SC-100 Design security operations, identity, and compliance capabilities Practice Test 5 — 15 Questions

Question 1

You need to design a solution to synchronize on-premises Active Directory users to Microsoft Entra ID for hybrid identity. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID for hybrid identity because it provides a comprehensive, full-featured synchronization engine that supports password hash synchronization, pass-through authentication, and federation integration. It is the primary tool for hybrid identity scenarios where you need to synchronize a single on-premises AD forest to a single Entra ID tenant, handling attributes, password writeback, and device synchronization.

Answer

Microsoft Identity Manager (MIM)

Answer

Microsoft Entra Connect Cloud Sync

Answer

Active Directory Federation Services (AD FS)

Question 2

Your organization uses Microsoft Sentinel and wants to correlate security events from multiple sources to detect multi-stage attacks. What should you create?

Accepted Answer

Fusion rule. Fusion rules in Microsoft Sentinel are specifically designed to correlate security events from multiple sources and detect multi-stage attacks by combining alerts from different detection technologies into a single incident. This matches the requirement to correlate events across sources for complex attack chains, unlike other rule types that focus on single-source or single-event detection.

Answer

Scheduled query rule

Answer

NRT rule

Answer

Anomaly rule

Question 3

Your organization uses Microsoft Intune to manage devices and wants to ensure that only compliant devices can access corporate email. Which conditional access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. Option A is correct because the 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) can access corporate email. This setting checks the device's compliance status reported by Intune to Azure AD during authentication, blocking non-compliant devices before they reach Exchange Online.

Answer

Require approved client app

Answer

Require Multi-Factor Authentication

Answer

Require domain join

Question 4

Your organization uses Microsoft Defender for Office 365 and wants to block malicious links in email messages in real time. Which policy should you configure?

Accepted Answer

Safe Links policy. Safe Links policy in Microsoft Defender for Office 365 provides real-time URL scanning and rewriting at the time of click, enabling the blocking of malicious links in email messages. This policy wraps URLs to route clicks through Microsoft's threat intelligence service, which checks the link against current threat data and blocks access if malicious content is detected.

Answer

Anti-phishing policy

Answer

Safe Attachments policy

Answer

Anti-spam policy

Question 5

Your organization uses Microsoft Purview and needs to prevent users from copying sensitive data to USB drives. Which solution should you implement?

Accepted Answer

Endpoint data loss prevention (DLP). Endpoint DLP is the correct solution because it extends data loss prevention policies to endpoints, enabling the detection and blocking of sensitive data being copied to removable USB drives. Unlike other controls, Endpoint DLP can monitor and restrict data exfiltration actions at the device level, such as copying files to USB media, based on the content's sensitivity classification.

Answer

Sensitivity labels with encryption

Answer

Insider Risk Management

Answer

Communication Compliance

Question 6

Your organization uses Microsoft Sentinel and wants to reduce alert fatigue by grouping related alerts into incidents. Which configuration should you use?

Accepted Answer

Configure incident creation in the analytics rule properties. Option A is correct because in Microsoft Sentinel, incident creation is configured directly within the analytics rule properties. When you create or edit a scheduled or Microsoft Security analytics rule, the 'Incident settings' tab allows you to enable incident creation and define how alerts are grouped into incidents. This is the native mechanism for reducing alert fatigue by automatically grouping related alerts into a single incident based on criteria such as entity matching or time window.

Answer

Use a workbook to aggregate alerts

Answer

Use a playbook to create incidents

Answer

Create an automation rule to group alerts

Question 7

Refer to the exhibit. You create this conditional access policy in Microsoft Entra ID. What is the result?

Accepted Answer

Blocks sign-ins from medium and high risk users for all applications. The conditional access policy shown assigns the 'Block access' control to the 'Medium and High' risk levels for 'All cloud apps'. This means any sign-in from a user or session detected as medium or high risk will be blocked, regardless of the application. Option B correctly identifies this outcome.

Answer

Requires MFA for medium and high risk users for all applications

Answer

Blocks sign-ins from low risk users for all applications

Answer

Blocks sign-ins from medium and high risk users only for selected applications

Question 8

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the primary purpose?

Accepted Answer

Detect entities that have been repeatedly targeted by high-severity alerts. The KQL query uses the `make_set` function to aggregate distinct alert names per entity (e.g., host or user) and then filters for entities that have been hit by more than 5 distinct high-severity alerts. This directly identifies entities repeatedly targeted by high-severity alerts, which is the primary purpose.

Answer

Correlate alerts across different data sources

Answer

Identify new high-severity alerts in the last 7 days

Answer

Find entities with fewer than 5 high-severity alerts

Question 9

Refer to the exhibit. You configure this mail flow rule in Exchange Online. What happens to emails with 'FREE' in the subject?

Accepted Answer

Emails are moved to the Junk Email folder. The mail flow rule is configured to add the header 'X-CustomHeader' with the value 'Free' to emails that have 'FREE' in the subject. However, the rule also has the action 'Increase the spam confidence level (SCL) to 9', which causes Exchange Online to treat the message as high-confidence spam. When the SCL is set to 9, Exchange Online automatically moves the email to the Junk Email folder for the recipient, unless a transport rule or mailbox setting overrides this behavior. Therefore, the emails are not deleted, blocked, or simply have a header added; they are moved to the Junk Email folder due to the SCL increase.

Answer

Emails are deleted

Answer

Emails have a custom header added

Answer

Emails are blocked and not delivered

Question 10

Which TWO of the following are valid methods to protect privileged accounts in Microsoft Entra ID?

Accepted Answer

Configure Conditional Access policies for privileged roles. Conditional Access policies can be configured to require stronger authentication, device compliance, or location-based controls specifically for users assigned to privileged roles (e.g., Global Administrator, Privileged Role Administrator). This directly protects privileged accounts by enforcing additional security requirements before granting access to Entra ID resources.

Answer

Enable Identity Protection for all users

Answer

Enable Self-Service Password Reset (SSPR)

Answer

Use Azure AD Connect to sync privileged accounts

Question 11

Which THREE of the following are capabilities of Microsoft Purview Information Protection?

Accepted Answer

Classifying data using trainable classifiers. Option B is correct because Microsoft Purview Information Protection includes trainable classifiers that use machine learning to intelligently identify sensitive content based on patterns and context, not just keywords. These classifiers can be trained with sample data to improve accuracy, enabling automated classification of documents and emails without requiring manual rule creation.

Answer

Preventing data loss via DLP policies

Answer

Detecting risky user activities with Insider Risk Management

Question 12

Which TWO of the following are components of Microsoft Defender XDR (Extended Detection and Response)?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender XDR (Extended Detection and Response) is a unified security operations platform that natively integrates signals from Microsoft Defender for Endpoint (endpoint detection and response) and Microsoft Defender for Office 365 (email and collaboration security). These two components provide the core telemetry for cross-domain threat correlation and automated response within the Defender XDR portal.

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 13

Your organization uses Microsoft Sentinel for security operations. You need to ensure that an attacker cannot disable data collection by deleting the diagnostic settings on the Sentinel workspace. What should you configure?

Accepted Answer

Apply a CanNotDelete resource lock on the Log Analytics workspace.. Option C is correct because applying a CanNotDelete resource lock on the Log Analytics workspace prevents any user or process, including an attacker, from deleting the workspace or its diagnostic settings. This lock overrides all role-based permissions, ensuring that even if an attacker gains high-privileged access, they cannot remove the diagnostic settings that stream telemetry to Microsoft Sentinel. Sentinel's data collection relies entirely on these diagnostic settings, so protecting them with a resource lock is the most direct and effective defense against deletion attacks.

Answer

Enable Sentinel's workspace deletion protection.

Answer

Assign the Log Analytics Contributor role only to specific users.

Answer

Create an Azure Policy to audit diagnostic settings.

Question 14

Your company uses Microsoft Defender for Cloud Apps (MDA). You need to create a policy that automatically suspends a user's access to a cloud app if the user is confirmed as compromised by Microsoft Entra ID Protection. Which policy type should you use?

Accepted Answer

Session policy. A session policy in Microsoft Defender for Cloud Apps can be configured to take real-time actions based on risk signals from Microsoft Entra ID Protection. When a user is confirmed as compromised, a session policy can enforce automatic suspension of access to cloud apps by blocking the session or requiring reauthentication, directly addressing the requirement.

Answer

Access policy

Answer

App permissions policy

Answer

Anomaly detection policy

Question 15

You are designing a compliance solution for your organization that must enforce retention policies for documents stored in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it is specifically designed to enforce retention policies for documents in SharePoint Online. It allows you to apply retention labels and policies that automatically retain or delete content based on compliance requirements, without user intervention.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Insider Risk Management