SC-100 Design security operations, identity, and compliance capabilities Practice Test 8 — 15 Questions

Question 1

Your organization uses Microsoft Purview to protect sensitive data. You need to create a sensitivity label that automatically encrypts documents containing credit card numbers when they are shared externally. Which configuration should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an auto-labeling policy that applies a label with encryption for external sharing. Auto-labeling in Purview can be configured to apply a sensitivity label based on sensitive info types like credit card numbers. The label should have encryption enabled for external sharing. The other options describe different scenarios: manual labeling, default labeling, or classification without encryption.

Answer

Create a trainable classifier to detect credit cards

Answer

Create a default label policy for SharePoint

Answer

Create a manual sensitivity label that users apply

Question 2

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only compliant devices can access Exchange Online. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access with the 'Require device to be marked as compliant' grant. Conditional Access policies in Entra ID can require that devices be marked as compliant with Intune compliance policies before granting access to cloud apps like Exchange Online. The other options are not correct: Device Compliance is a policy in Intune, not an Entra feature; MFA is authentication; and Azure AD Join is for device identity.

Answer

Azure AD device registration

Answer

Multi-factor authentication

Answer

Intune device compliance policy

Question 3

Your organization is deploying Microsoft Defender for Cloud Apps. Which THREE capabilities are included in Defender for Cloud Apps? (Select three.)

Accepted Answer

Session controls. Session controls are a core capability of Microsoft Defender for Cloud Apps, enabling real-time monitoring and control of user app sessions via reverse proxy integration. This allows administrators to enforce policies like blocking downloads or read-only access for sensitive data, leveraging Conditional Access App Control to intercept traffic to sanctioned SaaS apps.

Answer

Data Loss Prevention (DLP) policies

Answer

Conditional Access

Question 4

Your organization uses Microsoft Sentinel. You need to design a solution to detect and respond to threats across on-premises and cloud workloads. Which TWO components are essential for this? (Select two.)

Accepted Answer

Analytics rules. Data connectors ingest logs from various sources, and analytics rules detect threats. Playbooks automate response, but are not essential for detection. Workbooks visualize data, and UEBA enriches analytics but is not a separate essential component.

Answer

UEBA

Answer

Workbooks

Answer

Playbooks

Question 5

Your organization is implementing Microsoft Entra ID governance. Which TWO features are part of Microsoft Entra ID Governance? (Select two.)

Accepted Answer

Privileged Identity Management. Privileged Identity Management (PIM) and Entitlement Management are both core features of Microsoft Entra ID Governance. PIM provides time-bound and approval-based access to elevated roles, while Entitlement Management enables automated access request workflows, catalogs, and policies. Access Reviews is also a governance feature, but the question limits selection to two; the intended answer set commonly focuses on PIM and Entitlement Management for governance capabilities.

Answer

Authentication methods policy

Answer

Conditional Access

Answer

Access reviews

Question 6

Your organization uses Microsoft Sentinel for security operations. You need to ensure that incident investigations automatically enrich alerts with relevant user and device information from Microsoft Defender XDR and Microsoft Entra ID. What should you configure?

Accepted Answer

Enable User and Entity Behavior Analytics (UEBA) and configure entity behavior settings.. Enabling User and Entity Behavior Analytics (UEBA) and configuring entity behavior settings in Microsoft Sentinel automatically enriches alerts by linking entities (users, devices) with relevant information from Microsoft Defender XDR and Microsoft Entra ID. Option A is incorrect because Fusion detection is for detecting multistage attacks, not for enrichment. Option B is incorrect because watchlists are static reference data and do not provide automatic enrichment. Option C is incorrect because automation rules and playbooks can be used for response but not for automatic enrichment of alerts with entity information.

Answer

Enable Fusion detection for multistage attacks.

Answer

Create watchlists for user and device information and reference them in analytics rules.

Answer

Configure automation rules to trigger a playbook on alert creation.

Question 7

You are designing a security operations solution for a multinational organization using Microsoft Sentinel. The organization has multiple Azure subscriptions, each with its own Log Analytics workspace. You need to centralize incident management while minimizing data egress costs. What should you recommend?

Accepted Answer

Use a single Log Analytics workspace for all subscriptions and configure Sentinel in that workspace.. The recommended solution is to use a single Log Analytics workspace for all subscriptions and configure Microsoft Sentinel in that workspace. This centralizes all logs and incidents in one place, making incident management uniform across the organization. It also minimizes data egress costs because ingesting data into a single workspace avoids data transfer charges that would occur if logs were sent to multiple workspaces or exported to external systems. Option C (cross-workspace queries) is not a full solution for centralized incident management because each workspace maintains its own incidents independently. Option A (workspace per region) would scatter incidents across workspaces, complicating centralized management. Option B (export to third-party SIEM) introduces additional cost and latency.

Answer

Deploy a Sentinel workspace in each region and use cross-workspace views.

Answer

Export all logs to a third-party SIEM using Azure Event Hubs.

Answer

Configure Azure Monitor cross-workspace queries to correlate incidents.

Question 8

Your organization uses Microsoft Intune for mobile device management. You need to ensure that users can access corporate email on their personal iOS devices only if the device is enrolled in Intune and compliant with security policies. What should you configure?

Accepted Answer

Configure a conditional access policy in Microsoft Entra ID requiring compliant device.. A Conditional Access policy in Microsoft Entra ID can require that the device is marked as compliant in Intune before granting access to corporate resources like email. This policy enforces both enrollment and compliance, as the device must be enrolled and pass the compliance checks (e.g., passcode, encryption) to be considered compliant. Option A is wrong because a device configuration policy only enforces settings like passcode and encryption but does not directly control access based on compliance. Option B is wrong because an app protection policy (APP) focuses on app-level data protection, does not require device enrollment in Intune, and does not enforce full device compliance. Option D is wrong because a device compliance policy identifies whether a device is compliant but does not enforce access control; it must be combined with a Conditional Access policy to block noncompliant devices.

Answer

Configure a device configuration policy to enforce passcode and encryption.

Answer

Create an app protection policy for iOS requiring managed apps to be enrolled and compliant.

Answer

Create a device compliance policy for iOS and assign it to all users.

Question 9

Your organization is planning to migrate from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can use the same passwords for both on-premises and cloud resources without having to change them. What should you implement?

Accepted Answer

Microsoft Entra Connect password hash synchronization.. Password hash synchronization (PHS) synchronizes password hashes from on-premises Active Directory to Microsoft Entra ID, allowing users to use the same passwords for both on-premises and cloud resources without having to change them. Option A (Microsoft Entra Cloud Sync) is used for syncing users, groups, and contacts from on-premises to Entra ID but does not include password hash synchronization by default; it is primarily for directory synchronization, not password sync. Option B (Federation with on-premises AD FS) enables single sign-on but does not sync passwords; users authenticate against on-premises AD FS. Option D (Microsoft Entra Connect pass-through authentication) allows users to sign in using the same password but validates passwords against on-premises Active Directory without syncing password hashes; however, it does not provide the ability to use the same password for cloud-only resources if the on-premises server is unavailable, while password hash synchronization provides offline access.

Answer

Microsoft Entra Cloud Sync.

Answer

Federation with on-premises AD FS.

Answer

Microsoft Entra Connect pass-through authentication.

Question 10

Your organization uses Microsoft Purview to protect sensitive data. You need to create a sensitivity label that automatically encrypts documents containing credit card numbers when they are shared externally. Which configuration should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview account with scans for all data sources.. Microsoft Purview (the unified data governance service) supports scanning and classifying data across multi-cloud and on-premises sources. Option B is wrong because Azure Data Catalog is a legacy service that does not support automatic classification and labeling. Option C is wrong because Azure Purview (legacy) is no longer the current service name; it has been rebranded as Microsoft Purview. Option D is wrong because Microsoft Information Protection scanner is for labeling and protection, not for creating a unified data catalog.

Answer

Azure Data Catalog with custom classification.

Answer

Azure Purview (legacy) with multi-cloud scanning.

Answer

Microsoft Information Protection scanner on each source.

Question 11

Your organization uses Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing the Azure portal. What is the simplest way to configure this?

Accepted Answer

Create a conditional access policy targeting the Azure portal app requiring MFA.. A conditional access policy can be targeted to the Azure portal app and require MFA. Option A is wrong because per-user MFA is legacy and less flexible. Option B is wrong because security defaults apply to all apps, not just Azure portal, and may be too broad. Option D is wrong because MFA registration policy ensures registration but does not enforce MFA.

Answer

Enable per-user MFA for all users.

Answer

Enable security defaults.

Answer

Configure Microsoft Entra ID MFA registration policy.

Question 12

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to automatically create incidents in Sentinel for high-severity alerts from Defender XDR. You also want to suppress low-severity alerts to reduce noise. What should you configure?

Accepted Answer

Configure the Microsoft Defender XDR connector to create incidents only for high severity.. The Microsoft Defender XDR connector includes an incident creation setting that can be configured to create incidents only for high-severity alerts, which meets the requirement and suppresses low-severity alert noise. A scheduled analytics rule is not the recommended approach and can cause duplicate incidents.

Answer

Configure an automation rule to create incidents for all alerts.

Answer

Create a playbook that triggers on alerts and creates incidents.

Answer

Create a scheduled analytics rule that queries Defender XDR alerts with severity filter and creates incidents.

Question 13

Your organization uses Microsoft 365 and wants to protect against phishing attacks. Which TWO configurations should you recommend?

Accepted Answer

Configure DMARC policy to reject spoofed emails.. Configuring a DMARC policy to reject spoofed emails is a key email authentication method that directly prevents email spoofing, a common vector for phishing attacks. Option C is correct because Safe Links and Safe Attachments in Microsoft Defender for Office 365 protect users from malicious URLs and attachments, which are often used in phishing. Option A is incorrect because while anti-spoofing protection helps, DMARC is a more comprehensive and recommended standard for spoofing prevention. Option D is incorrect because MFA addresses authentication security, not phishing directly. Option E is incorrect because DLP focuses on data loss prevention, not phishing.

Answer

Enable anti-spoofing protection in Exchange Online Protection.

Answer

Require MFA for all external email access.

Answer

Configure DLP policies to detect sensitive data in email.

Question 14

Your organization is implementing Microsoft Entra ID governance. Which THREE capabilities should you include to manage the identity lifecycle and access reviews?

Accepted Answer

Microsoft Entra Access Reviews.. Access Reviews allow periodic review and attestation of access rights, ensuring access remains appropriate. Option C is correct because Entitlement Management automates access requests, approvals, and assignments, managing the access lifecycle. Option D is correct because Lifecycle Workflows automate joiner/mover/leaver processes, managing identity lifecycle events. Option A is incorrect because Identity Protection focuses on detecting and mitigating identity risks, not lifecycle management. Option E is incorrect because Privileged Identity Management (PIM) is designed for managing and auditing privileged roles, not general identity lifecycle or access reviews.

Answer

Microsoft Entra Identity Protection.

Answer

Privileged Identity Management (PIM).

Question 15

Your organization uses Microsoft Purview to comply with regulatory requirements. Which TWO features should you use to manage data retention and deletion?

Accepted Answer

Data lifecycle management policies (retention policies).. Data lifecycle management policies (retention policies) in Microsoft Purview allow you to automatically retain or delete data at the container level (e.g., SharePoint sites, Exchange mailboxes, Teams channel messages) based on regulatory requirements. They enforce retention and deletion actions without user intervention, making them essential for compliance with data governance mandates.

Answer

Sensitivity labels.

Answer

Data Loss Prevention (DLP) policies.

Answer

Trainable classifiers.