SC-100 Design security operations, identity, and compliance capabilities Practice Test 5 — 15 Questions

Question 1

Your organization wants to enforce that all users authenticate using Microsoft Authenticator app for Microsoft Entra ID. Which authentication method should you configure as the primary?

Accepted Answer

Microsoft Authenticator passwordless phone sign-in. The question requires that all users authenticate using the Microsoft Authenticator app. The Microsoft Authenticator passwordless phone sign-in (option C) is the only method that both uses the Microsoft Authenticator app and provides a passwordless primary authentication experience. This method leverages FIDO2-based key attestation within the app, allowing users to sign in with a biometric or PIN gesture without entering a password.

Answer

FIDO2 security keys

Answer

Email one-time passcode

Answer

SMS-based verification

Question 2

A company uses Microsoft Intune to manage devices. They need to ensure that only devices with a minimum OS version can access corporate email. Which policy type should they implement?

Accepted Answer

Compliance policies combined with conditional access. Compliance policies define required conditions like minimum OS version, and conditional access enforces those conditions by blocking or allowing access to corporate email. Option A is wrong because device enrollment restrictions control which devices can enroll in Intune, not post-enrollment access. Option B is wrong because app protection policies manage data protection within apps, not device-level OS version requirements. Option D is wrong because device configuration profiles manage device settings (e.g., Wi-Fi, VPN), not access enforcement.

Answer

Device enrollment restrictions

Answer

App protection policies

Answer

Device configuration profiles

Question 3

Your organization uses Microsoft Entra ID with external identities. You need to design a solution that allows partners to self-service sign up using their existing Azure AD or Microsoft account credentials, while preventing them from accessing other resources. What should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration, is correct because it allows partners to self-service sign up using their existing Azure AD or Microsoft account credentials. You can then apply conditional access policies to restrict their access to only the necessary resources. Option A (Microsoft Entra B2C) is designed for customer-facing applications and does not support external business partner scenarios. Option B (Microsoft Entra Identity Protection) is a risk detection service, not an identity provisioning solution. Option D (Direct federation) requires pre-existing federation relationships and does not provide self-service sign-up.

Answer

Microsoft Entra B2C

Answer

Microsoft Entra Identity Protection

Answer

Direct federation with partner's IdP

Question 4

Your organization is implementing Microsoft Defender for Office 365 to protect against phishing attacks. Which TWO features can be used to simulate phishing attacks and train users?

Accepted Answer

Campaign simulations. A is correct because Campaign simulations is a feature within Microsoft Defender for Office 365 that allows security administrators to create and send realistic phishing emails to users to test their awareness. It is part of the Attack Simulation Training (formerly Office 365 Attack Simulator) and helps identify vulnerable users before a real attack occurs.

Answer

Safe Attachments

Answer

Safe Links

Answer

Anti-phish policies

Question 5

Your organization uses Microsoft Sentinel and wants to improve threat hunting efficiency. Which THREE actions should you take?

Accepted Answer

Enable UEBA (User and Entity Behavior Analytics). UEBA (User and Entity Behavior Analytics) in Microsoft Sentinel uses machine learning models to establish baseline behavioral patterns for users, hosts, and other entities. It then detects anomalous activities such as unusual logon times, impossible travel, or abnormal data exfiltration, which directly enhances threat hunting by surfacing suspicious behaviors that might otherwise go unnoticed.

Answer

Use watchlists to filter out known benign IPs

Answer

Reduce data retention period to improve query speed

Question 6

The exhibit shows a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Identify the most frequent high-severity alerts over the past week. The query uses `summarize` with `count()` and `top 5 by count_ desc` to rank alert names by frequency, filtered to `AlertSeverity == 'High'` and `TimeGenerated > ago(7d)`. This directly identifies the most common high-severity alerts over the past week, making option C correct.

Answer

Find alerts that were not investigated

Answer

Analyze entities associated with alerts

Answer

Correlate alerts by time and alert name

Question 7

The exhibit shows a conditional access policy in Microsoft Entra ID. What will be the effect of this policy?

Accepted Answer

Block all applications except Office365. The exhibit shows a Conditional Access policy that includes 'All cloud apps' in the target resources and is configured with a 'Block access' grant control. The 'Exclude' list contains 'Office365', meaning the policy applies to all applications except Office365. Therefore, the effect is to block access to all applications except Office365, making option D correct.

Answer

Allow all applications except Office365

Answer

Block all applications including Office365

Answer

Allow all applications including Office365

Question 8

The exhibit shows a conditional access policy from Microsoft Entra ID Identity Protection. When will this policy require MFA?

Accepted Answer

When user risk is medium or high AND sign-in risk is high. The conditional access policy shown in the exhibit uses the 'Require MFA' grant control with conditions set for user risk (medium or high) AND sign-in risk (high). In Microsoft Entra ID Identity Protection, when both risk levels are evaluated together with an AND operator, MFA is only triggered when both conditions are met simultaneously. This ensures that MFA is enforced only when the user account itself is compromised (medium/high user risk) and the current sign-in session is also risky (high sign-in risk), providing a layered security response.

Answer

When either user risk is medium or sign-in risk is high

Answer

When user risk is medium or high, regardless of sign-in risk

Answer

When sign-in risk is high, regardless of user risk

Question 9

A company uses Microsoft Sentinel for security operations. The SOC team needs to automatically respond to a specific type of incident involving a known malicious IP address. They want to create an automated response that blocks the IP at the firewall and creates a Teams notification. Which feature should they use?

Accepted Answer

Automation rule with a playbook. Automation rules in Microsoft Sentinel allow you to trigger automated responses when incidents are created or updated. By associating a playbook (an Azure Logic Apps workflow) with the automation rule, you can execute actions such as blocking an IP at a firewall via a connector and posting a Teams notification. This directly meets the requirement for a two-step automated response triggered by a specific incident type.

Answer

UEBA to detect anomalous behavior

Answer

Watchlist to correlate IP addresses

Answer

Analytics rule with scheduled query

Question 10

A company uses Microsoft Defender XDR and wants to ensure that all devices are reporting to the service. They notice that some devices are not appearing in the device inventory. Which log source should they check first to troubleshoot?

Accepted Answer

Microsoft Defender for Endpoint deployment log (MDEClientAnalyzer). The MDEClientAnalyzer tool generates a detailed deployment log that specifically captures the onboarding and communication status between the device and the Microsoft Defender for Endpoint (MDE) cloud service. When devices are missing from the device inventory, this log is the first place to check because it reveals whether the sensor is installed, registered, and successfully sending telemetry. Other logs, like Intune enrollment or Windows Defender operational logs, do not directly track MDE sensor connectivity or onboarding failures.

Answer

Microsoft Intune enrollment logs

Answer

Windows Event Log - Microsoft-Windows-Windows Defender/Operational

Answer

Syslog from the device

Question 11

An organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from pasting sensitive data into AI-powered tools like Microsoft Copilot. Which DLP rule condition should they configure?

Accepted Answer

Cloud app includes Microsoft Copilot. To prevent users from pasting sensitive data into AI-powered tools like Microsoft Copilot, you need to configure a DLP rule condition that targets the specific application. The 'Cloud app includes Microsoft Copilot' condition allows the DLP policy to inspect and block sensitive content when it is being pasted into Copilot, as Copilot is a cloud app that can be monitored via Microsoft Purview's endpoint DLP and cloud app discovery capabilities.

Answer

Content is shared with external users

Answer

Access from unmanaged devices

Answer

File extension is .docx or .pdf

Question 12

A company uses Microsoft Sentinel and wants to use a built-in connector to ingest logs from Amazon Web Services (AWS). Which connector should they use?

Accepted Answer

Amazon Web Services S3 connector. The Amazon Web Services (AWS) S3 connector is the correct built-in connector in Microsoft Sentinel for ingesting logs from AWS. It works by configuring AWS to send logs (such as CloudTrail, VPC Flow Logs, or GuardDuty findings) to an S3 bucket, which Sentinel then polls via the S3 REST API using an IAM role for secure, cross-account access. This is the native, supported method for log ingestion from AWS into Sentinel.

Answer

ServiceNow connector

Answer

Azure Policy for AWS

Answer

Office 365 connector

Question 13

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Identify accounts that have experienced more than 10 failed login attempts from the same IP address within an hour. The KQL query uses the `summarize` operator to count failed logon events (EventID 4625) grouped by account and IP address, then filters for counts greater than 10 within a 1-hour time window. This directly identifies accounts that have experienced more than 10 failed login attempts from the same IP address within an hour, which is a classic indicator of a brute-force attack targeting a specific account.

Answer

Identify IP addresses that have successfully brute-forced an account

Answer

Identify users who have logged in from multiple IPs in a short time

Answer

Identify accounts that have been disabled due to multiple failures

Question 14

A company uses Microsoft Defender for Identity (MDI) to monitor on-premises Active Directory. They want to integrate MDI alerts into Microsoft Sentinel. Which data connector should they use?

Accepted Answer

Microsoft Defender for Identity connector. The Microsoft Defender for Identity connector ingests MDI alerts into Sentinel. Option A is incorrect because Syslog is for non-Microsoft devices or syslog-based logs, not MDI alerts. Option B is incorrect because Azure AD connector is for cloud identity logs. Option D is incorrect because Windows Security Events via AMA ingests raw security events, not MDI alerts.

Answer

Syslog connector

Answer

Azure Active Directory connector

Answer

Windows Security Events via AMA

Question 15

A company uses Microsoft Purview to classify and label sensitive data. They want to automatically apply a sensitivity label to documents containing a specific custom sensitive information type. Which TWO components are required for this?

Accepted Answer

Custom sensitive information type. A custom sensitive information type defines the specific data pattern (e.g., a proprietary employee ID format) that Microsoft Purview can detect in documents. Option D is correct because an auto-labeling policy uses that custom sensitive information type as a condition to automatically apply a sensitivity label to matching content, without requiring user intervention.

Answer

Data loss prevention (DLP) policy

Answer

Retention label

Answer

Trainable classifier