SC-100 Design security operations, identity, and compliance capabilities Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. An administrator runs this Microsoft Graph PowerShell command to retrieve an access review policy. The review is set to run quarterly but no recurrence is shown in the output. The review has not started. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The recurrence property is null, so the review is not scheduled.. The output shows the recurrence property as null, which means the review is not configured with a recurrence schedule. Even though the administrator intended a quarterly review, without a valid recurrence object (including type, durationInDays, and startDate), the review will not be scheduled to run automatically. This is the most direct cause of the missing recurrence in the output.

Answer

The reviewer is a single user, which is not allowed.

Answer

The autoReviewEnabled setting is false, preventing the review from starting.

Answer

The scope query is for groups, but the review should be for users.

Question 2

A company wants to implement a Zero Trust security model. Which TWO principles are fundamental to Zero Trust? (Choose two.)

Accepted Answer

Verify explicitly.. Zero Trust mandates that every access request must be authenticated and authorized based on all available data points, including user identity, location, device health, and data sensitivity, regardless of the network location. This 'verify explicitly' principle eliminates implicit trust and enforces continuous validation for every transaction, aligning with Microsoft's Zero Trust deployment guidance for identity and access management.

Answer

Use perimeter-based security.

Answer

Trust internal network.

Answer

Trust but verify.

Question 3

An organization uses Microsoft Purview to classify and protect sensitive data. Which THREE capabilities can be used to discover sensitive data? (Choose three.)

Accepted Answer

Trainable classifiers. Trainable classifiers use machine learning to identify content based on patterns and context, not just exact matches. They can be trained on sample data to recognize custom sensitive information, such as specific contract clauses or internal project codes, enabling discovery of sensitive data that predefined sensitive information types might miss.

Answer

Data loss prevention policies

Answer

Retention labels

Question 4

A security operations center (SOC) uses Microsoft Sentinel. They want to automate incident response for common alerts. Which THREE components are required to build an automated response? (Choose three.)

Accepted Answer

Connectors. Connectors are required to ingest security events and alerts into Microsoft Sentinel from various data sources (e.g., Microsoft 365 Defender, Azure Active Directory, third-party SIEMs). Without connectors, there would be no alerts to trigger automated responses, making them a foundational component for any automated incident response workflow.

Answer

Workbooks

Answer

Watchlists

Question 5

A company needs to ensure that only authorized users can access sensitive data in Microsoft SharePoint Online. Which TWO controls can be used? (Choose two.)

Accepted Answer

Microsoft Entra ID Governance access reviews. Options C and D are correct. Microsoft Entra ID Governance access reviews periodically review and certify access to ensure only authorized users have access. Conditional Access policies restrict access based on conditions such as location or device compliance. Option A is incorrect because sensitivity labels are for classification and protection, not for controlling access. Option B is incorrect because retention policies are for data retention, not access control. Option E is incorrect because DLP policies prevent data loss, not control access.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Data loss prevention policies

Question 6

An organization uses Microsoft Defender XDR to detect and respond to threats. Which THREE data sources does Defender XDR ingest? (Choose three.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender XDR ingests signals from Microsoft Defender for Identity to correlate on-premises Active Directory activities with cloud-based threats. This integration allows Defender XDR to detect identity-based attacks like Kerberoasting or pass-the-hash by analyzing domain controller logs and authentication events.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 7

A company wants to implement hybrid identity with Microsoft Entra ID. Which TWO components are required for password hash synchronization? (Choose two.)

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the on-premises tool that orchestrates synchronization between Active Directory and Microsoft Entra ID. It is required because password hash synchronization (PHS) is a feature within Entra Connect that reads password hashes from on-premises AD and syncs them to Entra ID, enabling seamless authentication without federated services.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra ID Protection

Answer

Azure AD Application Proxy

Question 8

Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents without human intervention. Which feature should you configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to define automated responses to incidents based on conditions such as severity, without requiring human intervention. When a high-severity incident is created or updated, an automation rule can trigger a playbook (via Azure Logic Apps) to perform actions like blocking an IP, resetting a user password, or creating a support ticket, enabling fully automated incident response.

Answer

Analytics rule

Answer

Workbook

Answer

Watchlist

Question 9

Your organization uses Microsoft Purview and needs to automatically apply a retention label to all documents containing personally identifiable information (PII) in SharePoint Online. What should you configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview can automatically apply retention labels to documents based on sensitive info types (e.g., PII). Option A is correct. Option B is incorrect because data loss prevention (DLP) policies prevent sharing or notify users but do not apply labels. Option C is incorrect because service-side sensitivity labels apply sensitivity labels, not retention labels, and require label inheritance from the site or library. Option D is incorrect because trainable classifiers can be used to identify content for labeling but are not the primary method for automatically applying retention labels; they require custom training and are more suited for classification-based scenarios.

Answer

Data loss prevention (DLP) policy

Answer

Service-side sensitivity label

Answer

Trainable classifier

Question 10

Your organization uses Microsoft Defender for Office 365 and wants to block malicious links in email messages in real time. Which policy should you configure?

Accepted Answer

Safe Links policy. Safe Links policy in Microsoft Defender for Office 365 provides real-time URL scanning and rewriting at the time of click, enabling the blocking of malicious links in email messages. This policy wraps URLs to route clicks through Microsoft's threat intelligence service, which checks the link against current threat data and blocks access if malicious content is detected.

Answer

Anti-phishing policy

Answer

Safe Attachments policy

Answer

Anti-spam policy

Question 11

Refer to the exhibit. You create this conditional access policy in Microsoft Entra ID. What is the result?

Accepted Answer

Blocks sign-ins from medium and high risk users for all applications. The conditional access policy shown assigns the 'Block access' control to the 'Medium and High' risk levels for 'All cloud apps'. This means any sign-in from a user or session detected as medium or high risk will be blocked, regardless of the application. Option B correctly identifies this outcome.

Answer

Requires MFA for medium and high risk users for all applications

Answer

Blocks sign-ins from low risk users for all applications

Answer

Blocks sign-ins from medium and high risk users only for selected applications

Question 12

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the primary purpose?

Accepted Answer

Detect entities that have been repeatedly targeted by high-severity alerts. The KQL query uses `make_set` to aggregate distinct high-severity alert names per entity and filters for entities with more than 5 distinct alert types. This identifies entities that have been targeted by a high variety of high-severity alerts, indicating repeated or broad attack activity.

Answer

Correlate alerts across different data sources

Answer

Identify new high-severity alerts in the last 7 days

Answer

Find entities with fewer than 5 high-severity alerts

Question 13

Which THREE of the following are capabilities of Microsoft Purview Information Protection?

Accepted Answer

Classifying data using trainable classifiers. Microsoft Purview Information Protection includes trainable classifiers that use machine learning to intelligently identify sensitive content based on patterns and context, not just keywords. These classifiers can be trained with sample data to improve accuracy, enabling automated classification of documents and emails without requiring manual rule creation.

Answer

Preventing data loss via DLP policies

Answer

Detecting risky user activities with Insider Risk Management

Question 14

Which TWO of the following are components of Microsoft Defender XDR (Extended Detection and Response)?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR (Extended Detection and Response) is a unified security operations platform that natively integrates signals from Microsoft Defender for Endpoint (endpoint detection and response) and Microsoft Defender for Office 365 (email and collaboration security). These two components provide the core telemetry for cross-domain threat correlation and automated response within the Defender XDR portal.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 15

Refer to the exhibit. You are reviewing a Conditional Access policy JSON in Microsoft Entra ID. The policy is not blocking any sign-ins even though there are high-risk users. What is the most likely reason?

Accepted Answer

The policy does not include any users or groups in the conditions.. The Conditional Access policy JSON shows that the 'conditions' object does not include a 'users' property. Without any users or groups assigned, the policy is not evaluated against any sign-in attempts, so it never applies—even if high-risk users exist. In Microsoft Entra ID, a policy must have at least one user or group specified in the conditions to be enforced.

Answer

The signInRiskLevels condition is empty, so no sign-ins match.

Answer

The policy only applies to specific applications, but the exhibit shows 'All'.

Answer

The grant controls operator should be 'AND' instead of 'OR'.