SC-100 Design security operations, identity, and compliance capabilities Practice Test 8 — 15 Questions

Question 1

A company uses Microsoft Defender XDR and wants to ensure that all devices are reporting to the service. They notice that some devices are not appearing in the device inventory. Which log source should they check first to troubleshoot?

Accepted Answer

Microsoft Defender for Endpoint deployment log (MDEClientAnalyzer). Option B is correct because the Microsoft Defender for Endpoint deployment log shows onboarding status and errors. Option A is incorrect because Windows Event Log may not be enabled. Option C is incorrect because Intune enrollment is for MDM, not Defender. Option D is incorrect because Syslog is for non-Microsoft devices.

Answer

Microsoft Intune enrollment logs

Answer

Windows Event Log - Microsoft-Windows-Windows Defender/Operational

Answer

Syslog from the device

Question 2

An organization uses Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from pasting sensitive data into AI-powered tools like Microsoft Copilot. Which DLP rule condition should they configure?

Accepted Answer

Cloud app includes Microsoft Copilot. To prevent users from pasting sensitive data into AI-powered tools like Microsoft Copilot, you need to configure a DLP rule condition that targets the specific application. The 'Cloud app includes Microsoft Copilot' condition allows the DLP policy to inspect and block sensitive content when it is being pasted into Copilot, as Copilot is a cloud app that can be monitored via Microsoft Purview's endpoint DLP and cloud app discovery capabilities.

Answer

Content is shared with external users

Answer

Access from unmanaged devices

Answer

File extension is .docx or .pdf

Question 3

A company uses Microsoft Sentinel and wants to use a built-in connector to ingest logs from Amazon Web Services (AWS). Which connector should they use?

Accepted Answer

Amazon Web Services S3 connector. The Amazon Web Services (AWS) S3 connector is the correct built-in connector in Microsoft Sentinel for ingesting logs from AWS. It works by configuring AWS to send logs (such as CloudTrail, VPC Flow Logs, or GuardDuty findings) to an S3 bucket, which Sentinel then polls via the S3 REST API using an IAM role for secure, cross-account access. This is the native, supported method for log ingestion from AWS into Sentinel.

Answer

ServiceNow connector

Answer

Azure Policy for AWS

Answer

Office 365 connector

Question 4

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is enabled but users who are detected as high risk are still able to sign in. What is the most likely reason?

Accepted Answer

No users or groups are assigned to the policy. Option C is correct because the exhibit does not show a session control or require MFA; a common reason is that the policy may require user assignment, but if no users are assigned, it won't apply. Option A is incorrect because the policy is enabled. Option B is incorrect because the risk levels are set. Option D is incorrect because the block control is set.

Answer

The policy state is set to 'enabled' but not 'enforced'

Answer

The user risk level is set to 'high' but sign-in risk is 'medium'

Answer

The grant control is set to 'block' but should be 'require MFA'

Question 5

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

Identify accounts that have experienced more than 10 failed login attempts from the same IP address within an hour. The KQL query uses the `summarize` operator to count failed logon events (EventID 4625) grouped by account and IP address, then filters for counts greater than 10 within a 1-hour time window. This directly identifies accounts that have experienced more than 10 failed login attempts from the same IP address within an hour, which is a classic indicator of a brute-force attack targeting a specific account.

Answer

Identify IP addresses that have successfully brute-forced an account

Answer

Identify users who have logged in from multiple IPs in a short time

Answer

Identify accounts that have been disabled due to multiple failures

Question 6

A company uses Microsoft Defender for Identity (MDI) to monitor on-premises Active Directory. They want to integrate MDI alerts into Microsoft Sentinel. Which data connector should they use?

Accepted Answer

Microsoft Defender for Identity connector. Option C is correct because the Microsoft Defender for Identity connector ingests MDI alerts into Sentinel. Option A is incorrect because Windows Security Events connector ingests raw events, not MDI alerts. Option B is incorrect because Azure AD connector is for cloud identity logs. Option D is incorrect because Syslog is for non-Microsoft devices.

Answer

Syslog connector

Answer

Azure Active Directory connector

Answer

Windows Security Events via AMA

Question 7

A company uses Microsoft Purview to classify and label sensitive data. They want to automatically apply a sensitivity label to documents containing a specific custom sensitive information type. Which TWO components are required for this?

Accepted Answer

Custom sensitive information type. Option C is correct because a custom sensitive information type defines the specific data pattern (e.g., a proprietary employee ID format) that Microsoft Purview can detect in documents. Option D is correct because an auto-labeling policy uses that custom sensitive information type as a condition to automatically apply a sensitivity label to matching content, without requiring user intervention.

Answer

Data loss prevention (DLP) policy

Answer

Retention label

Answer

Trainable classifier

Question 8

A company uses Microsoft Intune to manage devices. They need to ensure that only compliant devices can access corporate email. They plan to use Conditional Access in Microsoft Entra ID. Which THREE components must be configured?

Accepted Answer

Device registration in Entra ID. Device registration in Entra ID (A) is required because Conditional Access policies evaluate device compliance based on the device's identity in Entra ID. Without registration, the device lacks a unique identity that Entra ID can assess for compliance status, making it impossible to enforce access controls based on device state.

Answer

Windows Autopilot deployment profile

Answer

Configuration profile in Intune

Question 9

A company uses Microsoft Sentinel as its SIEM. They want to minimize storage costs for verbose logs that are rarely accessed but must be retained for one year for compliance. Which TWO actions should they take?

Accepted Answer

Archive the logs to Azure Storage after 30 days. Option B is correct because basic logs are cheaper than analytics logs. Option C is correct because archiving long-term data to Azure Storage reduces costs. Option A is incorrect because removing data sources reduces visibility. Option D is incorrect because continuous export does not reduce cost. Option E is incorrect because increasing retention increases cost.

Answer

Increase the retention period to one year

Answer

Remove the data sources that generate verbose logs

Answer

Set up continuous export to an event hub

Question 10

A company uses Microsoft Purview Data Lifecycle Management. They need to retain financial records for 7 years and then delete them. Which TWO actions should they configure?

Accepted Answer

Create a retention label with a 7-year retention period. Option C is correct because Microsoft Purview Data Lifecycle Management uses retention labels to enforce a specific retention period and then automatically delete the data. By creating a retention label with a 7-year retention period, the organization ensures financial records are retained for exactly 7 years and then permanently deleted without manual intervention.

Answer

Create a DLP policy that blocks deletion

Answer

Apply a sensitivity label to the records

Answer

Use a trainable classifier to identify records

Question 11

A company uses Microsoft Defender for Cloud to secure multicloud environments. They want to assess compliance with SOC 2. Which THREE steps should they take?

Accepted Answer

Monitor the secure score for SOC 2 recommendations. Option A is correct because Defender for Cloud has built-in regulatory compliance standards. Option B is correct because secure score helps track compliance. Option C is correct because continuous export sends data to other tools. Option D is incorrect because Azure Policy is for Azure resources, not multicloud. Option E is incorrect because JIT is a security control, not compliance assessment.

Answer

Enable just-in-time (JIT) VM access

Answer

Create Azure Policy definitions for SOC 2 controls

Question 12

A company uses Microsoft Intune and wants to ensure that devices are compliant before accessing corporate resources. They create a Conditional Access policy that requires devices to be marked as compliant. However, some users report that they are blocked even though their device shows as compliant in Intune. What is the most likely cause?

Accepted Answer

The device is not registered in Microsoft Entra ID. Option B is correct because the device must be registered in Entra ID for the Conditional Access policy to evaluate its compliance status. Option A is incorrect because the policy is for compliant devices, not MFA. Option C is incorrect because the policy is for compliance, not app protection. Option D is incorrect because location is not mentioned.

Answer

The user's location is blocked by a location-based policy

Answer

The policy also requires MFA, and users haven't registered for MFA

Answer

The policy requires an app protection policy, which is not applied

Question 13

Your company uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a confirmed ransomware incident by isolating affected devices and blocking malicious IPs. What should you use?

Accepted Answer

Sentinel automation rules with playbooks. Option D is correct because Microsoft Sentinel automation rules can trigger playbooks (based on Azure Logic Apps) to perform actions like device isolation and IP blocking. Option A is wrong because Microsoft Defender for Cloud Apps is more focused on SaaS app security. Option B is wrong because Azure Policy is for compliance, not automated response. Option C is wrong because Microsoft Intune supports device management but would require additional orchestration.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 14

Your organization needs to enforce multi-factor authentication (MFA) for all users accessing Microsoft Entra ID integrated applications. However, users in the finance department should be exempted from MFA when accessing a specific legacy financial app that does not support modern authentication. What should you design?

Accepted Answer

Create a Conditional Access policy that requires MFA for all cloud apps except the legacy app. Option B is correct because Conditional Access policies allow granular control, including exemption for specific applications. Option A is wrong because security defaults would apply MFA to all users and apps with no exemption. Option C is wrong because per-user MFA is outdated and does not offer app-based exemptions. Option D is wrong because Identity Protection is for risk-based policies, not app exemptions.

Answer

Enable security defaults for all users

Answer

Enable per-user MFA and exclude the finance department

Answer

Use Microsoft Entra Identity Protection to require MFA based on risk

Question 15

Your organization is implementing a zero-trust security model. You need to design a solution that continuously verifies user identity, device compliance, and access context before granting access to corporate resources. The solution should also support risk-based policies. Which Microsoft security capability should be at the core of this design?

Accepted Answer

Microsoft Entra ID Conditional Access. Option C is correct because Microsoft Entra ID Conditional Access is the core policy engine that evaluates signals (user, device, location, risk) to enforce access decisions. Option A is wrong because Microsoft Defender for Identity is a threat detection solution for on-premises AD, not a policy engine. Option B is wrong because Microsoft Intune manages devices but does not enforce conditional access policies. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR, not an access control engine.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Intune