SC-100 Design solutions that align with security best practices and priorities Practice Test 2 — 15 Questions

Question 1

Your company is implementing Microsoft Copilot for Security to assist the security operations team. You need to ensure that prompts and responses from Copilot do not expose sensitive internal information to unauthorized users. Which configuration should you apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable RBAC and data boundary controls in Copilot for Security settings. Enabling role-based access control (RBAC) and data boundary controls in Copilot for Security settings is correct because it restricts access to prompts and responses based on user roles and ensures data stays within your tenant. Option B (Use a third-party AI gateway to sanitize prompts) is unnecessary. Option C (Disable Copilot for Security for all users) would block the feature entirely. Option D (Train users to avoid sensitive data) is not a technical control.

Answer

Use a third-party AI gateway to sanitize prompts

Answer

Disable Copilot for Security for all users

Answer

Train users to avoid entering sensitive information in prompts

Question 2

Your organization is designing a security strategy for Microsoft 365 Copilot. You need to ensure that Copilot does not generate responses based on sensitive data that users are not authorized to access. Which TWO configurations should you implement?

Accepted Answer

Implement Conditional Access policies to restrict Copilot access based on user, device, and location.. Conditional Access policies (C) are correct because they enforce access controls at the authentication layer, ensuring that only authorized users from compliant devices and trusted locations can interact with Copilot. Sensitivity labels (E) are correct because Microsoft 365 Copilot respects sensitivity labels on documents and emails, preventing it from generating responses that include content from labeled sensitive data unless the user has the appropriate permissions. Together, these two controls address both who can access Copilot and what data Copilot can use in its responses.

Answer

Set up Information Barriers to prevent Copilot from accessing data across departments.

Answer

Configure Data Loss Prevention (DLP) policies to block sensitive data from being used in prompts.

Answer

Enable Purview Audit to monitor Copilot interactions.

Question 3

Your organization uses Microsoft Defender for Cloud to protect a multi-cloud environment (Azure, AWS, GCP). You need to ensure that security configurations are assessed against industry benchmarks like CIS and PCI DSS. Which THREE actions should you take?

Accepted Answer

Enable the regulatory compliance dashboard in Defender for Cloud and select the desired standards (CIS, PCI DSS).. The regulatory compliance dashboard in Microsoft Defender for Cloud allows you to add built-in standards such as CIS and PCI DSS. Once enabled, Defender for Cloud automatically assesses your multi-cloud resources against the selected benchmarks and provides a compliance score with detailed recommendations for remediation.

Option C is correct because Azure Policy can be used to enforce security configurations based on benchmark recommendations. By creating policy initiatives that map to CIS or PCI DSS controls, you can audit or enforce compliance across your Azure, AWS, and GCP resources via Defender for Cloud's integration.

Option D is correct because continuous export of assessment data to a Log Analytics workspace enables custom reporting and analysis. This allows you to build tailored dashboards, run advanced queries, and integrate with SIEM or other monitoring tools, extending the value of the compliance assessments.

Answer

Deploy Azure Firewall in each cloud environment to filter traffic.

Answer

Deploy the Log Analytics agent to all VMs in the multi-cloud environment.

Question 4

Your company is using Microsoft Entra ID and wants to implement passwordless authentication to improve security. Which THREE authentication methods should you consider?

Accepted Answer

Microsoft Authenticator app with phone sign-in. Microsoft Authenticator app with phone sign-in is a passwordless authentication method because it uses a cryptographic key pair stored on the user's device to sign authentication requests, eliminating the need for a password. When the user approves a notification on their phone, the app signs a challenge from Microsoft Entra ID using the private key, and the service verifies it with the public key. This aligns with the passwordless goal by replacing the password with a possession-based factor (the phone) and a biometric or PIN gesture.

Answer

SMS one-time passcode

Answer

App passwords

Question 5

Refer to the exhibit. You are evaluating an Azure Policy definition that checks whether a web app redirects HTTP to HTTPS. The policy uses 'auditIfNotExists' effect. After assigning this policy to a subscription, you notice that a web app that does not redirect HTTP to HTTPS is marked as 'Healthy'. What is the most likely cause?

Accepted Answer

The custom assessment referenced in the policy does not exist in Microsoft Defender for Cloud.. The 'auditIfNotExists' effect in Azure Policy requires a linked assessment in Microsoft Defender for Cloud to evaluate the existence condition. If the custom assessment referenced in the policy does not exist in Defender for Cloud, the policy cannot detect the missing HTTP-to-HTTPS redirect, causing non-compliant resources to be incorrectly marked as 'Healthy'.

Answer

The policy assignment is scoped to a management group that does not include the web app's subscription.

Answer

The policy definition has a syntax error in the 'existenceCondition' field.

Answer

The web app is not running and therefore not assessed.

Question 6

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel that detects machines with more than two malware alerts in a day. The query returns no results even though you know there are machines with multiple malware alerts. What is the most likely reason?

Accepted Answer

The alert name in the environment is not exactly 'Malware detected'; it might include a suffix like 'on endpoint'.. The KQL query likely uses a hardcoded string 'Malware detected' in a where clause to filter alerts. If the actual alert names in the environment include a suffix like 'on endpoint' (e.g., 'Malware detected on endpoint'), the exact string match fails, causing the query to return no results. This is a common issue when alert naming conventions vary across Microsoft Defender for Endpoint or other data sources ingested into Sentinel.

Answer

The 'summarize' function is incorrectly used and creates duplicate counts.

Answer

The query filters out alerts with severity less than 'High'.

Answer

The query does not include a time range filter, so it returns data from all time.

Question 7

Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous behavior such as impossible travel. What should you configure?

Accepted Answer

Anomaly detection policies in Microsoft Defender for Cloud Apps. Microsoft Defender for Cloud Apps uses anomaly detection policies to detect impossible travel and other suspicious activities. Option B is wrong because DLP policies focus on data protection, not activity anomalies. Option C is wrong because app permissions are for OAuth apps. Option D is wrong because session policies control real-time access, not anomaly detection.

Answer

Data loss prevention (DLP) policies in Microsoft Purview

Answer

Session policies in Microsoft Defender for Cloud Apps

Answer

App permission policies in Microsoft Entra ID

Question 8

A company uses Microsoft Sentinel and wants to implement a security orchestration, automation, and response (SOAR) solution. They need a playbook that automatically blocks a user in Microsoft Entra ID when a high-severity incident is created. What should they use?

Accepted Answer

Azure Logic Apps integrated with Microsoft Sentinel. Azure Logic Apps provides the native integration with Microsoft Sentinel to create automated playbooks that trigger on incident creation. Logic Apps connectors allow direct interaction with Microsoft Entra ID to block a user via the Microsoft Graph API, enabling a seamless SOAR workflow without additional licensing or services.

Answer

Microsoft Defender XDR automated investigation and response

Answer

Power Automate cloud flows

Answer

Microsoft Purview Compliance Manager

Question 9

A company uses Microsoft Defender for Endpoint (MDE) and needs to ensure that all devices report their security configuration to Microsoft Defender XDR. Which setting should they verify?

Accepted Answer

Devices are onboarded to Microsoft Defender XDR. Devices must be onboarded to Microsoft Defender XDR to report their security configuration. Onboarding registers the device with the Defender for Endpoint service, enabling the collection and forwarding of security telemetry to the Microsoft 365 Defender portal. Without onboarding, the device cannot communicate its security state, regardless of other integrations.

Answer

Devices are enrolled in Microsoft Intune

Answer

Microsoft Sentinel is connected to Defender for Endpoint

Answer

Microsoft Purview Information Protection is enabled

Question 10

Which TWO of the following are key components of a Zero Trust architecture according to Microsoft? (Choose two.)

Accepted Answer

Use least privilege access. In Microsoft's Zero Trust model, 'least privilege access' (Option C) is a core principle that ensures users and devices are granted only the minimum permissions necessary to perform their tasks, reducing the attack surface. This is enforced through technologies like Azure AD Conditional Access and Privileged Identity Management (PIM), which dynamically limit access based on risk and context.

Answer

Trust but verify

Answer

Implicit trust for internal traffic

Answer

Rely on a strong perimeter

Question 11

Which THREE of the following are valid ways to protect sensitive data in Microsoft 365 using Microsoft Purview? (Choose three.)

Accepted Answer

Sensitivity labels. Sensitivity labels are a core Microsoft Purview Information Protection capability that allows you to classify and protect data at the item level. They can apply encryption, visual markings (headers/footers/watermarks), and enforce rights management (Azure RMS) directly on documents and emails, ensuring protection persists even when data leaves Microsoft 365.

Answer

Conditional Access policies

Answer

Microsoft Defender for Endpoint

Question 12

Which TWO of the following are benefits of using Microsoft Defender XDR (Extended Detection and Response)? (Choose two.)

Accepted Answer

Cross-domain correlation of alerts. Microsoft Defender XDR correlates alerts across endpoints, email, identities, and cloud apps to provide a unified incident view. This cross-domain correlation enables security teams to detect multi-stage attacks that span different attack surfaces, which is a core benefit of an XDR solution.

Answer

Scans for vulnerabilities in VMs

Answer

Provides compliance assessments

Answer

Replaces the need for a firewall

Question 13

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The compliance team wants to ensure that all storage accounts have secure transfer required enabled. Which action should you take in Defender for Cloud?

Accepted Answer

Implement the 'Secure transfer to storage accounts should be enabled' recommendation. The correct action is to implement the 'Secure transfer to storage accounts should be enabled' recommendation because Microsoft Defender for Cloud provides built-in security recommendations that map to specific controls. This recommendation directly checks whether the 'Secure transfer required' property is enabled on each storage account, and if not, it provides remediation steps to enforce HTTPS-only traffic, which aligns with the compliance team's requirement.

Answer

Configure the regulatory compliance dashboard

Answer

Review the secure score

Answer

Enable the 'Cloud Security Posture Management' plan

Question 14

Your organization is adopting a Zero Trust network strategy. Which Microsoft solution should you use to implement micro-segmentation and enforce identity-based access controls for on-premises and cloud resources?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct solution because it enforces identity-based access controls for on-premises and cloud resources. It enables micro-segmentation by allowing you to apply granular access policies based on user identity, device health, and risk signals, effectively segmenting access to applications and data regardless of network location. This aligns with Zero Trust principles of 'never trust, always verify' by ensuring access decisions are based on identity and context, not just network location.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 15

Your organization uses Microsoft Sentinel for security operations. The SOC team wants to automatically disable a compromised user account in Microsoft Entra ID when a high-severity alert is generated. Which automation method should you use?

Accepted Answer

An automation rule with a playbook. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when a high-severity alert fires. The playbook can then execute an action to disable the user account in Microsoft Entra ID via the Microsoft Graph API. This is the correct method because it provides the necessary integration between Sentinel alerts and Entra ID identity remediation.

Answer

A workbook

Answer

A KQL query in a hunting rule

Answer

An analytics rule