcome when a user with high user risk attempts to sign in?

Accepted Answer

The sign-in is blocked because user risk is high. Option B is correct because the policy blocks sign-ins when user risk level is high. Option A is wrong because sign-in risk is not evaluated (empty array). Option C is wrong because there is no MFA requirement. Option D is wrong because the policy blocks regardless of sign-in risk.

Answer

The sign-in is blocked only if sign-in risk is also high

Answer

The sign-in is allowed because sign-in risk is not high

Answer

The user is prompted for multi-factor authentication

Question 4

Refer to the exhibit. You are analyzing a Microsoft Sentinel analytics rule. What does this rule detect?

Accepted Answer

Brute-force attack against a single account. This rule detects a brute-force attack against a single account by triggering when the number of failed logons for a specific user exceeds a threshold within a given time window, followed by a successful logon. The condition `FailedLogons > 5` and `SuccessfulLogon > 0` for the same account indicates that the attacker has guessed the correct password after multiple failed attempts, which is a classic sign of a successful brute-force attack.

Answer

Multiple successful logons for the same account

Answer

Multiple failed logons from the same source IP address

Answer

Overall number of failed logons across all accounts

Question 5

Refer to the exhibit. You are configuring a Microsoft Purview sensitivity label. When a user applies this label to an email, what happens?

Accepted Answer

The email is encrypted and cannot be forwarded, printed, or copied. Option A is correct because the sensitivity label is configured with encryption that includes the 'Do Not Forward' option. This applies Azure Rights Management (Azure RMS) protection, which encrypts the email and restricts the recipient from forwarding, printing, or copying the content. The label enforces these restrictions at the message level, regardless of the email client used.

Answer

The email is encrypted but can be forwarded

Answer

The email is not encrypted but cannot be forwarded

Answer

The email is encrypted and the recipient cannot reply

Question 6

Your organization uses Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. You need to create a custom detection rule that triggers when a user receives a phishing email and then attempts to log in from a new location. Which approach should you use?

Accepted Answer

Use Advanced Hunting to create a custom detection rule. Option A is correct because Advanced Hunting in Microsoft Defender XDR allows you to write Kusto Query Language (KQL) queries that correlate events across multiple data tables (e.g., EmailEvents, IdentityLogonEvents). You can then create a custom detection rule from that query, which will trigger an alert when a user receives a phishing email and subsequently logs in from a new location, enabling cross-domain correlation within Defender XDR.

Answer

Create a custom detection rule in Microsoft Defender for Endpoint

Answer

Use an automation rule in Microsoft Defender XDR

Answer

Create an analytics rule in Microsoft Sentinel

Question 7

Which TWO actions should you take to implement a zero-trust identity strategy in Microsoft Entra ID?

Accepted Answer

Require multi-factor authentication for all users. A is correct because MFA is a core zero-trust control. D is correct because Conditional Access enforces policies based on signals. B is wrong because passwordless authentication is recommended but not a specific zero-trust action. C is wrong because single sign-on is convenience, not zero-trust. E is wrong because synchronization is for hybrid identity, not zero-trust.

Answer

Enable single sign-on for all applications

Answer

Implement passwordless authentication for all users

Answer

Synchronize all on-premises identities to the cloud

Question 8

Which THREE capabilities does Microsoft Purview provide for compliance management?

Accepted Answer

Information protection with sensitivity labels. Microsoft Purview provides compliance management capabilities including information protection with sensitivity labels, which allow organizations to classify and protect sensitive data across Microsoft 365 services, endpoints, and third-party apps. Sensitivity labels enforce encryption, visual markings, and access restrictions based on policy, directly supporting data loss prevention and governance.

Answer

Identity protection and risk detection

Answer

Endpoint detection and response

Question 9

Which TWO configurations are required to enable Microsoft Defender for Cloud Apps to monitor cloud app usage?

Accepted Answer

Add app connectors for the cloud apps you want to monitor. A is correct because Microsoft Defender for Cloud Apps requires app connectors to establish API-based connections with cloud applications (e.g., Office 365, Salesforce, AWS). These connectors enable the service to ingest activity logs, file metadata, and user sessions for monitoring and threat detection. Without app connectors, Defender for Cloud Apps cannot access the cloud app's data plane to perform its core monitoring functions.

Answer

Configure Microsoft Intune device compliance policies

Answer

Deploy Azure Information Protection scanner

Answer

Synchronize with Microsoft Entra ID

Question 10

Your organization uses Microsoft Sentinel as a SIEM. You need to reduce the cost of data ingestion while ensuring that security-relevant events are retained. You have identified that Windows Event ID 4624 (successful logon) produces a high volume of logs. What should you do?

Accepted Answer

Configure the analytics connector to ingest these events as basic logs. Option D is correct because Microsoft Sentinel supports 'basic logs' ingestion, which is a lower-cost tier designed for high-volume, verbose logs like Windows Event ID 4624. Basic logs are stored in a separate table with a reduced retention period (default 30 days) but still retain security-relevant metadata, enabling cost savings while preserving the ability to query for security incidents. This approach avoids the need to filter or drop events entirely, ensuring compliance with security monitoring requirements.

Answer

Reduce the retention period for all logs to 30 days

Answer

Ingest the events into a separate Log Analytics workspace with a shorter retention

Answer

Filter out Event ID 4624 at the source using Windows Event Forwarding

Question 11

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only devices with a TPM (Trusted Platform Module) version 2.0 can access corporate resources. What should you configure?

Accepted Answer

Create a device compliance policy that requires TPM 2.0 and use Conditional Access to block non-compliant devices. A device compliance policy in Microsoft Intune can check for TPM 2.0 presence and version. When combined with a Conditional Access policy that blocks non-compliant devices, only devices meeting the TPM 2.0 requirement can access corporate resources. This is the correct approach because Conditional Access enforces the compliance check at the authentication and authorization layer.

Answer

Use Windows Update for Business to ensure TPM firmware is updated

Answer

Configure device enrollment restrictions to require TPM 2.0

Answer

Deploy a device configuration profile that enables TPM 2.0

Question 12

Your organization uses Microsoft Defender for Cloud to manage the security posture of Azure resources. You need to receive alerts when a virtual machine is deployed without just-in-time (JIT) access enabled. What should you do?

Accepted Answer

Use the built-in Defender for Cloud recommendation for JIT access. The correct answer is D because Microsoft Defender for Cloud provides a built-in security recommendation specifically for just-in-time (JIT) VM access. This recommendation continuously assesses your VMs and generates an alert when a VM is deployed without JIT enabled, without requiring custom rules or manual configuration. It directly addresses the requirement to receive alerts for non-compliant VMs.

Answer

Create a custom alert rule in Microsoft Sentinel

Answer

Configure JIT access on the VM and monitor via activity logs

Answer

Enable JIT access on all VMs

Question 13

A company uses Microsoft Sentinel for security operations. The security team wants to automatically create an incident in Microsoft Sentinel when Microsoft Defender for Cloud detects a high-severity vulnerability on a virtual machine. What should the security team configure?

Accepted Answer

Create an analytics rule with a rule template that maps to the Defender for Cloud alert.. Option D is correct because Microsoft Sentinel can ingest high-severity vulnerability alerts from Microsoft Defender for Cloud via the SecurityAlert analytics rule template. When you enable this built-in rule template, Sentinel automatically creates an incident for each Defender for Cloud alert that matches the configured severity (e.g., High). This is the native, out-of-the-box method to convert Defender for Cloud alerts into Sentinel incidents without requiring custom logic or external orchestration.

Answer

Create an automation rule in Microsoft Sentinel.

Answer

Create a playbook in Microsoft Sentinel.

Answer

Create a watchlist in Microsoft Sentinel.

Question 14

A global organization uses Microsoft Entra ID with Conditional Access policies. They want to enforce multifactor authentication (MFA) for all users accessing sensitive apps from outside the corporate network, but allow access without MFA from trusted IPs. What should they configure?

Accepted Answer

Create a Conditional Access policy that includes 'All users' and 'All cloud apps', with conditions for locations: include 'All trusted' and exclude 'All trusted'? Wait, correct approach: include 'All locations' and exclude 'Trusted IPs', and require MFA.. Option D is correct because it configures a Conditional Access policy that includes 'All locations' as a condition and excludes 'Trusted IPs' (defined as named locations in Entra ID), then requires MFA as a grant control. This enforces MFA for all access attempts from outside the corporate network while allowing access without MFA from trusted IPs, precisely matching the requirement.

Answer

Create a Conditional Access policy that grants access, requiring MFA for all locations.

Answer

Create a Conditional Access policy that requires MFA for all users and all locations.

Answer

Create a Conditional Access policy that blocks access from all locations except trusted IPs.

Question 15

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. The query returns a list of users and IP addresses with failed sign-ins due to 'User Account Disabled' (ResultType 50057). The analyst wants to create a scheduled analytics rule that generates an incident when a user exceeds 5 such failures from the same IP in an hour. Which setting is missing from the query to meet the requirement?

Accepted Answer

Add a 'bin' or 'bin_at' to group by time windows.. The query currently returns all failed sign-ins due to 'User Account Disabled' but does not aggregate them into time-based windows. To meet the requirement of generating an incident when a user exceeds 5 failures from the same IP in an hour, the query must group the results into 1-hour time buckets using 'bin' or 'bin_at' on the timestamp column, then count the failures per user and IP per bucket, and filter for counts greater than 5. Without this time-windowing, the query cannot enforce the 'in an hour' condition.

Answer

Add a 'let' statement to define the threshold.

Answer

Add a 'project' to select columns.

Answer

Add a 'where' clause to filter by ResultType.