SC-100 Design solutions that align with security best practices and priorities Practice Test 11 — 15 Questions

Question 1

A company is implementing Microsoft Defender for Cloud to protect their Azure environment. Which TWO of the following are security best practices that should be enabled? (Choose two.)

Accepted Answer

Cloud Security Posture Management (CSPM). Option A, Cloud Security Posture Management (CSPM), is correct because Defender for Cloud's foundational CSPM continuously assesses Azure resources against security benchmarks like Microsoft Cloud Security Benchmark, surfaces secure score recommendations, and detects misconfigurations and external attack surface risks — the core best practice for hardening an Azure environment. Option B, Microsoft Defender for Cloud workload protection, is correct because enabling the Defender plans (e.g., Defender for Servers, Storage, SQL, Containers, App Service, Key Vault) adds threat detection, vulnerability assessment, and advanced protection for running workloads, which is the recommended complement to CSPM. Option C, Microsoft Defender for Office 365, is not part of Defender for Cloud's Azure protection scope; it protects Exchange Online, SharePoint, Teams, and email against phishing and malware. Option D, Microsoft Defender for Endpoint onboarding, is a separate endpoint security product (though Defender for Servers can auto-provision it), not a Defender for Cloud best-practice toggle itself. Option E, Microsoft Sentinel integration, is an optional SIEM/SOAR data-connector scenario for centralized detection and response, not a required Defender for Cloud security best practice.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint onboarding

Answer

Microsoft Sentinel integration

Question 2

A company is designing a data security strategy using Microsoft Purview. They need to identify sensitive data across their data estate, including on-premises SQL Server, Azure SQL Database, and Amazon S3. Which THREE components should they use? (Choose three.)

Accepted Answer

Microsoft Purview Data Estate Insights. Microsoft Purview Data Estate Insights provides visibility into data estate health and security posture, including sensitive data discovery across on-premises SQL Server, Azure SQL Database, and Amazon S3. It aggregates scan results and offers dashboards to identify where sensitive data resides, enabling targeted classification and protection actions.

Answer

Microsoft Purview External Identities

Answer

Microsoft Purview Compliance Manager

Question 3

A company is deploying Microsoft Entra ID Governance. They need to implement a least privilege access model for their Azure resources. Which TWO features should they use? (Choose two.)

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is correct because it provides just-in-time (JIT) privileged access to Azure resources, enabling time-bound and approval-based role activation. This directly supports a least privilege model by ensuring users only have elevated permissions when needed, reducing standing access.

Answer

Identity Protection

Answer

Conditional Access policies

Answer

Microsoft Intune compliance policies

Question 4

You are a security architect for a large financial services company. The company has a hybrid identity environment with on-premises Active Directory synchronized to Microsoft Entra ID using Microsoft Entra Connect. They use Microsoft 365 E5 licenses and have deployed Microsoft Defender for Cloud, Microsoft Defender for Identity, Microsoft Sentinel, and Microsoft Purview. The company has recently suffered a ransomware attack where an attacker gained access via a compromised service account that had permanent Global Administrator privileges. The attacker then used the account to create a backdoor user and exfiltrate sensitive data from SharePoint Online. After the incident, the CISO mandates a Zero Trust security transformation with the following requirements: 
1. Eliminate standing privileged access for all cloud admins.
2. Require phishing-resistant authentication for all privileged roles.
3. Ensure that all sensitive data in SharePoint Online is automatically classified and protected.
4. Enable detection of lateral movement using anomalous behavior analytics. Which combination of actions should you recommend?

Accepted Answer

Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.. It directly addresses all four CISO requirements: Privileged Identity Management (PIM) eliminates standing Global Administrator privileges by requiring just-in-time activation; Authentication Strengths with FIDO2 enforces phishing-resistant authentication for privileged roles; auto-labeling policies in Microsoft Purview automatically classify and protect sensitive data like credit card numbers in SharePoint Online; and Defender for Identity lateral movement path detection uses behavioral analytics to detect anomalous lateral movement, fulfilling the detection requirement.

Answer

Deploy Microsoft Entra Identity Protection for all users, configure Azure AD Conditional Access with MFA, use Microsoft Purview Information Protection with manual labeling, and enable Microsoft Sentinel analytics for lateral movement.

Answer

Configure Conditional Access to require MFA for admins, enable Microsoft Purview DLP for SharePoint, deploy Defender for Cloud Apps, and use Identity Protection for user risk.

Answer

Remove all permanent admin roles and use just-in-time access via PIM, enforce MFA via Conditional Access, apply sensitivity labels via Microsoft Purview Data Map, and use Microsoft Defender for Cloud for network security groups.

Question 5

Your organization is adopting Microsoft Entra ID as the identity provider for all SaaS applications. The security team wants to enforce multifactor authentication (MFA) for all users accessing these applications. Which approach aligns with security best practices and minimizes user friction?

Accepted Answer

Create a Conditional Access policy requiring MFA for all cloud apps, excluding trusted locations and devices.. Conditional Access policies allow granular, risk-based MFA enforcement that excludes trusted locations (e.g., corporate offices) and trusted devices (e.g., compliant or hybrid-joined devices). This aligns with the Zero Trust principle of 'verify explicitly' while minimizing user friction by not prompting for MFA when the user is already in a trusted context. Security defaults (Option C) enforce MFA for all users but lack the ability to exclude trusted locations or devices, which can cause unnecessary friction.

Answer

Enable per-user MFA for all users in Microsoft Entra ID.

Answer

Disable MFA and rely on strong password policies.

Answer

Enable Microsoft Entra ID Security defaults.

Question 6

Your organization uses Microsoft Sentinel and has deployed the Analytics rule 'TI map IP entity to AzureActivity' to detect suspicious activities based on threat intelligence. The SOC team reports that the rule has a high false positive rate because it matches benign IP addresses used by legitimate services. What design change should you recommend to reduce false positives while maintaining detection coverage?

Accepted Answer

Create a watchlist of trusted IP addresses and modify the rule to exclude those IPs.. Creating a watchlist of trusted IP addresses and modifying the TI map IP entity to AzureActivity rule to exclude those IPs directly addresses the high false positive rate caused by benign IPs. This approach preserves detection coverage for all other threat intelligence matches while filtering out known legitimate services, leveraging Sentinel's watchlist feature for dynamic exclusion without disabling the rule.

Answer

Increase the alert threshold to require multiple occurrences within a time window.

Answer

Disable the rule and rely on manual hunting queries.

Answer

Create a separate analytics rule that suppresses alerts when the source IP is in a trusted list.

Question 7

A company plans to implement a Zero Trust architecture using Microsoft security solutions. They want to ensure that all access to corporate resources is verified explicitly, uses least privilege, and assumes breach. Which Microsoft service should be the central policy engine for enforcing conditional access decisions?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct central policy engine because it directly enforces Zero Trust principles by evaluating signals (user, device, location, risk) in real time to grant or block access. It acts as the policy decision point (PDP) that enforces explicit verification, least privilege, and assumes breach by requiring continuous authentication and authorization for every access request.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 8

Your organization uses Microsoft Purview Information Protection to classify and protect sensitive data. The compliance team wants to automatically apply a 'Highly Confidential' sensitivity label to emails that contain credit card numbers. Which solution should you configure?

Accepted Answer

Microsoft Purview auto-labeling policy. The correct option is A, Microsoft Purview auto-labeling policy, because auto-labeling policies are the native Purview Information Protection mechanism that scans content for sensitive information types (such as credit card numbers) and automatically applies a specified sensitivity label like 'Highly Confidential' to emails and files. This directly matches the requirement to classify and protect data at the label level, since sensitivity labels can also enforce encryption and other protection settings. Option B, Safe Attachments, is a Defender for Office 365 threat-detection feature that sandboxes attachments and does not apply sensitivity labels. Option C, a DLP policy, can detect credit card numbers and block or warn on sharing, but it enforces DLP rules rather than automatically applying a sensitivity label. Option D, Microsoft Endpoint DLP, extends DLP controls to endpoint devices and likewise does not apply sensitivity labels to email.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Microsoft 365 Data Loss Prevention (DLP) policy

Answer

Microsoft Endpoint DLP

Question 9

An organization wants to ensure that all Windows 10 devices are compliant with security policies before they can access corporate email. Microsoft Intune is used for device management. Which component should be used to enforce compliance and block non-compliant devices?

Accepted Answer

Microsoft Entra ID Conditional Access policy integrated with Intune compliance. Microsoft Entra ID Conditional Access policies can evaluate Intune device compliance status in real time. When a device is marked non-compliant by an Intune compliance policy, the Conditional Access policy blocks access to corporate email (e.g., Exchange Online) until the device is remediated. This integration enforces a 'compliant device required' gate that cannot be achieved by Intune compliance alone, which only reports status without blocking access.

Answer

Intune device compliance policy alone

Answer

Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint device risk score

Question 10

Your organization uses Microsoft Sentinel to centralize security logs from multiple clouds. They need to ensure that logs from Amazon Web Services (AWS) are ingested and analyzed for threats. Which connector should you implement?

Accepted Answer

AWS S3 connector. The AWS S3 connector is the correct choice because it is the native Microsoft Sentinel data connector designed specifically to ingest AWS CloudTrail logs (and other AWS service logs) from an S3 bucket. It uses an AWS Simple Queue Service (SQS) to poll for new log files, then streams them into Sentinel for analysis, enabling threat detection across multi-cloud environments.

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor Agent

Answer

Azure Event Hubs

Question 11

A company wants to implement a secure web application gateway to protect their public-facing web apps from common exploits like SQL injection and cross-site scripting. Which Azure service should they use?

Accepted Answer

Azure Application Gateway with WAF. Azure Application Gateway with WAF is the correct choice because it is a regional, layer-7 load balancer that includes a built-in Web Application Firewall (WAF) specifically designed to protect web applications from common exploits such as SQL injection and cross-site scripting (XSS). The WAF uses OWASP Core Rule Sets (CRS) to inspect HTTP/HTTPS traffic and block malicious payloads at the application layer, making it the ideal service for securing public-facing web apps.

Answer

Azure Front Door with WAF

Answer

Azure Firewall

Answer

Azure DDoS Protection

Question 12

Your organization uses Microsoft Defender for Office 365 to protect against phishing attacks. The security team wants to implement a custom advanced phishing threshold policy that blocks suspicious emails more aggressively. Which policy type should they modify?

Accepted Answer

Anti-phishing policy. The Anti-phishing policy in Microsoft Defender for Office 365 includes the Advanced Phishing Threshold (APT) settings that allow administrators to control the aggressiveness of phishing detection. By modifying the anti-phishing policy, you can set the phishing threshold to 'Aggressive' or 'Most Aggressive,' which applies more stringent machine learning models to block suspicious emails earlier. This is the correct policy type because it directly governs the phishing threshold level, not attachment or link scanning.

Answer

ATP policy

Answer

Safe Attachments policy

Answer

Safe Links policy

Question 13

A company plans to use Microsoft Purview to manage data governance across their on-premises SQL Server databases and Azure SQL databases. They need to classify sensitive data and create a unified data map. Which resource should they deploy?

Accepted Answer

Microsoft Purview. Microsoft Purview is the correct choice because it provides a unified data governance service that can scan both on-premises SQL Server and Azure SQL databases, automatically classify sensitive data using built-in classifiers (e.g., PII, financial info), and build a centralized data map. This aligns with the requirement to manage data governance across hybrid environments with a single pane of glass.

Answer

Azure Synapse Analytics

Answer

Azure Data Factory

Answer

Azure SQL Database

Question 14

Which TWO Microsoft security solutions should be integrated to provide a comprehensive Zero Trust architecture that includes identity protection, endpoint detection, and response? (Select exactly two correct options.)

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (B) is correct because it is the extended detection and response platform that unifies signals across endpoints (Defender for Endpoint), identities (Defender for Identity), email and collaboration (Defender for Office 365), and cloud apps (Defender for Cloud Apps), delivering automated endpoint detection and response capabilities required by the scenario. Microsoft Entra ID (C) is correct because it provides the identity protection pillar of Zero Trust, including Conditional Access, risk-based sign-in and user risk detection via Entra ID Protection, and phishing-resistant authentication such as FIDO2 and Windows Hello for Business. Together, Entra ID secures and verifies identities while Defender XDR detects, investigates, and responds to threats across endpoints and other workloads, satisfying the identity protection plus endpoint detection and response requirement. Microsoft 365 E5 (A) is a licensing bundle rather than a distinct security solution, so it does not itself constitute the integration of identity protection and XDR. Microsoft Sentinel (D) is a SIEM/SOAR platform for centralized log ingestion and orchestration, not the endpoint detection and response engine, and Microsoft Purview (E) focuses on data governance, compliance, and information protection rather than identity or endpoint threat response.

Answer

Microsoft 365 E5

Answer

Microsoft Sentinel

Answer

Microsoft Purview

Question 15

You are a security architect for a large enterprise that is migrating to Microsoft 365. The organization has 50,000 users across multiple regions. They have recently experienced a ransomware attack that encrypted files on SharePoint Online and OneDrive for Business. The security team wants to implement a comprehensive protection strategy. Requirements: 1. Automatically detect and block ransomware-like behavior in real-time. 2. Provide users with self-service recovery of files encrypted by ransomware. 3. Ensure that all files in SharePoint and OneDrive are scanned for malware upon upload. 4. Minimize administrative overhead. Which combination of Microsoft 365 security features should you recommend?

Accepted Answer

Enable Microsoft Defender for Office 365 to scan files on upload and use version history and recycle bin for recovery.. Microsoft Defender for Office 365 provides real-time scanning of files uploaded to SharePoint and OneDrive, detecting and blocking known malware. Combined with version history and the recycle bin, users can self-recover files encrypted by ransomware without administrative intervention, satisfying all requirements with minimal overhead.

Answer

Use Microsoft Entra ID Protection to detect compromised accounts and automatically block access.

Answer

Enable Microsoft Endpoint DLP and configure file policies to block encrypted files.

Answer

Configure Microsoft Purview auto-labeling to apply a 'Ransomware' label and then block all labeled files.