SC-100 Design security operations, identity, and compliance capabilities Practice Test 6 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing a Conditional Access policy JSON in Microsoft Entra ID. The policy is not blocking any sign-ins even though there are high-risk users. What is the most likely reason?

Accepted Answer

The policy does not include any users or groups in the conditions.. Option C is correct because the policy only includes user risk levels but not sign-in risk levels; however, the exhibit shows signInRiskLevels is empty, which is fine. The issue is that the policy is in 'Report-only' mode (not shown) or the conditions are not met. But the most likely reason based on the exhibit is that the policy does not include any users or groups; the conditions do not specify users. Option A is wrong because the exhibit does not show assignment of users. Option B is wrong because the policy blocks all apps, not just specific ones. Option D is wrong because signInRiskLevels empty means no filter, but that doesn't prevent blocking.

Answer

The signInRiskLevels condition is empty, so no sign-ins match.

Answer

The policy only applies to specific applications, but the exhibit shows 'All'.

Answer

The grant controls operator should be 'AND' instead of 'OR'.

Question 2

Your organization uses Microsoft Defender for Endpoint (MDE) and Microsoft Sentinel. You need to create an analytics rule in Sentinel that triggers an incident when a device is reported as 'high risk' by MDE. Which data source and rule type should you use?

Accepted Answer

Microsoft Defender XDR connector with a Scheduled query rule. The Microsoft Defender XDR connector ingests alerts from Microsoft Defender for Endpoint (MDE) into Sentinel. A Scheduled query rule is required to run a KQL query at a defined interval (e.g., every 5 minutes) that checks for devices with a 'high risk' severity level in the ingested alert data. This combination allows you to create an incident when MDE reports a device as high risk.

Answer

Microsoft Sentinel's Anomalous Activity rule

Answer

Microsoft 365 Defender connector with an NRT query rule

Answer

Microsoft Defender for Cloud connector with a Fusion rule

Question 3

Your company needs to automatically classify and label sensitive documents in Microsoft 365 based on their content. Which Microsoft Purview solution should you implement?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Azure Information Protection) enables automatic classification and labeling of sensitive documents based on content, using trainable classifiers, exact data match (EDM), and sensitive information types. This solution applies sensitivity labels to documents in Microsoft 365 (e.g., SharePoint, Exchange, OneDrive) via client-side labeling or auto-labeling policies, meeting the requirement to classify and label by content.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Purview Insider Risk Management

Question 4

Refer to the exhibit. You are troubleshooting a KQL query in Microsoft Sentinel that is supposed to return alerts for ransomware detections in the last day. The query returns no results, but you know there were ransomware alerts. What is the most likely cause?

Accepted Answer

The AlertName filter is too specific and does not match the actual alert name.. Option B is correct because the query's `AlertName` filter is likely too specific (e.g., using a hardcoded string like 'RansomwareAlert') and does not match the actual alert name generated by Microsoft Sentinel's analytics rules. Ransomware alerts often have dynamic naming conventions that include variant names or suffixes, so an exact match filter fails to return results even though alerts exist. The query otherwise appears syntactically correct, and the `TimeGenerated` filter is set to the last day, which aligns with the known presence of alerts.

Answer

The ThreatFamily field is an integer, not a string.

Answer

The TimeGenerated filter uses the wrong time range.

Answer

The parse_json function is failing due to malformed JSON.

Question 5

Your organization uses Microsoft Entra ID and plans to implement a Zero Trust architecture. You need to ensure that all access requests to internal applications are verified continuously, not just at the initial sign-in. What should you configure?

Accepted Answer

Continuous Access Evaluation (CAE). Continuous Access Evaluation (CAE) is the correct choice because it enables real-time token validation and policy enforcement for critical events (e.g., user risk elevation, device compliance change, or IP address change) without requiring a new authentication request. This aligns with the Zero Trust principle of 'verify explicitly and continuously' by revoking access mid-session when conditions change, rather than only at initial sign-in.

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Privileged Identity Management (PIM)

Answer

Conditional Access policies with session controls

Question 6

You need to audit user activities in Microsoft 365, including who accessed a specific file in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Audit. Microsoft Purview Audit (specifically Audit (Standard) or Audit (Premium)) is the correct solution because it captures and logs user activities across Microsoft 365 services, including SharePoint Online. When a user accesses a specific file, the audit log records the event with details such as the user, file name, action (e.g., FileAccessed), and timestamp, enabling you to query this data via the Microsoft 365 Defender portal or Search-UnifiedAuditLog cmdlet.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Data Lifecycle Management

Question 7

Which TWO actions should you take to meet a compliance requirement that all emails containing credit card numbers must be encrypted before delivery?

Accepted Answer

Create a Microsoft Purview Data Loss Prevention (DLP) policy that detects credit card numbers and applies encryption.. Option B is correct because a Microsoft Purview Data Loss Prevention (DLP) policy can detect sensitive data types like credit card numbers and automatically apply encryption via Information Rights Management (IRM) as an action. This ensures that any email containing credit card data is encrypted before delivery, meeting the compliance requirement directly through policy enforcement.

Answer

Create a sensitivity label with encryption and apply it via auto-labeling.

Answer

Enable Microsoft Purview Information Protection auto-labeling for credit card data.

Answer

Create a mail flow rule in Exchange Online to encrypt emails with credit card numbers.

Question 8

Which TWO components are required to enable Microsoft Sentinel to ingest data from Amazon Web Services (AWS) CloudTrail?

Accepted Answer

An AWS S3 bucket to store CloudTrail logs.. Option B is correct because AWS CloudTrail logs must be delivered to an S3 bucket as a prerequisite for ingestion into Microsoft Sentinel. Sentinel's AWS CloudTrail data connector reads log files directly from the S3 bucket using the S3 REST API, making the bucket the required storage and access point for the logs.

Answer

An Azure Function to pull logs from AWS.

Answer

An AWS Lambda function to process logs.

Answer

An Azure Event Hubs namespace to receive logs.

Question 9

Which THREE capabilities are provided by Microsoft Defender for Cloud Apps (MDA) when integrated with Microsoft Defender XDR?

Accepted Answer

Discovery of shadow IT cloud apps.. Microsoft Defender for Cloud Apps (MDA) integrates with Microsoft Defender XDR to provide shadow IT discovery by analyzing traffic logs from network devices and cloud app catalogs, identifying unsanctioned cloud applications used in the organization. This capability is core to MDA's Cloud Discovery feature, which uses log parsing and machine learning to detect and classify shadow IT.

Answer

Email protection against phishing and malware.

Answer

Endpoint detection and response (EDR) for devices.

Question 10

Which THREE conditions can trigger a Microsoft Entra ID Protection user risk policy to require a password change?

Accepted Answer

Leaked credentials detected on the dark web.. Option A is correct because Microsoft Entra ID Protection's user risk policy can be triggered by leaked credentials detected on the dark web. When Microsoft's threat intelligence services find a user's credentials exposed in a known data breach, the user's risk level is elevated, and the policy can be configured to require a password change as a remediation action to mitigate the compromised account.

Answer

User has not registered for multi-factor authentication.

Answer

Device is marked as non-compliant by Intune.

Question 11

Refer to the exhibit. You run the PowerShell command in Microsoft Entra ID to find compliance roles. You need to assign the Compliance Administrator role to a user. What is the correct parameter to use in the Add-AzureADMSRoleAssignment cmdlet?

Accepted Answer

-RoleDefinitionId "173a97e2-97f2-4c7a-8e7c-7e2f1c1e2f1c". The `Add-AzureADMSRoleAssignment` cmdlet requires the `-RoleDefinitionId` parameter to specify the role by its unique identifier (GUID). The exhibit shows that the Compliance Administrator role has the ObjectId `173a97e2-97f2-4c7a-8e7c-7e2f1c1e2f1c`, which is the role's definition ID, not a user or group object ID. Therefore, option D correctly uses `-RoleDefinitionId` with that GUID.

Answer

-ObjectId "173a97e2-97f2-4c7a-8e7c-7e2f1c1e2f1c"

Answer

-RoleName "Compliance Administrator"

Answer

-RoleId "173a97e2-97f2-4c7a-8e7c-7e2f1c1e2f1c"

Question 12

Refer to the exhibit. You are deploying this Bicep template to enable Microsoft Defender for Cloud's VM protection. After deployment, you notice that Agentless VM scanning is not enabled for existing VMs. What is the most likely reason?

Accepted Answer

Agentless scanning is only enabled for new VMs; existing VMs require rescanning.. Option D is correct because the Bicep template sets pricing for 'VirtualMachines' but the extension for agentless scanning must be enabled at the subscription level or per VM; the extension in the pricing resource only enables the feature for new VMs, not existing ones. Option A is wrong because the name 'VirtualMachines' is correct. Option B is wrong because the pricing tier is Standard, which is correct. Option C is wrong because the extension syntax is correct for Bicep.

Answer

The pricing tier must be 'Free' to enable agentless scanning.

Answer

The resource name 'VirtualMachines' is incorrect; it should be 'virtualMachines'.

Answer

The extension 'AgentlessVmScanning' must be defined outside the pricing resource.

Question 13

Your organization uses Microsoft Sentinel for security operations. You need to ensure that all incident investigations are automatically captured for compliance reporting. Which feature should you enable?

Accepted Answer

Enable Microsoft Sentinel audit logging. Microsoft Sentinel audit logging captures all actions performed within the Sentinel environment, including incident investigations, queries run, and configuration changes. Enabling this feature ensures that every investigation step is logged and can be used for compliance reporting, as it records user activities and system events in the Azure Activity Log or Log Analytics workspace.

Answer

Use Microsoft Purview Compliance Manager

Answer

Configure Azure Policy for Sentinel

Answer

Enable Microsoft Defender for Cloud Apps

Question 14

A company is implementing a zero-trust security model. They need to enforce conditional access policies that require device compliance from Microsoft Intune. However, some users report being blocked when using personal devices that are not enrolled. What is the best approach to allow access while maintaining security?

Accepted Answer

Require app protection policies via Microsoft Intune. Option B is correct because Microsoft Intune app protection policies (APP) can enforce data protection and access controls on personal devices without requiring full enrollment. This allows the company to maintain a zero-trust posture by applying conditional access policies that check for app-level compliance, such as requiring a managed browser or blocking copy/paste, while still permitting access from unenrolled personal devices. This approach aligns with the zero-trust principle of 'never trust, always verify' by verifying device health at the application layer rather than the device layer.

Answer

Allow all devices but monitor with Defender for Cloud Apps

Answer

Block all non-compliant devices

Answer

Require device enrollment for all devices

Question 15

Your organization uses Microsoft Entra ID with Privileged Identity Management (PIM). You need to design a role activation policy that requires approval from a security group for global administrator roles, but allows self-activation for other roles. What is the correct configuration?

Accepted Answer

Configure separate PIM settings per role: Global Administrator requires approval, others self-activate. Privileged Identity Management (PIM) in Microsoft Entra ID allows you to configure role-specific activation settings. By creating separate PIM policies per role, you can require approval for the Global Administrator role while allowing self-activation for other roles. This granular control ensures that high-privilege roles have additional oversight, while lower-privilege roles remain agile.

Answer

Create a single PIM policy for all roles with approver group

Answer

Enable just-in-time access in Azure AD Identity Protection

Answer

Use Azure AD entitlement management with access packages

SC-100 Design security operations, identity, and compliance capabilities Practice Test 6 — 15 Questions

Exhibit

SC-100 Design security operations, identity, and compliance capabilities Practice Test 6 — 15 Questions

Exhibit