SC-100 Design security operations, identity, and compliance capabilities Practice Test 7 — 15 Questions

Question 1

Your organization needs to monitor and respond to threats across email, endpoints, and identities. Which Microsoft solution provides a unified incident response experience?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct choice because it provides a unified incident response experience by correlating alerts and signals from email (Defender for Office 365), endpoints (Defender for Endpoint), and identities (Defender for Identity) into a single incident queue. This cross-domain correlation enables security teams to investigate and remediate complex multi-stage attacks from a single pane of glass, rather than switching between separate consoles.

Answer

Microsoft Purview

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 2

A company uses Microsoft Purview to classify data and enforce retention policies. They need to automatically apply a retention label to all documents containing credit card numbers. Which approach should they use?

Accepted Answer

Configure an auto-labeling policy with a sensitive info type. Option A is correct because Microsoft Purview auto-labeling policies can automatically apply retention labels to documents based on sensitive info types (SITs), such as credit card numbers. This approach uses pattern matching to detect the credit card number format and applies the label without user intervention, meeting the requirement for automatic enforcement.

Answer

Use a trainable classifier

Answer

Create a manual labeling policy for users

Answer

Use a default label for SharePoint libraries

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender for Cloud. You need to design a solution that automatically creates an incident in Sentinel when a high-severity alert is generated in Defender for Cloud. What should you configure?

Accepted Answer

Enable the Microsoft Defender for Cloud data connector and create an analytics rule. The Microsoft Defender for Cloud data connector ingests security alerts from Defender for Cloud into Microsoft Sentinel. Once ingested, you create an analytics rule with a rule query that triggers on high-severity alerts and configures the rule to automatically create an incident. This is the standard method to convert a Defender for Cloud alert into a Sentinel incident without manual intervention.

Answer

Create a workbook to track alerts

Answer

Create a playbook in Microsoft Sentinel

Answer

Use a watchlist to import alerts

Question 4

Your organization wants to enforce that all users authenticate using Microsoft Authenticator app for Microsoft Entra ID. Which authentication method should you configure as the primary?

Accepted Answer

Microsoft Authenticator passwordless phone sign-in. The question requires that all users authenticate using the Microsoft Authenticator app. The Microsoft Authenticator passwordless phone sign-in (option C) is the only method that both uses the Microsoft Authenticator app and provides a passwordless primary authentication experience. This method leverages FIDO2-based key attestation within the app, allowing users to sign in with a biometric or PIN gesture without entering a password.

Answer

FIDO2 security keys

Answer

Email one-time passcode

Answer

SMS-based verification

Question 5

A company uses Microsoft Intune to manage devices. They need to ensure that only devices with a minimum OS version can access corporate email. Which policy type should they implement?

Accepted Answer

Compliance policies combined with conditional access. Option B is correct because compliance policies define conditions like minimum OS version, and conditional access enforces them. Option A is wrong because configuration profiles set settings, not enforce access. Option C is wrong because apps are not relevant. Option D is wrong because device enrollment restrictions are for enrollment, not access.

Answer

Device enrollment restrictions

Answer

App protection policies

Answer

Device configuration profiles

Question 6

Your organization uses Microsoft Entra ID with external identities. You need to design a solution that allows partners to self-service sign up using their existing Azure AD or Microsoft account credentials, while preventing them from accessing other resources. What should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Option A is correct because Entra ID B2B collaboration allows external users to use their own credentials and you can control access via conditional access or directory roles. Option B is wrong because B2C is for customer-facing apps. Option C is wrong because guest users are already part of B2B. Option D is wrong because identity protection is for risk detection.

Answer

Microsoft Entra B2C

Answer

Microsoft Entra Identity Protection

Answer

Direct federation with partner's IdP

Question 7

Your organization is implementing Microsoft Defender for Office 365 to protect against phishing attacks. Which TWO features can be used to simulate phishing attacks and train users?

Accepted Answer

Campaign simulations. Option A and D are correct because Attack simulation training in Defender for Office 365 allows creating simulation campaigns and training users. Option B is wrong because Safe Links protect against malicious URLs in real-time. Option C is wrong because Safe Attachments scans attachments. Option E is wrong because Anti-phish policies protect against phishing, not simulate.

Answer

Safe Attachments

Answer

Safe Links

Answer

Anti-phish policies

Question 8

Your organization uses Microsoft Sentinel and wants to improve threat hunting efficiency. Which THREE actions should you take?

Accepted Answer

Enable UEBA (User and Entity Behavior Analytics). UEBA (User and Entity Behavior Analytics) in Microsoft Sentinel uses machine learning models to establish baseline behavioral patterns for users, hosts, and other entities. It then detects anomalous activities such as unusual logon times, impossible travel, or abnormal data exfiltration, which directly enhances threat hunting by surfacing suspicious behaviors that might otherwise go unnoticed.

Answer

Use watchlists to filter out known benign IPs

Answer

Reduce data retention period to improve query speed

Question 9

Your organization needs to comply with regulatory requirements for data retention and deletion. Which TWO Microsoft Purview features should you use?

Accepted Answer

Retention policies. Retention policies (A) are the correct choice because they allow you to define automated rules for retaining or deleting data at the container level (e.g., entire SharePoint sites, Exchange mailboxes, or OneDrive accounts) to meet regulatory requirements. Retention labels (D) are also correct because they provide granular, item-level control (e.g., specific documents or emails) for retention and deletion, and can be applied manually or automatically via trainable classifiers or sensitive information types. Together, they form the core of Microsoft Purview's data lifecycle management, ensuring compliance with data retention and deletion mandates.

Answer

Data Loss Prevention (DLP) policies

Answer

Audit logs

Answer

eDiscovery

Question 10

The exhibit shows a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Identify the most frequent high-severity alerts over the past week. The query uses `summarize` with `count()` and `top 5 by count_ desc` to rank alert names by frequency, filtered to `AlertSeverity == 'High'` and `TimeGenerated > ago(7d)`. This directly identifies the most common high-severity alerts over the past week, making option C correct.

Answer

Find alerts that were not investigated

Answer

Analyze entities associated with alerts

Answer

Correlate alerts by time and alert name

Question 11

The exhibit shows a conditional access policy in Microsoft Entra ID. What will be the effect of this policy?

Accepted Answer

Block all applications except Office365. The exhibit shows a Conditional Access policy that includes 'All cloud apps' in the target resources and is configured with a 'Block access' grant control. The 'Exclude' list contains 'Office365', meaning the policy applies to all applications except Office365. Therefore, the effect is to block access to all applications except Office365, making option D correct.

Answer

Allow all applications except Office365

Answer

Block all applications including Office365

Answer

Allow all applications including Office365

Question 12

The exhibit shows a conditional access policy from Microsoft Entra ID Identity Protection. When will this policy require MFA?

Accepted Answer

When user risk is medium or high AND sign-in risk is high. Option A is correct because the conditional access policy shown in the exhibit uses the 'Require MFA' grant control with conditions set for user risk (medium or high) AND sign-in risk (high). In Microsoft Entra ID Identity Protection, when both risk levels are evaluated together with an AND operator, MFA is only triggered when both conditions are met simultaneously. This ensures that MFA is enforced only when the user account itself is compromised (medium/high user risk) and the current sign-in session is also risky (high sign-in risk), providing a layered security response.

Answer

When either user risk is medium or sign-in risk is high

Answer

When user risk is medium or high, regardless of sign-in risk

Answer

When sign-in risk is high, regardless of user risk

Question 13

A company uses Microsoft Sentinel for security operations. The SOC team needs to automatically respond to a specific type of incident involving a known malicious IP address. They want to create an automated response that blocks the IP at the firewall and creates a Teams notification. Which feature should they use?

Accepted Answer

Automation rule with a playbook. Automation rules in Microsoft Sentinel allow you to trigger automated responses when incidents are created or updated. By associating a playbook (an Azure Logic Apps workflow) with the automation rule, you can execute actions such as blocking an IP at a firewall via a connector and posting a Teams notification. This directly meets the requirement for a two-step automated response triggered by a specific incident type.

Answer

UEBA to detect anomalous behavior

Answer

Watchlist to correlate IP addresses

Answer

Analytics rule with scheduled query

Question 14

A global enterprise uses Microsoft Entra ID with Privileged Identity Management (PIM) and Conditional Access. They need to ensure that all privileged role activations require an approval workflow, and that the approval process is documented for compliance. What configuration should they implement?

Accepted Answer

In PIM, edit the role settings to require approval for activation. Option C is correct because PIM approvals require configuring role settings with approval required. Option A is incorrect because role-assignable groups are for group-based assignments, not approval workflows. Option B is incorrect because access reviews are for periodic review, not per-activation approval. Option D is incorrect because Authentication Strengths control MFA, not approval.

Answer

Create a Conditional Access policy requiring an Authentication Strength

Answer

Configure an access review for the privileged roles

Answer

Create a role-assignable group and assign the privileged role to the group

Question 15

A company uses Microsoft Defender for Cloud Apps to discover and control Shadow IT. They want to block the use of a newly discovered unsanctioned app. What should they do?

Accepted Answer

Mark the app as unsanctioned in Defender for Cloud Apps. Option C is correct because marking an app as unsanctioned in Microsoft Defender for Cloud Apps is the direct mechanism to block access to a discovered Shadow IT app. When an app is marked unsanctioned, Defender for Cloud Apps automatically enforces a block by integrating with Conditional Access to prevent users from accessing the app, and it can also generate alerts and session controls. This action is specifically designed for the discovered app governance workflow within Defender for Cloud Apps.

Answer

Create a Conditional Access policy to block the app

Answer

Use Microsoft Purview Data Loss Prevention to block the app

Answer

Block the app's domain in Microsoft Intune