SC-100 Design security operations, identity, and compliance capabilities Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. What does this policy accomplish?

Accepted Answer

Blocks all users when sign-in risk is high.. The policy grants access only when sign-in risk is not high, effectively blocking all users when sign-in risk is high. Option A is incorrect because the policy does not require MFA; it simply blocks access. Option B is incorrect because the policy blocks all users, not specifically external users. Option D is incorrect because the policy blocks based on sign-in risk, not on specific applications.

Answer

Requires MFA for high-risk sign-ins.

Answer

Blocks external users from high-risk sign-ins.

Answer

Blocks sign-ins from specific applications.

Question 2

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

To enrich Mimikatz alerts with user account names.. The query joins security alerts with identity information to add the user account name to each Mimikatz-related alert, enriching the alert context. Option A is wrong because the query is not aggregating or summarizing alerts; it's adding a field. Option B is wrong because the query itself does not create an automation rule; it is a query that could be used within a rule. Option D is wrong because while enrichment may aid in detecting lateral movement, the primary purpose is enrichment, not detection of lateral movement.

Answer

To summarize Mimikatz alerts by account.

Answer

To create an automation rule based on the query.

Answer

To detect lateral movement after a Mimikatz alert.

Question 3

Refer to the exhibit. You are reviewing a Microsoft Purview Data Map resource pattern for scanning. What is this pattern intended to do?

Accepted Answer

Automatically apply sensitivity labels to resources matching the pattern.. The pattern targets all *.onmicrosoft.com resources in Global and USGov regions and applies sensitivity labels. Option A is wrong because it applies labels, not just scans. Option B is wrong because it does not block access. Option D is wrong because it does not enforce retention.

Answer

Scan all resources in the onmicrosoft.com domain for classification.

Answer

Block access to resources in USGov regions.

Answer

Enforce retention policies on scanned resources.

Question 4

Your organization uses Microsoft Sentinel for security operations. You need to ensure that all incidents related to a specific critical asset are automatically assigned to the senior SOC analyst. The assignment should occur as soon as the incident is created. What should you configure?

Accepted Answer

Create an automation rule that sets the incident owner to the senior SOC analyst.. Automation rules in Microsoft Sentinel can directly set the incident owner upon creation without requiring a playbook. This is the simplest and most efficient method for immediate assignment, as automation rules run automatically when an incident is created and can modify incident properties like owner.

Answer

Modify the analytics rule to include a custom details field for owner.

Answer

Create a playbook and trigger it from an automation rule.

Answer

Configure a workbook to display incidents and manually assign them.

Question 5

Your company uses Microsoft Purview Compliance Manager to track compliance with regulatory standards. You need to generate a report that shows the percentage of controls that are not yet implemented for the PCI DSS standard. What should you do?

Accepted Answer

In Compliance Manager, open the PCI DSS assessment and view the control status.. In Microsoft Purview Compliance Manager, you can open the PCI DSS assessment and view the control status, which includes a breakdown of controls by implementation status, including the percentage not yet implemented. Option B is incorrect because Data Lifecycle Management policies are for data retention and deletion, not for compliance reporting on PCI DSS. Option C is incorrect because Compliance Manager provides pre-built assessments for standards like PCI DSS; you do not need to create a custom risk assessment for this purpose. Option D is incorrect because Communication Compliance policies are designed to detect policy violations in communications, not to track PCI DSS control implementation.

Answer

Create a Data Lifecycle Management policy for PCI DSS.

Answer

Create a custom risk assessment in Compliance Manager for PCI DSS.

Answer

Configure a Communication Compliance policy to monitor PCI DSS compliance.

Question 6

You are designing a security operations strategy for a multinational organization. The SOC team needs to correlate alerts from multiple sources including Microsoft Defender for Cloud, Microsoft Sentinel, and third-party firewalls. Which solution should you use as the primary platform for correlation?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM that can ingest logs from multiple sources, including Defender for Cloud, Microsoft 365 Defender, and third-party firewalls, and correlate alerts across these sources. Option A is incorrect because Defender for Cloud is a CSPM, not a SIEM. Option B is incorrect because Microsoft 365 Defender is a unified protection suite for endpoint and email, but it cannot correlate alerts from third-party firewalls. Option C is incorrect because Azure Monitor is for infrastructure monitoring and metrics, not a SIEM for correlation of alerts from multiple security sources.

Answer

Microsoft Defender for Cloud

Answer

Microsoft 365 Defender

Answer

Azure Monitor

Question 7

Your organization uses Microsoft Entra ID. You need to ensure that when a user's risk level is assessed as high by Identity Protection, the user is automatically blocked from signing in. The block should apply immediately. What should you configure?

Accepted Answer

Configure a Conditional Access policy that blocks access when sign-in risk is high.. A Conditional Access policy can enforce a block on sign-in when the sign-in risk level is high, using the 'Block access' grant. This is the recommended method for immediate blocking. Option B is incorrect because enabling self-service password reset does not block sign-ins; it allows users to reset passwords. Option C is incorrect because an access review does not block sign-ins; it only reviews access periodically. Option D is incorrect because a user risk policy in Identity Protection can block sign-in based on user risk, but it is not as immediate or granular as Conditional Access; the scenario specifies 'sign-in risk' as the trigger, not user risk, making Conditional Access the correct choice.

Answer

Enable self-service password reset for high-risk users.

Answer

Create an access review to require re-certification of high-risk users.

Answer

Configure a user risk policy in Identity Protection to block sign-in.

Question 8

Refer to the exhibit. You have deployed the automation shown in the exhibit in Microsoft Defender for Cloud. The automation triggers a Logic App when a high-severity alert is generated. Users report that the Logic App is not being triggered for some high-severity alerts. What is the most likely cause?

Accepted Answer

Some high-severity alerts are generated from a different event source not included in the 'sources' array.. The most likely cause is that some high-severity alerts originate from a different event source not included in the automation's 'sources' array. In Microsoft Defender for Cloud, automations can trigger on specific event sources (e.g., 'Alerts', 'SecurityPolicies', 'RegulatoryComplianceAssessment'). If the automation is configured only for 'Alerts', alerts from other sources will not trigger the Logic App. Option A is incorrect because using 'Equals' for severity is appropriate when the severity value is 'High'; 'Contains' would be incorrect. Option B is incorrect because a wrong Logic App resource ID would prevent all triggers, not just some. Option D is incorrect because the automation should trigger on 'Alerts', not 'SecurityPolicies'.

Answer

The trigger condition uses 'Equals' instead of 'Contains' for severity.

Answer

The Logic App resource ID is incorrect.

Answer

The automation is configured to trigger on 'Alerts' but should be 'SecurityPolicies'.

Question 9

Your organization uses Microsoft Intune for mobile device management. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device.. Conditional Access in Microsoft Entra ID can enforce device compliance for access. Option A is incorrect because app protection policies protect data within apps but do not control device-level access. Option B is incorrect because device configuration policies define settings but do not enforce compliance-based access. Option D is incorrect because device compliance policies define compliance requirements, but Conditional Access is needed to enforce them.

Answer

Configure an app protection policy in Intune.

Answer

Create a device configuration policy in Intune.

Answer

Create a device compliance policy in Intune.

Question 10

Your company uses Microsoft 365 Copilot for Security. You need to ensure that only users in the 'SecurityAnalysts' group can access the Copilot for Security portal. All other users should not see the portal in their Microsoft 365 app launcher. What should you configure?

Accepted Answer

In the Copilot for Security settings, restrict access to the 'SecurityAnalysts' group.. In the Copilot for Security settings, you can restrict access to specific security groups, which both controls access and hides the portal from the app launcher for unauthorized users. Option A is incorrect because removing and reassigning licenses would restrict access, but it is not the intended configuration for hiding the app and may affect other services. Option B is incorrect because Conditional Access policies block sign-in but do not remove the portal from the app launcher. Option C is incorrect because administrative units are used to delegate administrative permissions, not to control end-user application visibility.

Answer

Remove the Copilot for Security license from all users and assign only to the group.

Answer

Create a Conditional Access policy to block access to Copilot for Security for users not in the group.

Answer

Configure an Entra ID administrative unit to restrict access.

Question 11

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You need to create an analytics rule that generates an incident when a user is reported as compromised by Microsoft Defender for Identity. The rule should use the most efficient method to get this data. What should you use as the data source?

Accepted Answer

The SecurityAlert table with a filter for Defender for Identity.. The SecurityAlert table contains security alerts from various sources, including Microsoft Defender for Identity, when ingested via the Microsoft 365 Defender connector. By filtering for Defender for Identity alerts, you can create an analytics rule that triggers an incident when a user is reported as compromised. This is the most efficient method because the alerts are already available in this table. Option B (DeviceEvents) is from Advanced Hunting and is not directly available in Sentinel tables; it requires running queries against the Microsoft 365 Defender advanced hunting schema, which is less efficient for creating analytics rules. Option C (OfficeActivity) contains Office 365 audit logs, not security alerts. Option D (IdentityInfo) contains identity information such as user details, but not alerts or compromise status.

Answer

The DeviceEvents table from Advanced Hunting.

Answer

The OfficeActivity table.

Answer

The IdentityInfo table.

Question 12

Your company uses Microsoft Purview Data Loss Prevention (DLP). You need to ensure that credit card numbers are not shared externally via email. What should you configure?

Accepted Answer

Create a DLP policy that detects credit card numbers and blocks external sharing.. DLP policies are designed to detect sensitive information, such as credit card numbers, and enforce actions like blocking external sharing. Option A is incorrect because sensitivity labels primarily classify and protect content (e.g., encryption) but do not directly block sharing; DLP policies handle that. Option C is incorrect because auto-labeling applies labels automatically but does not enforce blocking; DLP policies are needed for enforcement. Option D is incorrect because retention policies manage data retention periods, not sharing restrictions.

Answer

Create a sensitivity label that applies encryption to emails containing credit card numbers.

Answer

Configure auto-labeling for credit card numbers in Microsoft 365.

Answer

Create a retention policy for credit card data.

Question 13

Your organization uses Microsoft Defender for Cloud Apps. You need to identify users who are downloading large amounts of data from a sanctioned cloud app in a short period. What should you configure?

Accepted Answer

Create an anomaly detection policy for impossible travel or unusual activity.. Anomaly detection policies in Microsoft Defender for Cloud Apps are designed to detect unusual activities, including large data downloads from sanctioned apps, by analyzing behavioral patterns over time. Option A is correct because it leverages built-in anomaly detection for volume-based alerts. Option B (app permission policy) manages OAuth app permissions, not download volume. Option C (activity policy) can monitor specific activities but is less specialized for mass download detection. Option D (file policy) focuses on file attributes and metadata, not download quantity.

Answer

Create an app permission policy to block downloads.

Answer

Create an activity policy to monitor downloads.

Answer

Create a file policy to detect mass download.

Question 14

Which TWO actions should you take to implement a Zero Trust security strategy for identity and access? (Choose two.)

Accepted Answer

Require Multi-Factor Authentication for all users.. Requiring Multi-Factor Authentication (MFA) for all users is a foundational Zero Trust principle that verifies identity beyond just a password, ensuring that even if credentials are compromised, an additional factor (e.g., a one-time passcode or biometric) is needed to authenticate. This directly addresses the 'verify explicitly' pillar of Zero Trust, reducing the risk of lateral movement and unauthorized access.

Answer

Use VPN for remote access to the corporate network.

Answer

Rely on strong passwords only.

Answer

Create shared accounts for temporary workers.

Question 15

Which THREE capabilities are part of Microsoft Purview's insider risk management solution? (Choose three.)

Accepted Answer

Forensic evidence capturing user activity on devices.. Options B, D, and E are correct. Option B is correct because insider risk management includes forensic evidence (activity explorer) that captures user activity on devices for investigation. Option D is correct because policy templates for data theft by departing users are a predefined template within insider risk management. Option E is correct because indicators in insider risk management detect unauthorized data exfiltration behaviors. Option A is incorrect because communication compliance is a separate Microsoft Purview solution focused on regulatory compliance monitoring. Option C is incorrect because Data Loss Prevention (DLP) is a separate solution for blocking sensitive data, not a capability within insider risk management.

Answer

Communication compliance policies for monitoring emails.

Answer

Data Loss Prevention policies that block sensitive data.