SC-100 Design security operations, identity, and compliance capabilities Practice Test 7 — 15 Questions

Question 1

Your organization uses Microsoft Intune for mobile device management. Employees report they cannot access corporate email on their personal iOS devices. The helpdesk confirms devices are enrolled and compliant. What should you check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify the conditional access policy for Exchange Online includes iOS devices.. Conditional access policies in Microsoft Entra ID (formerly Azure AD) control access to cloud apps like Exchange Online. Since devices are enrolled and compliant, the issue likely lies with a conditional access policy that may not include iOS devices or has restrictions. Option A is incorrect because device configuration profiles set device settings (e.g., Wi-Fi, VPN) but do not directly affect email access. Option C is incorrect because app protection policies manage data within apps (e.g., prevent copy-paste) but do not block access. Option D is incorrect because the compliance policy defines device requirements (e.g., jailbreak detection) but the devices are already compliant.

Answer

Confirm the device configuration profile includes email settings.

Answer

Review the app protection policy for Outlook.

Answer

Ensure the compliance policy allows iOS devices.

Question 2

A multinational company uses Microsoft Purview for data governance. They need to automatically classify sensitive data in Microsoft 365 and apply retention labels. The solution must use pattern-based detection for credit card numbers and support custom keywords. What should they configure?

Accepted Answer

Create a custom sensitive info type with a regex pattern and keyword list.. The requirement specifies pattern-based detection for credit card numbers and support for custom keywords. A custom sensitive info type in Microsoft Purview allows you to define a regex pattern (e.g., for credit card numbers) and associate a custom keyword list, enabling precise auto-classification and retention label application. Trainable classifiers use machine learning, not pattern-based detection, and DLP policies or retention label auto-labeling policies do not directly create the pattern and keyword logic needed.

Answer

Use a trainable classifier for credit card numbers.

Answer

Configure a DLP policy with a rule for credit card numbers.

Answer

Create a retention label with auto-labeling policy.

Question 3

You need to design a security operations strategy for a hybrid environment using Microsoft Sentinel. Your environment includes on-premises servers and Azure VMs. Which data connector should you use to collect security events from both sources?

Accepted Answer

Windows Security Events via AMA connector. The Windows Security Events via Azure Monitor Agent (AMA) connector can collect security events from both on-premises servers (via Azure Arc) and Azure VMs. Option A is incorrect because the Azure Activity log connector captures Azure resource operations, not security events. Option C is incorrect because the Office 365 connector is for Office 365 logs, not server security events. Option D is incorrect because the Syslog connector is used for Linux systems, not Windows security events.

Answer

Azure Activity log connector

Answer

Office 365 connector

Answer

Syslog connector

Question 4

Your organization uses Microsoft Defender for Endpoint (MDE) and wants to implement automated investigation and response (AIR) for ransomware. You need to ensure that when a suspicious file is detected, the investigation is automatically started and the file is contained. What should you configure?

Accepted Answer

Configure the automated investigation and response capabilities in MDE.. Automated investigation and response (AIR) in Microsoft Defender for Endpoint can be configured to automatically start investigations and take containment actions like isolating files when suspicious activity is detected. Option B is incorrect because custom detection rules in Microsoft 365 Defender create alerts but do not automatically take response actions like containment; they require manual or automated remediation rules. Option C is incorrect because attack surface reduction rules reduce the attack surface by blocking common techniques but do not automate investigation and response for specific detections. Option D is incorrect because adding file hashes to the indicators of compromise list blocks or allows known threats but does not automate the investigation process.

Answer

Create a custom detection rule in Microsoft 365 Defender.

Answer

Enable attack surface reduction rules.

Answer

Add the file hash to the indicators of compromise list.

Question 5

A company uses Microsoft Entra ID with P2 licenses and wants to implement a zero-trust identity security model. They need to require multi-factor authentication (MFA) for all external users accessing internal applications. The solution should not require external users to have Entra ID licenses. What should you configure?

Accepted Answer

Create a conditional access policy for external users requiring MFA.. A conditional access policy can be configured to target external guest users and require MFA, without requiring those users to have Entra ID licenses. Option A (PIM) is used for managing privileged access for internal users, not for external MFA enforcement. Option C (Identity Protection) is a risk detection service that requires licenses and does not enforce MFA directly. Option D is incorrect because while Entra ID B2B collaboration enables external identities, the MFA enforcement itself is done through conditional access policies, making option B the direct and specific configuration needed.

Answer

Configure Privileged Identity Management (PIM) for external users.

Answer

Enable identity protection for external users.

Answer

Use Entra ID B2B collaboration and configure MFA enforcement.

Question 6

Your organization uses Microsoft Purview Information Protection to label sensitive documents. You need to ensure that documents containing personally identifiable information (PII) are automatically labeled when saved in SharePoint Online. What should you configure?

Accepted Answer

Configure an auto-labeling policy for sensitivity labels targeting SharePoint.. Auto-labeling policies for sensitivity labels can scan content in SharePoint and automatically apply labels based on conditions like PII detection. Option A is wrong because retention labels are designed for retention and disposition, not for sensitivity classification. Option B is wrong because publishing a sensitivity label only makes it available for manual application; automatic labeling requires an auto-labeling policy. Option D is wrong because DLP policies can detect PII and enforce protection actions, but they do not directly apply sensitivity labels; auto-labeling policies are needed for that.

Answer

Create a retention label with auto-labeling rule.

Answer

Publish a sensitivity label with auto-labeling for SharePoint.

Answer

Set up a DLP policy to detect PII and apply a label.

Question 7

Which TWO actions should you take to implement a least-privilege identity security model using Microsoft Entra ID? (Choose two.)

Accepted Answer

Create conditional access policies to restrict access based on user, device, and location.. Conditional access policies enforce least-privilege by restricting access based on user, device, and location conditions. Option C is correct because Privileged Identity Management (PIM) enables just-in-time role activation, reducing standing privileges. Option B is incorrect because guest access reviews are primarily for governance and compliance, not directly for least-privilege identity security. Option D is incorrect because multi-factor authentication is an authentication security control, not a least-privilege model. Option E is incorrect because assigning the global administrator role to all IT staff violates least-privilege by granting excessive permissions.

Answer

Enable Azure AD Identity Governance for guest user access reviews.

Answer

Require multi-factor authentication for all users.

Answer

Assign global administrator role to all IT staff for simplicity.

Question 8

Your company uses Microsoft Sentinel to manage security incidents. You need to design a solution that automatically triages low-severity incidents and enriches them with threat intelligence. Which THREE capabilities would you include? (Choose three.)

Accepted Answer

Playbooks to perform enrichment actions like querying threat intelligence.. The correct answers are C, D, and E. Playbooks (C) can be designed to run enrichment actions such as querying threat intelligence sources. Automation rules (D) can automatically trigger those playbooks when an incident is created, enabling triage without manual intervention. Watchlists (E) store known indicators (e.g., malicious IPs) that can be correlated with incident data for enrichment. Option A is incorrect because advanced hunting queries are used for proactive threat hunting, not for automatic triage of incidents. Option B is incorrect because analytics rules are used to generate alerts, not to triage or enrich incidents.

Answer

Advanced hunting queries to investigate incidents.

Answer

Analytics rules to generate alerts for low-severity incidents.

Question 9

Which THREE are valid methods to secure privileged access in Microsoft Entra ID? (Choose three.)

Accepted Answer

Use privileged access groups to manage elevated access to resources.. Privileged access groups in Microsoft Entra ID allow organizations to assign users to roles that grant elevated permissions to resources like Azure AD roles or Azure resources. By using these groups, administrators can manage access more granularly and reduce standing privileges, aligning with the principle of least privilege.

Answer

Require device enrollment via Microsoft Intune.

Answer

Enable self-service password reset for all users.

Question 10

You need to design a compliance solution using Microsoft Purview that automatically detects and protects credit card numbers in emails and documents. Which TWO features should you include? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policies to detect and block credit card numbers.. Data Loss Prevention (DLP) policies can detect credit card numbers in emails and documents and enforce protective actions like blocking or alerting. Option C is correct because auto-labeling policies can automatically apply sensitivity labels to content containing credit card numbers, helping to classify and protect the data. Option B is incorrect because retention labels are used for managing data retention and deletion, not for protection or detection. Option D is incorrect because trainable classifiers are used to identify patterns of sensitive information, but DLP and auto-labeling are the direct features for detection and protection. Option E is incorrect because eDiscovery is used for searching and managing legal holds, not for automatic detection and protection.

Answer

Retention labels to retain credit card data for a specified period.

Answer

Trainable classifiers to identify credit card numbers.

Answer

eDiscovery to search for credit card numbers.

Question 11

You are analyzing a custom detection rule in Microsoft 365 Defender. Based on the exhibit, what is a potential operational issue with this rule?

Accepted Answer

The threshold is too low, leading to alert fatigue.. The threshold is set too low (5), which with high severity can cause an excessive number of alerts, resulting in alert fatigue. Option B is incorrect because the query syntax appears valid. Option C is incorrect because using High severity is appropriate for the detection. Option D is incorrect because the rule includes both powershell.exe and pwsh.exe in the query.

Answer

The query syntax is invalid.

Answer

The severity should be Medium instead of High.

Answer

The rule does not cover PowerShell 7 (pwsh.exe).

Question 12

Your organization uses Microsoft Sentinel to centralize security events. You need to ensure that alerts from Microsoft Defender for Cloud are automatically ingested into Sentinel. Which data connector should you enable?

Accepted Answer

Microsoft Defender for Cloud connector. The Microsoft Defender for Cloud connector (formerly Azure Security Center) is specifically designed to ingest alerts and recommendations from Defender for Cloud into Sentinel. The other options are unrelated: Office 365 connector ingests Office logs, Azure Activity logs track Azure resource operations, and DNS connector ingests DNS queries.

Answer

DNS connector

Answer

Office 365 connector

Answer

Azure Activity connector

Question 13

A company is implementing Microsoft Purview Compliance Manager to manage compliance activities. They need to assign a specific control action to a compliance officer. Which role should be assigned to the user in Purview Compliance Manager?

Accepted Answer

Compliance Manager. The Compliance Manager role provides permissions to manage compliance assessments and actions. The other roles do not have the necessary permissions to assign control actions within Compliance Manager.

Answer

Security Operator

Answer

Global Administrator

Answer

Compliance Administrator

Question 14

Your organization uses Microsoft Defender XDR. You need to configure automatic attack disruption for ransomware attacks. Which action should you take?

Accepted Answer

Enable 'Automatic attack disruption' in the Microsoft 365 Defender portal. Automatic attack disruption is a feature of Microsoft Defender XDR that can be enabled to automatically contain attacks. It is configured in the Microsoft 365 Defender portal under Settings > Endpoints > Advanced features. The other options are not correct: disabling automated investigation reduces response, and the other portals are not for this setting.

Answer

Enable the 'Automatically investigate and respond to alerts' feature in Defender for Cloud Apps

Answer

Configure an automation rule in Microsoft Sentinel

Answer

Disable 'Automated investigation and response' in Defender for Endpoint

Question 15

You are designing identity security for a hybrid organization using Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy that requires MFA for the sensitive applications. Conditional Access policies in Entra ID are the recommended method to require MFA for specific applications. The other options are less granular or outdated: per-user MFA is legacy, Security defaults apply to all apps and cannot be scoped, and Azure AD Identity Protection focuses on risk-based policies.

Answer

Enable Security defaults

Answer

Enable per-user MFA in Entra ID

Answer

Use Azure AD Identity Protection user risk policy