SC-100 Design security operations, identity, and compliance capabilities Practice Test 4 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You need to create an analytics rule in Sentinel that triggers an incident when a device is reported as 'high risk' by MDE. Which data source and rule type should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender XDR connector with a Scheduled query rule. The Microsoft Defender XDR connector ingests alerts from Microsoft Defender for Endpoint (MDE) into Sentinel. A Scheduled query rule is required to run a KQL query at a defined interval (e.g., every 5 minutes) that checks for devices with a 'high risk' severity level in the ingested alert data. This combination allows you to create an incident when MDE reports a device as high risk.

Answer

Microsoft Sentinel's Anomalous Activity rule

Answer

Microsoft 365 Defender connector with an NRT query rule

Answer

Microsoft Defender for Cloud connector with a Fusion rule

Question 2

Your company needs to automatically classify and label sensitive documents in Microsoft 365 based on their content. Which Microsoft Purview solution should you implement?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) enables automatic classification and labeling of sensitive documents based on content, using trainable classifiers, exact data match (EDM), and sensitive information types. This solution applies sensitivity labels to documents in Microsoft 365 (e.g., SharePoint, Exchange, OneDrive) via client-side labeling or auto-labeling policies, meeting the requirement to classify and label by content.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Insider Risk Management

Question 3

Refer to the exhibit. You are troubleshooting a KQL query in Microsoft Sentinel that is supposed to return alerts for ransomware detections in the last day. The query returns no results, but you know there were ransomware alerts. What is the most likely cause?

Accepted Answer

The AlertName filter is too specific and does not match the actual alert name.. The query's `AlertName` filter is likely too specific (e.g., using a hardcoded string like 'RansomwareAlert') and does not match the actual alert name generated by Microsoft Sentinel's analytics rules. Ransomware alerts often have dynamic naming conventions that include variant names or suffixes, so an exact match filter fails to return results even though alerts exist. The query otherwise appears syntactically correct, and the `TimeGenerated` filter is set to the last day, which aligns with the known presence of alerts.

Answer

The ThreatFamily field is an integer, not a string.

Answer

The TimeGenerated filter uses the wrong time range.

Answer

The parse_json function is failing due to malformed JSON.

Question 4

Your organization uses Microsoft Entra ID and plans to implement a Zero Trust architecture. You need to ensure that all access requests to internal applications are verified continuously, not just at the initial sign-in. What should you configure?

Accepted Answer

Continuous Access Evaluation (CAE). Continuous Access Evaluation (CAE) is the correct choice because it enables real-time token validation and policy enforcement for critical events (e.g., user risk elevation, device compliance change, or IP address change) without requiring a new authentication request. This aligns with the Zero Trust principle of 'verify explicitly and continuously' by revoking access mid-session when conditions change, rather than only at initial sign-in.

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access policies with session controls

Question 5

You need to audit user activities in Microsoft 365, including who accessed a specific file in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) is the correct solution because it captures and logs user activities across Microsoft 365 services, including SharePoint Online. When a user accesses a specific file, the audit log records the event with details such as the user, file name, action (e.g., FileAccessed), and timestamp, enabling you to query this data via the Microsoft 365 Defender portal or Search-UnifiedAuditLog cmdlet.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Question 6

Which TWO actions should you take to meet a compliance requirement that all emails containing credit card numbers must be encrypted before delivery?

Accepted Answer

Create a Microsoft Purview Data Loss Prevention (DLP) policy that detects credit card numbers and applies encryption.. A Microsoft Purview Data Loss Prevention (DLP) policy can detect sensitive data types like credit card numbers and automatically apply encryption via Information Rights Management (IRM) as an action. This ensures that any email containing credit card data is encrypted before delivery, meeting the compliance requirement directly through policy enforcement.

Answer

Create a sensitivity label with encryption and apply it via auto-labeling.

Answer

Enable Microsoft Purview Information Protection auto-labeling for credit card data.

Answer

Create a mail flow rule in Exchange Online to encrypt emails with credit card numbers.

Question 7

Which TWO components are required to enable Microsoft Sentinel to ingest data from Amazon Web Services (AWS) CloudTrail?

Accepted Answer

An AWS S3 bucket to store CloudTrail logs.. AWS CloudTrail logs must be delivered to an S3 bucket as a prerequisite for ingestion into Microsoft Sentinel. Sentinel's AWS CloudTrail data connector reads log files directly from the S3 bucket using the S3 REST API, making the bucket the required storage and access point for the logs.

Answer

An Azure Function to pull logs from AWS.

Answer

An AWS Lambda function to process logs.

Answer

An Azure Event Hubs namespace to receive logs.

Question 8

Which THREE conditions can trigger a Microsoft Entra ID Protection user risk policy to require a password change?

Accepted Answer

Leaked credentials detected on the dark web.. Microsoft Entra ID Protection's user risk policy can be triggered by leaked credentials detected on the dark web. When Microsoft's threat intelligence services find a user's credentials exposed in a known data breach, the user's risk level is elevated, and the policy can be configured to require a password change as a remediation action to mitigate the compromised account.

Answer

User has not registered for multi-factor authentication.

Answer

Device is marked as non-compliant by Intune.

Question 9

Refer to the exhibit. You run the PowerShell command in Microsoft Entra ID to find compliance roles. You need to assign the Compliance Administrator role to a user. What is the correct parameter to use in the Add-AzureADMSRoleAssignment cmdlet?

Accepted Answer

-RoleDefinitionId "173a97e2-97f2-4c7a-8e7c-7e2f1c1e2f1c". The `Add-AzureADMSRoleAssignment` cmdlet requires the `-RoleDefinitionId` parameter to specify the role by its unique identifier (GUID). The exhibit shows that the Compliance Administrator role has the ObjectId `173a97e2-97f2-4c7a-8e7c-7e2f1c1e2f1c`, which is the role's definition ID, not a user or group object ID. Therefore, option D correctly uses `-RoleDefinitionId` with that GUID.

Answer

-ObjectId "173a97e2-97f2-4c7a-8e7c-7e2f1c1e2f1c"

Answer

-RoleName "Compliance Administrator"

Answer

-RoleId "173a97e2-97f2-4c7a-8e7c-7e2f1c1e2f1c"

Question 10

Refer to the exhibit. You are deploying this Bicep template to enable Microsoft Defender for Cloud's VM protection. After deployment, you notice that Agentless VM scanning is not enabled for existing VMs. What is the most likely reason?

Accepted Answer

The extension 'AgentlessVmScanning' must be defined outside the pricing resource.. The 'AgentlessVmScanning' extension is not a valid sub-resource of the pricing resource. In Bicep, agentless VM scanning is configured via a separate 'Microsoft.Security/vmScanners' resource, not nested inside the pricing resource. Defining it inside the pricing resource would cause a configuration error, resulting in agentless scanning not being enabled. Option B is incorrect: agentless scanning is automatically enabled for all existing and new VMs when the plan is enabled; existing VMs do not require manual rescanning.

Answer

The pricing tier must be 'Free' to enable agentless scanning.

Answer

Agentless scanning is only enabled for new VMs; existing VMs require rescanning.

Answer

The resource name 'VirtualMachines' is incorrect; it should be 'virtualMachines'.

Question 11

Your organization uses Microsoft Sentinel for security operations. You need to ensure that all incident investigations are automatically captured for compliance reporting. Which feature should you enable?

Accepted Answer

Enable Microsoft Sentinel audit logging. Microsoft Sentinel audit logging captures all actions performed within the Sentinel environment, including incident investigations, queries run, and configuration changes. Enabling this feature ensures that every investigation step is logged and can be used for compliance reporting, as it records user activities and system events in the Azure Activity Log or Log Analytics workspace.

Answer

Use Microsoft Purview Compliance Manager

Answer

Configure Azure Policy for Sentinel

Answer

Enable Microsoft Defender for Cloud Apps

Question 12

A company is implementing a zero-trust security model. They need to enforce conditional access policies that require device compliance from Microsoft Intune. However, some users report being blocked when using personal devices that are not enrolled. What is the best approach to allow access while maintaining security?

Accepted Answer

Require app protection policies via Microsoft Intune. Microsoft Intune app protection policies (APP) can enforce data protection and access controls on personal devices without requiring full enrollment. This allows the company to maintain a zero-trust posture by applying conditional access policies that check for app-level compliance, such as requiring a managed browser or blocking copy/paste, while still permitting access from unenrolled personal devices. This approach aligns with the zero-trust principle of 'never trust, always verify' by verifying device health at the application layer rather than the device layer.

Answer

Allow all devices but monitor with Defender for Cloud Apps

Answer

Block all non-compliant devices

Answer

Require device enrollment for all devices

Question 13

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM). You need to design a role activation policy that requires approval from a security group for global administrator roles, but allows self-activation for other roles. What is the correct configuration?

Accepted Answer

Configure separate PIM settings per role: Global Administrator requires approval, others self-activate. Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure role-specific activation settings. By creating separate PIM policies per role, you can require approval for the Global Administrator role while allowing self-activation for other roles. This granular control ensures that high-privilege roles have additional oversight, while lower-privilege roles remain agile.

Answer

Create a single PIM policy for all roles with approver group

Answer

Enable just-in-time access in Azure AD Identity Protection

Answer

Use Azure AD entitlement management with access packages

Question 14

Your organization needs to monitor and respond to threats across email, endpoints, and identities. Which Microsoft solution provides a unified incident response experience?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified incident response experience by correlating alerts and signals from email (Defender for Office 365), endpoints (Defender for Endpoint), and identities (Defender for Identity) into a single incident queue. This cross-domain correlation enables security teams to investigate and remediate complex multi-stage attacks from a single pane of glass, rather than switching between separate consoles.

Answer

Microsoft Purview

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 15

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to design a solution that automatically creates an incident in Sentinel when a high-severity alert is generated in Defender for Cloud. What should you configure?

Accepted Answer

Enable the Microsoft Defender for Cloud data connector and create an analytics rule. The Microsoft Defender for Cloud data connector ingests security alerts from Defender for Cloud into Microsoft Sentinel. Once ingested, you create an analytics rule with a rule query that triggers on high-severity alerts and configures the rule to automatically create an incident. This is the standard method to convert a Defender for Cloud alert into a Sentinel incident without manual intervention.

Answer

Create a workbook to track alerts

Answer

Create a playbook in Microsoft Sentinel

Answer

Use a watchlist to import alerts