SC-100 Design security operations, identity, and compliance capabilities — Timed 15 Questions

Question 1

Your organization uses Microsoft Sentinel to aggregate logs from on-premises and cloud sources. You need to reduce the cost of data ingestion while ensuring security-critical logs are retained for at least one year. What should you do?

15 minute time limit — choose an answer to begin.

Accepted Answer

Ingress security-critical logs to the Analytics logs tier with 365-day retention, and other logs to the Auxiliary logs tier with shorter retention. Use the Analytics logs tier for security-critical logs because it provides full KQL query capabilities and supports setting 365-day retention to meet compliance. For other logs, use the Auxiliary logs tier (or Basic logs) to reduce ingestion costs while accepting shorter retention and limited query capabilities. This tiered approach balances cost and security requirements.

Answer

Archive all logs to Azure Storage after 90 days

Answer

Use the Basic logs tier for all logs and set retention to 365 days

Answer

Set the default retention to 30 days and export logs to Log Analytics Workspace

Question 2

Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in emails. What should you configure?

Accepted Answer

Safe Links policy. Safe Links policy is the correct answer because it specifically protects users from malicious links in emails by scanning URLs at the time of click, checking against Microsoft's threat intelligence, and optionally rewriting links to route clicks through the Safe Links service. This is the dedicated Defender for Office 365 feature designed to mitigate link-based attacks in email messages.

Answer

Anti-malware policy

Answer

Anti-phishing policy

Answer

Safe Attachments policy

Question 3

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a unified security operations platform. Which THREE capabilities should you enable?

Accepted Answer

Microsoft Defender XDR incident integration with Sentinel. Microsoft Defender XDR incident integration with Sentinel creates a unified security operations platform by automatically synchronizing high-fidelity alerts and incidents from Defender XDR into Sentinel. This enables security teams to correlate endpoint, email, identity, and cloud app signals within a single SIEM, reducing alert fatigue and accelerating incident response through automated orchestration.

Answer

Azure Policy for security controls

Answer

Microsoft Purview Information Protection

Question 4

Your organization uses Microsoft Entra ID and needs to implement a Zero Trust identity strategy. Which THREE principles should you apply?

Accepted Answer

Use least privilege access. Least privilege access is a core Zero Trust principle that ensures users, devices, and services are granted only the minimum permissions necessary to perform their tasks. In Microsoft Entra ID, this is implemented through features like Privileged Identity Management (PIM), Conditional Access policies, and role-based access control (RBAC) to reduce the attack surface and limit lateral movement.

Answer

Trust implicitly

Answer

Use a single authentication method

Question 5

Your company uses Microsoft Defender for Cloud to manage security posture across hybrid workloads. You need to ensure that critical vulnerabilities found on Azure VMs are automatically remediated without manual intervention. Which feature should you enable?

Accepted Answer

Enable 'Remediate' for security recommendations in Defender for Cloud. Microsoft Defender for Cloud's 'Remediate' feature allows you to automatically apply the necessary configuration changes or deploy the required patches to fix critical vulnerabilities on Azure VMs without manual intervention. This is achieved by enabling the 'Remediate' option on specific security recommendations, which triggers an automated workflow (often using Azure Policy or a custom script) to resolve the identified issue. This directly addresses the requirement for automatic remediation of critical vulnerabilities.

Answer

File Integrity Monitoring (FIM)

Answer

Microsoft Defender for Cloud's Regulatory Compliance dashboard

Answer

Azure Automation Update Management

Question 6

Your organization uses Microsoft Sentinel to aggregate logs from on-premises and cloud sources. You need to reduce the cost of data ingestion while ensuring security-critical logs are retained for at least one year. What should you do?

15 minute time limit — choose an answer to begin.

Accepted Answer

Entity behavior analytics (UEBA) with automated investigation. Entity behavior analytics (UEBA) with automated investigation is the correct choice because it profiles normal user and entity behavior, then automatically investigates low-fidelity alerts by correlating them with historical baselines. When the investigation confirms malicious activity, it escalates to an incident, reducing noise and manual triage.

Answer

Automation rules with playbooks

Answer

Machine Learning (ML) based anomaly detection

Answer

Custom analytic rules

Question 7

Your company is deploying Microsoft Intune for mobile device management. You need to ensure that corporate data on personally owned devices is protected without affecting the user's personal data. Which Intune feature should you use?

Accepted Answer

App Protection Policies (MAM). App Protection Policies (MAM) are the correct choice because they allow you to manage and protect corporate data within applications on personally owned devices without requiring device enrollment. This ensures that corporate data is encrypted, can be selectively wiped, and is prevented from being copied to personal apps, while leaving the user's personal data untouched.

Answer

Device compliance policies

Answer

Conditional Access for app control

Answer

Windows Autopilot

Question 8

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate using their existing on-premises credentials while gradually moving to cloud-only authentication. Which authentication method should you implement first?

Accepted Answer

Password Hash Synchronization (PHS) with Seamless SSO. Password Hash Synchronization (PHS) with Seamless SSO is the best first step because it syncs password hashes to Microsoft Entra ID, enabling users to authenticate with their on-premises credentials while providing a seamless sign-on experience. It requires minimal infrastructure and supports a gradual transition to cloud-only authentication. Option A (Azure AD Connect) is the tool for synchronization, not an authentication method. Option B (AD FS) is a federation service that is more complex and not needed initially. Option C (Pass-through Authentication) validates passwords on-premises, which is suitable for some scenarios but does not facilitate a gradual move to cloud-only authentication as effectively as PHS with Seamless SSO.

Answer

Azure AD Connect

Answer

Active Directory Federation Services (AD FS)

Answer

Pass-through Authentication (PTA)

Question 9

Your organization is implementing a privileged access strategy using Microsoft Entra ID. You need to provide just-in-time (JIT) access to Azure resources for administrators. Which TWO features should you use?

Accepted Answer

Privileged Access Groups (PAG). Privileged Access Groups (PAG) provide just-in-time activation of group membership that can be assigned to Azure RBAC roles, enabling JIT access to Azure resources. PIM for Azure AD roles is specifically for Azure AD roles and does not directly manage Azure resource access.

Answer

Identity Protection user risk policy

Answer

Privileged Identity Management (PIM) for Azure AD roles

Answer

Azure RBAC roles

Answer

Access reviews

Question 10

Your organization is using Microsoft Sentinel to detect advanced threats. You need to ensure that alerts from Microsoft Defender XDR are automatically synchronized with Sentinel and that incidents are created. Which THREE components are required?

Accepted Answer

Microsoft Defender XDR data connector. The Microsoft Defender XDR data connector (Option B) is required because it is the specific integration point that ingests alerts and raw signals from Microsoft 365 Defender into Microsoft Sentinel. Without this connector, there is no automated synchronization of Defender XDR alerts into the Sentinel workspace.

Answer

Entity behavior analytics (UEBA)

Answer

Automation rule to trigger playbook

Question 11

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. The policy is intended to block legacy authentication. However, users are still able to access email using Outlook (modern auth). What is the most likely reason?

Accepted Answer

The clientAppTypes list does not include 'modernAuth'. The 'clientAppTypes' list in the Conditional Access policy must include 'modernAuth' to explicitly target and block modern authentication clients. Without this entry, the policy only applies to legacy authentication protocols (e.g., POP, IMAP, SMTP), leaving modern auth flows (like Outlook using OAuth 2.0) unaffected. The JSON snippet shows 'clientAppTypes': ['exchangeActiveSync', 'other'], which omits 'modernAuth', so Outlook (modern auth) bypasses the block.

Answer

The policy does not include 'Microsoft Office 365' in applications

Answer

The grant control should be 'require MFA' instead of 'block'

Answer

The policy state is set to 'enabled' incorrectly

Question 12

Refer to the exhibit. A KQL query is used in Microsoft Sentinel to detect brute-force attacks. The query returns no results despite known brute-force attempts. What is the most likely issue?

Accepted Answer

The EventID 4625 may not cover all authentication failures. EventID 4625 in Windows Security logs specifically records failed logon attempts, but brute-force attacks may target other authentication protocols (e.g., RDP, SMB, or network-level authentication) that generate different EventIDs (such as 4648, 4776, or 5156). Additionally, some brute-force attempts might be blocked at the network layer or use non-Windows authentication methods, so relying solely on EventID 4625 will miss those events. Therefore, the query returns no results because it does not capture all authentication failure scenarios.

Answer

The query lacks a time filter

Answer

The 'IPAddress' field does not exist in SecurityEvent

Answer

The 'count()' aggregation is incorrect

Question 13

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. The security team requires that only HTTPS traffic is allowed and that TLS 1.2 is enforced. Does this template meet the requirements?

Accepted Answer

Yes, the template correctly enforces HTTPS and TLS 1.2. The ARM template sets 'supportsHttpsTrafficOnly' to true, which enforces HTTPS-only traffic, and 'minimumTlsVersion' to 'TLS1_2', which enforces TLS 1.2 as the minimum protocol version. These two properties together fully satisfy the security team's requirement that only HTTPS traffic is allowed and TLS 1.2 is enforced.

Answer

No, because 'minimumTlsVersion' should be 'TLS1_0'

Answer

No, because 'supportsHttpsTrafficOnly' should be false

Answer

No, because 'defaultAction': 'Deny' blocks all traffic including HTTPS

Question 14

A company uses Microsoft Defender for Cloud to assess the security posture of their hybrid environment. They need to ensure that all Azure subscriptions are evaluated against the same set of regulatory compliance standards. What should they configure?

Accepted Answer

Assign the regulatory compliance standard to the management group containing all subscriptions. Regulatory compliance standards in Microsoft Defender for Cloud are assigned at the management group scope, which automatically applies the standard to all subscriptions within that management group. This ensures consistent evaluation across the entire hybrid environment without needing per-subscription configuration. The assignment inherits down the hierarchy, so all subscriptions under the management group are assessed against the same compliance framework.

Answer

Assign the standard to each subscription individually

Answer

Create an Azure Policy initiative and assign it to the management group

Answer

Use Microsoft Defender for Cloud's default policy

Question 15

Your organization uses Microsoft Intune to manage devices. You need to ensure that corporate data on personally owned devices is removed when a user leaves the company, but personal data remains intact. What should you use?

Accepted Answer

Selective wipe (retire). Selective wipe (retire) is the correct choice because it removes only corporate data from a personally owned device enrolled in Microsoft Intune, while preserving the user's personal data. This is achieved by targeting managed app data and corporate profiles, leaving personal apps, photos, and settings intact. It aligns with the requirement to protect corporate information upon employee departure without affecting the user's personal property.

Answer

Conditional Access policy

Answer

Full wipe

Answer

Device compliance policy