SC-100 Design security operations, identity, and compliance capabilities Practice Test 6 — 15 Questions

Question 1

A company uses Microsoft Sentinel as its SIEM. They want to minimize storage costs for verbose logs that are rarely accessed but must be retained for one year for compliance. Which TWO actions should they take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Archive the logs to Azure Storage after 30 days. Archiving logs to Azure Storage after 30 days moves cold data to low-cost blob storage while retaining it for compliance, reducing Sentinel ingestion and retention costs. Option C is correct because the Basic Logs tier is designed for verbose, high-volume logs that are rarely queried, offering lower ingestion costs and shorter interactive retention (8 days) with long-term archival, meeting the one-year compliance requirement.

Answer

Increase the retention period to one year

Answer

Remove the data sources that generate verbose logs

Answer

Set up continuous export to an event hub

Question 2

A company uses Microsoft Purview Data Lifecycle Management. They need to retain financial records for 7 years and then delete them. Which TWO actions should they configure?

Accepted Answer

Create a retention label with a 7-year retention period. Retention labels define the retention period. However, to actually delete the records after 7 years, a disposition review (Option E) is required to approve the deletion. Both are needed: the retention label sets the lifecycle and the disposition review provides the approval process before permanent deletion. Option C alone does not automatically delete; it waits for a disposition review action. Option E ensures that deletion is approved by a reviewer before the data is permanently removed.

Answer

Create a DLP policy that blocks deletion

Answer

Apply a sensitivity label to the records

Answer

Use a trainable classifier to identify records

Question 3

A company uses Microsoft Defender for Cloud to secure multicloud environments. They want to assess compliance with SOC 2. Which THREE steps should they take?

Accepted Answer

Monitor the secure score for SOC 2 recommendations. The secure score in Microsoft Defender for Cloud provides a quantified assessment of your security posture, including specific recommendations aligned with the SOC 2 regulatory compliance standard. By monitoring the secure score for SOC 2 recommendations, you can track your progress against SOC 2 controls and prioritize remediation actions based on the impact on your compliance score.

Answer

Enable just-in-time (JIT) VM access

Answer

Create Azure Policy definitions for SOC 2 controls

Question 4

A company uses Microsoft Intune and wants to ensure that devices are compliant before accessing corporate resources. They create a Conditional Access policy that requires devices to be marked as compliant. However, some users report that they are blocked even though their device shows as compliant in Intune. What is the most likely cause?

Accepted Answer

The device is not registered in Microsoft Entra ID. The most likely cause. For a Conditional Access policy to evaluate device compliance, the device must be registered with Microsoft Entra ID (formerly Azure AD). Even if Intune marks the device as compliant, if it is not registered in Entra ID, the policy cannot assess its compliance status, resulting in a block. Option A is incorrect because there is no indication of a location-based policy blocking access; the scenario only mentions a compliant device requirement. Option B is incorrect because while MFA may be required, the issue described is that devices show as compliant yet users are blocked, pointing to a registration problem rather than MFA. Option D is incorrect because an app protection policy is a separate requirement and would not cause a block if the device itself is compliant but unregistered.

Answer

The user's location is blocked by a location-based policy

Answer

The policy also requires MFA, and users haven't registered for MFA

Answer

The policy requires an app protection policy, which is not applied

Question 5

Your company uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a confirmed ransomware incident by isolating affected devices and blocking malicious IPs. What should you use?

Accepted Answer

Sentinel automation rules with playbooks. Microsoft Sentinel automation rules can trigger playbooks (based on Azure Logic Apps) to perform actions like device isolation and IP blocking. Option A (Azure Policy) is wrong because it is mainly for governance and compliance, not for automated incident response. Option C (Microsoft Defender for Cloud Apps) is wrong because it focuses on SaaS application security and CASB functionality, not on orchestrating multi-step response actions. Option D (Microsoft Intune) is wrong because it manages device compliance and configuration but lacks the built-in orchestration to automatically respond to incidents; it would require additional automation.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 6

Your organization uses Microsoft Purview to govern sensitive data. You need to design a solution that automatically detects and protects credit card numbers in emails and documents stored in Microsoft 365. The solution should also provide data loss prevention (DLP) policy tips to users when they try to share such data externally. What should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention policies. You need a solution that automatically detects credit card numbers in emails and documents and provides DLP policy tips when sharing externally. Microsoft Purview Data Loss Prevention (DLP) policies (Option B) are designed for this purpose: they can detect sensitive info types like credit card numbers and show policy tips to users. Option A (Sensitivity labels with auto-classification) is incorrect because sensitivity labels are for classification and protection, not for real-time DLP policy tips with end-user notifications. Option C (Microsoft 365 compliance center) is incorrect because it is the portal used to manage compliance features, not a specific configuration for DLP tips. Option D (Microsoft Information Protection unified labeling) is incorrect because unified labeling focuses on label management and does not directly provide DLP policy tips.

Answer

Sensitivity labels with auto-classification

Answer

Microsoft 365 compliance center

Answer

Microsoft Information Protection unified labeling

Question 7

Your organization wants to use Microsoft Defender XDR to automatically investigate and respond to alerts. You need to ensure that the solution can autonomously remediate confirmed threats on endpoints, such as quarantining files and isolating devices. What should you enable?

Accepted Answer

Microsoft Defender for Endpoint. Microsoft Defender for Endpoint includes automated investigation and remediation (AIR) capabilities that can autonomously quarantine malicious files and isolate devices. Option A is incorrect: Microsoft Defender for Identity focuses on detecting identity-based threats using on-premises Active Directory signals, not endpoint remediation. Option B is incorrect: Microsoft Defender for Cloud Apps provides visibility and control over SaaS applications, but does not perform endpoint quarantine or isolation. Option D is incorrect: Microsoft Defender for Office 365 protects email and collaboration tools like SharePoint, OneDrive, and Teams, but cannot remediate endpoint-level threats.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Question 8

Your company uses Microsoft Intune to manage corporate devices. You need to design a compliance policy that requires devices to have a minimum OS version, be encrypted, and not be jailbroken or rooted. Additionally, you want to automatically block non-compliant devices from accessing corporate email. What should you configure?

Accepted Answer

Intune compliance policies and Conditional Access. Intune compliance policies define device requirements (minimum OS version, encryption, jailbreak/root status), and Conditional Access policies can block access to corporate email for non-compliant devices. Option B is incorrect because device configuration profiles configure settings but do not enforce access control. Option C is incorrect because app protection policies protect data at the app level, not device-level compliance, and Microsoft Defender for Endpoint provides threat detection but not compliance enforcement. Option D is incorrect because device enrollment restrictions limit which devices can enroll, not access after enrollment.

Answer

Device configuration profiles and Azure AD join

Answer

App protection policies and Microsoft Defender for Endpoint

Answer

Device enrollment restrictions

Question 9

Your organization is designing a privileged access strategy using Microsoft Entra ID. Which TWO configurations should be part of the design to protect privileged accounts?

Accepted Answer

Require multi-factor authentication for all administrative roles via Conditional Access. Options A and C are correct. Option A: Conditional Access with MFA for admin roles reduces risk of credential theft. Option C: Privileged Identity Management (PIM) provides just-in-time access and approval workflows. Option B is wrong because security defaults enforce MFA for all users but lack granularity for privileged roles. Option D is wrong because self-service password reset is not specific to privileged accounts and does not protect against misuse. Option E is wrong because disabling MFA would weaken security.

Answer

Enable security defaults

Answer

Enable self-service password reset for admins

Answer

Disable multi-factor authentication for emergency admin accounts

Question 10

Your company is deploying Microsoft Defender XDR. You need to design a solution that uses advanced hunting to proactively search for threats. Which THREE data sources should be included in the advanced hunting schema to enable comprehensive threat hunting across endpoints, identities, and cloud apps?

Accepted Answer

CloudAppEvents. Options C, D, and E are correct because they represent key data sources in Microsoft Defender XDR advanced hunting. CloudAppEvents (C) provides cloud application activity data from Defender for Cloud Apps. IdentityInfo (D) offers identity context from Azure Active Directory. DeviceEvents (E) captures endpoint activities from Microsoft Defender for Endpoint. Option A (EmailEvents) is part of Microsoft Defender for Office 365 and is not a primary table in the Defender XDR advanced hunting schema; it is available but not considered a core source for comprehensive threat hunting across endpoints, identities, and cloud apps. Option B (AzureActivity) is part of Azure Monitor, not Defender XDR schema.

Answer

EmailEvents

Answer

AzureActivity

Question 11

Your organization needs to comply with GDPR. You need to design a data protection strategy using Microsoft Purview. Which THREE capabilities should you include?

Accepted Answer

Data classification and labeling. Options C, D, and E are correct. Option C: Data classification and labeling helps identify personal data and apply appropriate controls. Option D: Data subject request (DSR) management is a requirement under GDPR to handle requests from data subjects. Option E: Data Loss Prevention (DLP) policies prevent unauthorized sharing of personal data. Option A (Azure Policy) is used for regulatory compliance of Azure resources, not specifically for data protection under GDPR. Option B (eDiscovery) is used for legal investigations and electronic discovery, not a primary GDPR data protection capability.

Answer

Azure Policy

Answer

eDiscovery

Question 12

Refer to the exhibit. You are analyzing a KQL query in Microsoft Defender XDR advanced hunting. The query is intended to identify the top 10 devices by the number of executable process creations in the last 7 days. However, the results are showing only a few entries with low counts. What is the most likely issue?

Accepted Answer

The ActionType filter is likely missing the correct value for process creation. The query likely filters on an incorrect ActionType value for process creation. In Microsoft Defender XDR advanced hunting, process creation events use ActionType == "ProcessCreated" (or "CreateProcess" depending on schema), not "ProcessCreate". This mismatch causes the query to return few or no results. Option A is incorrect because DeviceName should be included in the summarize to group by device, but the primary issue is the filter. Option B is incorrect because 'take' is appropriate for limiting results after aggregation. Option C is incorrect because 'bin' on Timestamp is valid for time bucketing.

Answer

The 'summarize' statement should include DeviceName in the aggregate

Answer

The 'take' operator is not appropriate for this aggregation

Answer

The 'bin' function on Timestamp is incorrect

Question 13

Refer to the exhibit. You are reviewing an Azure Policy definition for GDPR compliance. The policy is intended to audit storage accounts that do not have encryption enabled. However, the policy is not evaluating correctly. What is the most likely reason?

Accepted Answer

The effect should be 'Audit' instead of 'auditIfNotExists'. The policy uses the 'auditIfNotExists' effect, which is designed to audit when a dependent resource (e.g., a diagnostic setting) does not exist. However, storage account encryption is a property of the storage account itself, not a separate resource. Therefore, the correct effect should be 'Audit' with a condition that checks if encryption is disabled (e.g., properties.encryption.services.blob.enabled != true). Option C is correct because changing the effect to 'Audit' will properly evaluate the encryption status. Options A, B, and D are incorrect: The field 'type' is correct for the resource type, policy type can be built-in or custom, and the mode 'Indexed' is appropriate for storage accounts.

Answer

The field 'type' should be 'Microsoft.Storage/storageAccounts/encryption'

Answer

The policy type should be 'Custom'

Answer

The policy mode should be 'All' instead of 'Indexed'

Question 14

Your organization deploys Microsoft Sentinel and wants to automatically respond to phishing emails reported by users. You need to recommend a solution that creates an incident in Sentinel and blocks the email sender in Exchange Online. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Automation rules in Microsoft Sentinel can trigger a playbook when an incident is created, allowing automated response actions such as blocking the email sender in Exchange Online. Option A is incorrect because watchlists are for reference data, not automation. Option C is incorrect because UEBA analyzes user behavior but does not directly respond to incidents. Option D is incorrect because analytics rules generate incidents from data, but the question asks for a response after an incident is created.

Answer

Use a watchlist to store known phishing senders.

Answer

Enable UEBA to detect anomalous email behavior.

Answer

Create an analytics rule that queries user-reported phishing data.

Question 15

A company uses Microsoft Defender for Cloud Apps to monitor SaaS apps. They discover that a user is downloading large volumes of data from SharePoint Online from an atypical IP address. The security team wants to automatically suspend the user's access to all cloud apps. What is the most efficient way to achieve this?

Accepted Answer

Create a session policy that blocks the user's session based on the anomaly.. Session policies in Microsoft Defender for Cloud Apps enforce real-time controls and can block a user's session based on anomalous behavior, such as downloading large volumes from an atypical IP. Option A is wrong because app tags categorize apps, not users. Option B is wrong because file policies control data at rest, not user access. Option D is wrong because OAuth app policies manage third-party app permissions, not user access suspension.

Answer

Tag the user as suspicious using an app tag.

Answer

Create a file policy that triggers when a user downloads many files.

Answer

Create an OAuth app policy to revoke permissions.