SC-100 Design security operations, identity, and compliance capabilities Practice Test 9 — 15 Questions

Question 1

Your organization uses Microsoft Purview to govern sensitive data. You need to design a solution that automatically detects and protects credit card numbers in emails and documents stored in Microsoft 365. The solution should also provide data loss prevention (DLP) policy tips to users when they try to share such data externally. What should you configure?

Accepted Answer

Microsoft Purview Data Loss Prevention policies. Option A is correct because Microsoft Purview DLP policies can detect sensitive info types (e.g., credit card numbers) and show policy tips to users. Option B is wrong because sensitivity labels are for classification and protection but do not provide real-time DLP policy tips. Option C is wrong because Microsoft Information Protection (MIP) unified labeling is part of Purview but not specifically for DLP tips. Option D is wrong because Microsoft 365 compliance center is the portal, not a specific feature.

Answer

Sensitivity labels with auto-classification

Answer

Microsoft 365 compliance center

Answer

Microsoft Information Protection unified labeling

Question 2

Your company is deploying a new line-of-business application in Azure that must comply with PCI DSS. The application uses Azure SQL Database. You need to design a solution to encrypt sensitive data at rest and in transit, and to audit access to sensitive columns. Which combination of Microsoft security capabilities should you recommend?

Accepted Answer

Transparent Data Encryption, Always Encrypted, and Azure SQL Auditing. Option B is correct because Transparent Data Encryption (TDE) encrypts the SQL database at rest, Always Encrypted protects sensitive columns in transit and at rest by ensuring encryption keys are never exposed to the database engine, and Azure SQL Auditing logs all access to sensitive columns for compliance with PCI DSS requirements.

Answer

Dynamic Data Masking and Azure SQL Firewall rules

Answer

Azure Policy and Microsoft Defender for Cloud

Answer

Azure Storage Service Encryption and Azure Key Vault

Question 3

Your organization wants to use Microsoft Defender XDR to automatically investigate and respond to alerts. You need to ensure that the solution can autonomously remediate confirmed threats on endpoints, such as quarantining files and isolating devices. What should you enable?

Accepted Answer

Microsoft Defender for Endpoint. Option B is correct because Microsoft Defender for Endpoint includes automated investigation and remediation capabilities that can quarantine files and isolate devices. Option A is wrong because Microsoft Defender for Office 365 focuses on email and collaboration threats. Option C is wrong because Microsoft Defender for Cloud Apps is for SaaS app security. Option D is wrong because Microsoft Defender for Identity is for on-premises AD threats.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Question 4

Your organization uses Microsoft Sentinel as its SIEM. You receive a large number of low-severity alerts from various sources, overwhelming the security operations team. You need to design a solution to reduce alert fatigue while ensuring that critical incidents are not missed. The solution should also automatically collect feedback from analysts when they close an incident. What should you implement?

Accepted Answer

Tune analytics rules to generate incidents only for high-fidelity alerts and use automation rules to collect feedback on incident closure. Option D is correct because Sentinel's analytics rules can be configured to create incidents only for high-fidelity alerts, and automation rules can be used to prompt analysts for feedback when closing incidents. Option A is wrong because simply increasing severity thresholds may miss critical events. Option B is wrong because creating incidents for all alerts would increase fatigue. Option C is wrong because a playbook for feedback is useful but does not reduce alert volume.

Answer

Create a separate analytics rule for each severity level

Answer

Implement a playbook that automatically closes low-severity alerts and collects feedback

Answer

Increase the severity threshold for all analytics rules

Question 5

Your company uses Microsoft Intune to manage corporate devices. You need to design a compliance policy that requires devices to have a minimum OS version, be encrypted, and not be jailbroken or rooted. Additionally, you want to automatically block non-compliant devices from accessing corporate email. What should you configure?

Accepted Answer

Intune compliance policies and Conditional Access. Option C is correct because Intune compliance policies define device requirements (OS version, encryption, jailbreak status), and Conditional Access policies can block access to corporate resources like email for non-compliant devices. Option A is wrong because configuration profiles set settings but do not enforce access control. Option B is wrong because device enrollment restrictions limit which devices can enroll, not access after enrollment. Option D is wrong because app protection policies protect data at the app level, not device-level compliance.

Answer

Device configuration profiles and Azure AD join

Answer

App protection policies and Microsoft Defender for Endpoint

Answer

Device enrollment restrictions

Question 6

Your organization is required to retain all Microsoft Teams chat messages for 7 years due to regulatory compliance. You need to design a solution that automatically retains and, if needed, e-discovery searches these messages. What should you configure?

Accepted Answer

Microsoft Purview retention policies and eDiscovery. Option A is correct because Microsoft Purview retention policies can be applied to Teams chats to retain them for a specified period, and eDiscovery can search retained messages. Option B is wrong because sensitivity labels classify but do not enforce retention. Option C is wrong because DLP policies prevent data loss, not retention. Option D is wrong because Azure Policy applies to Azure resources, not Microsoft 365 data.

Answer

Microsoft Purview Data Loss Prevention policies

Answer

Azure Policy

Answer

Sensitivity labels auto-labeling

Question 7

Your organization is designing a privileged access strategy using Microsoft Entra ID. Which TWO configurations should be part of the design to protect privileged accounts?

Accepted Answer

Require multi-factor authentication for all administrative roles via Conditional Access. Options A and C are correct. Option A: Conditional Access with MFA for admin roles reduces risk of credential theft. Option C: Privileged Identity Management (PIM) provides just-in-time access and approval workflows. Option B is wrong because security defaults enforce MFA for all users but lack granularity for privileged roles. Option D is wrong because self-service password reset is not specific to privileged accounts and does not protect against misuse. Option E is wrong because disabling MFA would weaken security.

Answer

Enable security defaults

Answer

Enable self-service password reset for admins

Answer

Disable multi-factor authentication for emergency admin accounts

Question 8

Your company is deploying Microsoft Defender XDR. You need to design a solution that uses advanced hunting to proactively search for threats. Which THREE data sources should be included in the advanced hunting schema to enable comprehensive threat hunting across endpoints, identities, and cloud apps?

Accepted Answer

CloudAppEvents. Options A, B, and D are correct because they represent key data sources in Defender XDR advanced hunting. Option A: IdentityInfo provides identity context. Option B: DeviceEvents captures endpoint activities. Option D: CloudAppEvents provides cloud app activity. Option C is wrong because EmailEvents is part of Defender for Office 365 but not a core advanced hunting table in Defender XDR; it is available in Microsoft 365 Defender advanced hunting but the question asks for core sources. Option E is wrong because AzureActivity is not part of Defender XDR schema; it is in Azure Monitor.

Answer

EmailEvents

Answer

AzureActivity

Question 9

Your organization needs to comply with GDPR. You need to design a data protection strategy using Microsoft Purview. Which THREE capabilities should you include?

Accepted Answer

Data classification and labeling. Options B, C, and D are correct. Option B: Data classification and labeling helps identify personal data. Option C: Data Loss Prevention (DLP) prevents unauthorized sharing of personal data. Option D: Data subject requests (DSR) management is a GDPR requirement. Option A is wrong because eDiscovery is for legal holds, not GDPR specifically. Option E is wrong because Azure Policy is for Azure resource compliance, not data protection.

Answer

Azure Policy

Answer

eDiscovery

Question 10

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud automation resource. You want the automation to trigger a playbook in Microsoft Sentinel when a high-severity security assessment is found. Based on the exhibit, what is the missing configuration?

Accepted Answer

The action type should be 'LogicApp' instead of 'EventHub'. Option B is correct because the exhibit shows the automation sends to EventHub, but to trigger a Sentinel playbook, the action type should be 'LogicApp' with the playbook's trigger URL. Option A is wrong because the source is already set to Assessments. Option C is wrong because the severity filter is correctly set to High. Option D is wrong because the API version is not the issue; the action type is wrong.

Answer

The severity filter should be 'Low' to capture all assessments

Answer

The eventSource should be 'Alerts' instead of 'Assessments'

Answer

The API version should be '2020-01-01'

Question 11

Refer to the exhibit. You are analyzing a KQL query in Microsoft Defender XDR advanced hunting. The query is intended to identify the top 10 devices by the number of executable process creations in the last 7 days. However, the results are showing only a few entries with low counts. What is the most likely issue?

Accepted Answer

The ActionType filter is likely missing the correct value for process creation. Option C is correct because the query filters on ActionType == "ProcessCreate", but the correct field might be "ProcessCreated" or different enumeration; also, FileName endswith ".exe" might miss processes with full paths. Option A is wrong because the take operator works but the query may not be returning the expected data due to filtering. Option B is wrong because bin(Timestamp, 1h) is valid. Option D is wrong because the summarize should work on DeviceName.

Answer

The 'summarize' statement should include DeviceName in the aggregate

Answer

The 'take' operator is not appropriate for this aggregation

Answer

The 'bin' function on Timestamp is incorrect

Question 12

Refer to the exhibit. You are reviewing an Azure Policy definition for GDPR compliance. The policy is intended to audit storage accounts that do not have encryption enabled. However, the policy is not evaluating correctly. What is the most likely reason?

Accepted Answer

The effect should be 'Audit' instead of 'auditIfNotExists'. Option B is correct because the effect 'auditIfNotExists' requires a resource to audit if a dependent resource does not exist. However, storage account encryption is a property of the storage account itself, not a separate resource. The policy should use 'Audit' effect with a condition that checks if encryption is disabled. Option A is wrong because 'Indexed' mode is appropriate for storage accounts. Option C is wrong because the policy is built-in but the snippet shows custom properties. Option D is wrong because the field type is correct.

Answer

The field 'type' should be 'Microsoft.Storage/storageAccounts/encryption'

Answer

The policy type should be 'Custom'

Answer

The policy mode should be 'All' instead of 'Indexed'

Question 13

Your organization deploys Microsoft Sentinel and wants to automatically respond to phishing emails reported by users. You need to recommend a solution that creates an incident in Sentinel and blocks the email sender in Exchange Online. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Option A is correct because automation rules in Microsoft Sentinel can trigger playbooks when an incident is created. Option B is wrong because analytics rules create incidents from data, not from existing incidents. Option C is wrong because watchlists are for reference data, not automation. Option D is wrong because UEBA is for user behavior analytics.

Answer

Use a watchlist to store known phishing senders.

Answer

Enable UEBA to detect anomalous email behavior.

Answer

Create an analytics rule that queries user-reported phishing data.

Question 14

A company uses Microsoft Defender for Cloud Apps to monitor SaaS apps. They discover that a user is downloading large volumes of data from SharePoint Online from an atypical IP address. The security team wants to automatically suspend the user's access to all cloud apps. What is the most efficient way to achieve this?

Accepted Answer

Create a session policy that blocks the user's session based on the anomaly.. Option B is correct because session policies enforce real-time controls and can block access. Option A is wrong because file policies control data at rest, not access. Option C is wrong because app tags categorize apps. Option D is wrong because OAuth app policies manage third-party app permissions.

Answer

Tag the user as suspicious using an app tag.

Answer

Create a file policy that triggers when a user downloads many files.

Answer

Create an OAuth app policy to revoke permissions.

Question 15

Your organization uses Microsoft Intune for mobile device management. Employees report they cannot access corporate email on their personal iOS devices. The helpdesk confirms devices are enrolled and compliant. What should you check first?

Accepted Answer

Verify the conditional access policy for Exchange Online includes iOS devices.. Option A is correct because conditional access policies in Entra ID enforce access rules for cloud apps like Exchange Online. Option B is wrong because compliance policies define device requirements, not access. Option C is wrong because app protection policies manage data within apps. Option D is wrong because device configuration profiles set device settings but not access.

Answer

Confirm the device configuration profile includes email settings.

Answer

Review the app protection policy for Outlook.

Answer

Ensure the compliance policy allows iOS devices.