SC-100 Design solutions that align with security best practices and priorities Practice Test 10 — 15 Questions

Question 1

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a specific minimum OS version can access corporate resources. Which configuration should you use?

Accepted Answer

Device compliance policy with minimum OS version rule. A device compliance policy with a minimum OS version rule is the correct choice because Intune compliance policies evaluate device attributes—including OS version—against defined rules before granting access to corporate resources. When a device fails the minimum OS version check, Conditional Access blocks access until the device is updated or remediated, ensuring only compliant devices can connect.

Answer

Device configuration profile

Answer

Enrollment restrictions

Answer

App protection policy

Question 2

A company uses Microsoft Entra ID with P2 licenses. They want to implement a Zero Trust approach that requires step-up authentication for accessing high-value data in SharePoint. The solution must use risk-based policies and minimize user friction. Which combination should you recommend?

Accepted Answer

Microsoft Entra Conditional Access with sign-in risk policy and authentication context for sensitive data. It combines Conditional Access with a sign-in risk policy (from Identity Protection) and an authentication context that is applied to sensitive SharePoint data. This enforces step-up authentication only when risk is detected and the user accesses high-value data, minimizing friction for low-risk sessions while meeting Zero Trust requirements.

Answer

Microsoft Entra Conditional Access with trusted locations policy

Answer

Azure AD Conditional Access with MFA for all SharePoint access

Answer

Microsoft Entra Identity Protection user risk policy with MFA

Question 3

Your organization plans to use Microsoft Defender for Cloud to secure Azure resources. The security team wants to continuously assess compliance against the CIS Azure Foundations Benchmark. What should you do?

Accepted Answer

Enable the CIS Azure Foundations Benchmark in Defender for Cloud regulatory compliance dashboard. Microsoft Defender for Cloud's regulatory compliance dashboard includes built-in support for the CIS Azure Foundations Benchmark. By enabling this standard in the dashboard, Defender for Cloud continuously assesses your Azure resources against all CIS controls, providing automated compliance scores and remediation recommendations without requiring custom definitions or manual policy assignments.

Answer

Create a custom Azure Blueprint for CIS

Answer

Deploy Azure Security Center (legacy)

Answer

Assign Azure Policy for all CIS controls manually

Question 4

A company uses Microsoft Entra ID and wants to enable passwordless authentication for all users to reduce phishing risks. Users are already using Microsoft Authenticator for MFA. Which passwordless method should you prioritize?

Accepted Answer

Microsoft Authenticator passwordless sign-in. The organization already uses Microsoft Authenticator for MFA, making the transition to passwordless sign-in via Authenticator the most seamless and cost-effective path. This method leverages the existing app registration and push notification infrastructure, allowing users to authenticate with a biometric or PIN gesture without deploying additional hardware or certificates.

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Answer

Certificate-based authentication

Question 5

Which TWO are best practices for designing a Microsoft 365 Defender (XDR) deployment to ensure optimal detection and response?

Accepted Answer

Configure automated investigation and response for common incident types. Option B is correct because configuring automated investigation and response (AIR) for common incident types lets Microsoft 365 Defender automatically investigate and remediate recurring, well-understood threats, which reduces analyst workload and speeds response so human effort can focus on complex attacks. Option D is correct because XDR detection quality depends on ingesting all supported signal sources (endpoint, identity, email, cloud apps, and other connectors) and having the corresponding licenses enabled, since missing telemetry or unlicensed workloads create blind spots that degrade correlation and incident detection. Option A is not a best practice because deploying Defender for Endpoint on unsupported operating systems with limited functionality provides incomplete telemetry and unreliable protection, undermining XDR detection rather than optimizing it. Option C is not a best practice because relying solely on manual alert triage does not scale and increases the risk of missing complex or high-volume attacks that automation and correlation are designed to catch. Option E is not a best practice because configuring workloads in silo mode prevents cross-domain signal correlation, which is the core value of Microsoft 365 Defender XDR and would increase, not reduce, false positives and missed detections.

Answer

Deploy Defender for Endpoint on unsupported operating systems with limited functionality

Answer

Rely solely on manual alert triage to avoid missing complex attacks

Answer

Configure each workload (Endpoint, Identity, etc.) in SILO mode to avoid false positives

Question 6

Which THREE are components of Microsoft's Zero Trust model?

Accepted Answer

Data. Microsoft's Zero Trust model is built on three foundational principles—verify explicitly, use least privilege access, and assume breach—and it organizes its architecture around six core components: identities, devices (endpoints), applications, data, infrastructure, and networks. Option A (Data) is correct because data is one of those six pillars, protected through classification, labeling, and encryption so that access is granted based on sensitivity and policy. Option D (Identities) is correct because identities are the primary control plane in Zero Trust, verified with strong authentication (such as MFA and conditional access) before any resource is reached. Option E (Endpoints) is correct because devices/endpoints are a core component, validated for health and compliance before being trusted to access corporate resources. Option B (Assume breach) is not a component but one of the three guiding principles of Zero Trust, and Option C (Microsoft Defender for Cloud) is a specific product/CNAPP offering rather than a structural component of the model.

Answer

Assume breach

Answer

Microsoft Defender for Cloud

Question 7

Which TWO should you implement to protect privileged accounts in Microsoft Entra ID?

Accepted Answer

Conditional Access policies requiring MFA for privileged roles. Option B is correct because Conditional Access policies that require multifactor authentication for privileged directory roles (such as Global Administrator) enforce strong authentication at sign-in, directly reducing the risk of credential compromise for high-impact accounts. Option E is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time role activation, approval workflows, time-bound assignments, and access reviews, which minimize standing privileged access and its exposure window. Together, B and E address both authentication strength and the elimination of permanent admin rights, which are core controls for protecting privileged accounts in Entra ID. Option A (Microsoft Purview Data Loss Prevention) is incorrect because it protects sensitive data in motion/at rest rather than securing privileged identities. Option C (Microsoft Defender for Cloud security score) is incorrect because it is a posture assessment metric, not an access control for privileged accounts. Option D (Microsoft Defender Vulnerability Management) is incorrect because it identifies and remediates software vulnerabilities, not privileged identity protection.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Cloud security score

Answer

Microsoft Defender Vulnerability Management

Question 8

A company uses Microsoft Defender for Cloud to manage security across hybrid workloads. They need to ensure that all Azure VMs have guest-level threat detection enabled. Which security policy should they assign?

Accepted Answer

Microsoft cloud security benchmark. The Microsoft cloud security benchmark (MCSB) is the correct policy because it includes built-in guest-level threat detection recommendations for Azure VMs, such as deploying the Log Analytics agent and enabling Microsoft Defender for Servers with guest-level monitoring. This benchmark is the default initiative in Defender for Cloud and directly maps to the requirement of enabling guest-level threat detection across all VMs.

Answer

Azure Security Benchmark

Answer

Microsoft Defender for Cloud Apps

Answer

NIST SP 800-53

Question 9

A multinational corporation is implementing a privileged access strategy. They need to ensure that all users with permanent administrative roles sign in using phishing-resistant authentication methods. Which Microsoft Entra ID feature should they enforce?

Accepted Answer

Authentication Strengths in Conditional Access. Authentication Strengths in Conditional Access allows organizations to enforce specific authentication methods, such as FIDO2 security keys or certificate-based authentication, which are phishing-resistant. This directly meets the requirement to ensure users with permanent administrative roles use phishing-resistant methods, unlike general MFA policies that may allow weaker methods like SMS or OTP.

Answer

Privileged Identity Management (PIM) with access reviews

Answer

Multifactor authentication (MFA) with Conditional Access

Answer

Conditional Access policies requiring MFA for all admins

Question 10

A company wants to protect sensitive email data from being exfiltrated by malicious insiders. They need a solution that can detect and block anomalous outbound email traffic in real time. Which Microsoft solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) is the correct solution because it provides real-time detection and blocking of anomalous outbound email traffic through its outbound spam filtering and anti-phishing policies. MDO uses machine learning models to analyze email sending patterns, such as sudden spikes in volume or unusual recipient domains, and can automatically quarantine or block suspicious outbound messages to prevent data exfiltration by malicious insiders.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 11

A company is designing a security operations center (SOC). They want to use Microsoft Sentinel as their SIEM. They need to ensure that all security events from on-premises servers are collected. Which data connector should they configure?

Accepted Answer

Windows Security Events via Azure Monitor Agent (AMA). The Windows Security Events via Azure Monitor Agent (AMA) connector is the recommended method for collecting security events from on-premises Windows servers into Microsoft Sentinel. AMA is the current generation agent that supports data collection rules (DCRs) for granular filtering and is fully supported by Sentinel, replacing the legacy Log Analytics Agent. This ensures comprehensive collection of Windows security logs such as Event ID 4625 (failed logons) and 4688 (process creation) for SOC analysis.

Answer

Windows Firewall via Legacy Agent

Answer

Syslog via AMA

Answer

Azure Activity Log

Question 12

A company uses Microsoft Defender for Endpoint to protect endpoints. They want to configure attack surface reduction rules to block executable files from running unless they meet a specific prevalence, age, or trust level. Which ASR rule should they enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is specifically designed to block executables that do not meet Microsoft's cloud-based prevalence, age, or trustworthiness criteria. This rule uses the Microsoft Intelligent Security Graph to evaluate files against global telemetry, blocking those that are new, rare, or unsigned, which directly matches the requirement to block executables based on prevalence, age, or trust level.

Answer

Block Office communication application from creating child processes

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block untrusted and unsigned processes that run from USB

Question 13

A company is implementing Microsoft Purview to protect sensitive data in SharePoint Online. They need to automatically apply a 'Highly Confidential' label to documents that contain credit card numbers. What should they create?

Accepted Answer

An auto-labeling policy for sensitivity labels. Microsoft Purview auto-labeling policies for sensitivity labels can automatically detect sensitive data types (e.g., credit card numbers) in SharePoint Online documents and apply a 'Highly Confidential' label without user intervention. This meets the requirement for automatic, policy-driven labeling based on content inspection.

Answer

A communication compliance policy

Answer

A data loss prevention (DLP) rule

Answer

A manual labeling policy

Question 14

A company uses Microsoft Intune to manage devices. They want to ensure that all devices accessing corporate email are compliant with security policies before they can connect. Which feature should they enable?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it enforces compliance-based access control at the authentication layer. By integrating with Intune compliance policies, Conditional Access can block or allow device access to corporate email (e.g., Exchange Online) based on real-time compliance status, ensuring only compliant devices can connect.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Intune App Protection Policies

Answer

Mobile Device Management (MDM) enrollment

Question 15

A company is designing a security strategy for their AI-powered applications using Microsoft Azure OpenAI Service. They need to ensure that the AI models are not used to generate harmful content and that the data sent to the models is protected. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) for AI. Microsoft Purview Data Loss Prevention (DLP) for AI is the correct feature because it is specifically designed to monitor and control the data sent to and from AI applications, including Azure OpenAI Service, to prevent the generation of harmful content and protect sensitive data. It uses deep content analysis and policy-based controls to detect and block policy violations in real-time, directly addressing the dual requirements of content safety and data protection.

Answer

Microsoft Purview Endpoint DLP

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit