SC-100 Design security operations, identity, and compliance capabilities Practice Test 4 — 15 Questions

Question 1

A company uses Microsoft Purview to enforce Data Loss Prevention (DLP) policies. They want to prevent users from sharing credit card numbers via email. Which action should they configure in the DLP policy?

Accepted Answer

Block with override.. Option B is correct because configuring 'Block with override' allows the DLP policy to block the email containing credit card numbers while permitting users to override the block with a business justification. This balances security with operational flexibility, ensuring sensitive data is not shared without authorization while avoiding unnecessary disruption.

Answer

Audit only.

Answer

Notify only.

Answer

Block.

Question 2

An organization uses Microsoft Intune to manage devices. They need to ensure that only devices compliant with security baselines can access corporate email via Microsoft Outlook. The solution should use existing Microsoft 365 security features. What should they implement?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device.. Option B is correct because Conditional Access policies in Microsoft Entra ID evaluate device compliance status before granting access to cloud apps like Exchange Online. By requiring a compliant device, the policy enforces that only devices meeting security baselines can access corporate email via Outlook, leveraging existing Microsoft 365 identity and access management capabilities.

Answer

Configure an app protection policy in Microsoft Intune.

Answer

Create a device compliance policy in Microsoft Intune.

Answer

Configure a device configuration profile in Microsoft Intune.

Question 3

Refer to the exhibit. An organization uses Microsoft Entra ID Governance. This access review policy is intended to review guest users created after January 1, 2025. The reviewers are users with job title 'Manager'. However, the review is not starting automatically. What is the most likely cause?

Accepted Answer

The recurrence is not configured.. Option C is correct because the scope query filters guests by creation date, but the review is not starting automatically because there is no recurrence defined. The policy snippet does not include recurrence settings; access reviews need a recurrence to start. Option A is wrong because the query is valid. Option B is wrong because autoReviewEnabled is false but that affects decision application, not starting. Option D is wrong because the reviewer query is valid.

Answer

The reviewer query returns no users.

Answer

The autoReviewEnabled setting is false.

Answer

The scope query syntax is incorrect.

Question 4

A company wants to monitor and respond to threats across their entire digital estate, including on-premises servers, cloud workloads, and identities. Which Microsoft solution should they use as a central security information and event management (SIEM) and extended detection and response (XDR) platform?

Accepted Answer

Microsoft Sentinel and Microsoft Defender XDR. Option D is correct because Microsoft Sentinel is the SIEM and SOAR solution, while Microsoft Defender XDR provides XDR capabilities. The question asks for a central SIEM and XDR platform; Microsoft Sentinel integrates with Defender XDR. Option A is wrong because Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection (CWP) tool, not a SIEM. Option B is wrong because Microsoft Intune is for device management. Option C is wrong because Microsoft Purview is for data governance and compliance.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud

Answer

Microsoft Purview

Question 5

A company uses Microsoft Defender for Cloud Apps to discover and control cloud apps. They want to receive alerts when a user accesses a sanctioned app from an unusual location. Which feature should they configure?

Accepted Answer

Anomaly detection policies. Option C is correct because anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify behavioral deviations, such as a user accessing a sanctioned app from an unusual geographic location. These policies leverage machine learning to establish a baseline of normal user activity and trigger alerts when access patterns deviate from that baseline, enabling detection of potential account compromise or insider threats.

Answer

Session policies

Answer

File policies

Answer

App discovery policies

Question 6

Refer to the exhibit. An administrator runs this Microsoft Graph PowerShell command to retrieve an access review policy. The review is set to run quarterly but no recurrence is shown in the output. The review has not started. What is the most likely cause?

Accepted Answer

The recurrence property is null, so the review is not scheduled.. The output shows the recurrence property as null, which means the review is not configured with a recurrence schedule. Even though the administrator intended a quarterly review, without a valid recurrence object (including type, durationInDays, and startDate), the review will not be scheduled to run automatically. This is the most direct cause of the missing recurrence in the output.

Answer

The reviewer is a single user, which is not allowed.

Answer

The autoReviewEnabled setting is false, preventing the review from starting.

Answer

The scope query is for groups, but the review should be for users.

Question 7

A company wants to implement a Zero Trust security model. Which TWO principles are fundamental to Zero Trust? (Choose two.)

Accepted Answer

Verify explicitly.. Option A is correct because Zero Trust mandates that every access request must be authenticated and authorized based on all available data points, including user identity, location, device health, and data sensitivity, regardless of the network location. This 'verify explicitly' principle eliminates implicit trust and enforces continuous validation for every transaction, aligning with Microsoft's Zero Trust deployment guidance for identity and access management.

Answer

Use perimeter-based security.

Answer

Trust internal network.

Answer

Trust but verify.

Question 8

An organization uses Microsoft Purview to classify and protect sensitive data. Which THREE capabilities can be used to discover sensitive data? (Choose three.)

Accepted Answer

Trainable classifiers. Trainable classifiers use machine learning to identify content based on patterns and context, not just exact matches. They can be trained on sample data to recognize custom sensitive information, such as specific contract clauses or internal project codes, enabling discovery of sensitive data that predefined sensitive information types might miss.

Answer

Data loss prevention policies

Answer

Retention labels

Question 9

A security operations center (SOC) uses Microsoft Sentinel. They want to automate incident response for common alerts. Which THREE components are required to build an automated response? (Choose three.)

Accepted Answer

Connectors. Connectors are required to ingest security events and alerts into Microsoft Sentinel from various data sources (e.g., Microsoft 365 Defender, Azure Active Directory, third-party SIEMs). Without connectors, there would be no alerts to trigger automated responses, making them a foundational component for any automated incident response workflow.

Answer

Workbooks

Answer

Watchlists

Question 10

A company needs to ensure that only authorized users can access sensitive data in Microsoft SharePoint Online. Which TWO controls can be used? (Choose two.)

Accepted Answer

Microsoft Entra ID Governance access reviews. Options A and C are correct: Conditional Access policies restrict access based on conditions, and Microsoft Entra ID governance (access reviews) ensures authorized access. Option B is wrong because sensitivity labels are for classification and protection, not access control. Option D is wrong because retention policies are for data retention, not access. Option E is wrong because DLP policies prevent data loss, not control access.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Data loss prevention policies

Question 11

An organization uses Microsoft Defender XDR to detect and respond to threats. Which THREE data sources does Defender XDR ingest? (Choose three.)

Accepted Answer

Microsoft Defender for Identity. Microsoft Defender XDR ingests signals from Microsoft Defender for Identity to correlate on-premises Active Directory activities with cloud-based threats. This integration allows Defender XDR to detect identity-based attacks like Kerberoasting or pass-the-hash by analyzing domain controller logs and authentication events.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 12

A company wants to implement hybrid identity with Microsoft Entra ID. Which TWO components are required for password hash synchronization? (Choose two.)

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the on-premises tool that orchestrates synchronization between Active Directory and Microsoft Entra ID. It is required because password hash synchronization (PHS) is a feature within Entra Connect that reads password hashes from on-premises AD and syncs them to Entra ID, enabling seamless authentication without federated services.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra ID Protection

Answer

Azure AD Application Proxy

Question 13

Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents without human intervention. Which feature should you configure?

Accepted Answer

Automation rule. Automation rules in Microsoft Sentinel allow you to automatically respond to incidents based on criteria such as severity. Option C is correct because automation rules can trigger playbooks. Option A is wrong because analytics rules create alerts, not automated responses. Option B is wrong because workbooks are for visualization. Option D is wrong because watchlists are for correlation.

Answer

Analytics rule

Answer

Workbook

Answer

Watchlist

Question 14

Your company uses Microsoft Defender for Cloud Apps and wants to prevent users from uploading sensitive files to personal cloud storage apps. What should you configure?

Accepted Answer

Session policy. Session policy in Microsoft Defender for Cloud Apps allows real-time monitoring and control of user activities based on app and content inspection. By configuring a session policy, you can block or restrict uploads of sensitive files to personal cloud storage apps like Dropbox or Google Drive during the user's session, leveraging reverse proxy capabilities to inspect and intervene in traffic.

Answer

Activity policy

Answer

App connector

Answer

File policy

Question 15

Your organization uses Microsoft Purview and needs to automatically apply a retention label to all documents containing personally identifiable information (PII) in SharePoint Online. What should you configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview can automatically apply sensitivity labels or retention labels based on sensitive info types. Option C is correct. Option A is wrong because data loss prevention (DLP) policies prevent sharing, they do not apply labels. Option B is wrong because trainable classifiers require custom training. Option D is wrong because service-side sensitivity labels apply labels based on the label of the parent site or document library.

Answer

Data loss prevention (DLP) policy

Answer

Service-side sensitivity label

Answer

Trainable classifier