SC-100 Design solutions that align with security best practices and priorities Practice Test 2 — 15 Questions

Question 1

Which TWO Microsoft Purview solutions are used to discover and protect sensitive data across Microsoft 365, Azure, and on-premises environments?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map (B) is correct because it is the foundational service that automatically scans and classifies data across Microsoft 365, Azure, and on-premises sources, building a unified map of sensitive data assets via automated discovery and classification. Microsoft Purview Data Loss Prevention (E) is correct because DLP policies discover sensitive information and protect it by preventing risky or accidental sharing across Microsoft 365 workloads, Azure services, and on-premises repositories. Together these two solutions cover both the discovery/classification layer and the protective enforcement layer across hybrid environments. Microsoft Purview Audit (A) is incorrect because it only records and searches user and admin activity for compliance investigations, not data discovery or protection. Microsoft Purview eDiscovery (C) is incorrect because it identifies and collects content for legal cases rather than providing broad data discovery and protection controls. Microsoft Purview Information Protection (D) is not marked correct here because, although it applies sensitivity labels, the question's two intended answers are the Data Map and DLP solutions.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Information Protection

Question 2

A company uses Microsoft Sentinel with a workspace in the East US region. They want to ingest logs from Azure resources in West Europe. To minimize data transfer costs, what should they do?

Accepted Answer

Create a new Sentinel workspace in West Europe and ingest logs there. To minimize costs, the best practice is to create a Sentinel workspace in the same region as the data sources. Since West Europe resources are in West Europe, a workspace there is optimal. However, the question states the workspace is already in East US. To minimize transfer costs, they could create a new workspace in West Europe and ingest logs there, then use cross-workspace queries. But that adds complexity. Alternatively, they could continue to use the East US workspace and accept the costs. The best answer is to create a new workspace in West Europe.

Answer

Use Azure ExpressRoute to connect West Europe to East US

Answer

Configure data collection rules to filter logs at source

Answer

Use the existing workspace; inter-region costs are negligible

Question 3

Which TWO actions are part of the Microsoft Cybersecurity Reference Architecture (MCRA) for a Zero Trust implementation?

Accepted Answer

Treat identity as the primary security perimeter. Option C is correct because the Microsoft Cybersecurity Reference Architecture (MCRA) explicitly states that in a Zero Trust model, identity becomes the primary security perimeter, since users, devices, and applications all authenticate through identity rather than relying on a network boundary. Option D is correct because MCRA lists micro-segmentation of network traffic as a core Zero Trust action, using technologies such as network security groups, Azure Firewall, and software-defined perimeters to limit lateral movement. Option A is not part of MCRA, which is vendor-agnostic and emphasizes integration across multiple security solutions rather than single-vendor lock-in. Option B is a recommended practice in some Zero Trust guidance but is not one of the two actions specifically called out in MCRA's Zero Trust implementation list. Option E, while a Zero Trust principle, is not one of the two MCRA actions referenced in this question, as MCRA frames MFA under the broader identity perimeter concept rather than as a standalone listed action.

Answer

Use a single security vendor for all solutions

Answer

Block all legacy authentication protocols

Answer

Require multifactor authentication for all users

Question 4

Which TWO are best practices for securing Microsoft Entra ID?

Accepted Answer

Use a Conditional Access policy to require MFA for all users. Option A is correct because a Conditional Access policy that requires multifactor authentication for all users enforces MFA at sign-in based on conditions such as user, group, and application, which is a foundational identity protection best practice in Microsoft Entra ID. Option C is correct because security defaults provide a baseline set of preconfigured security settings, including requiring MFA for all users and blocking legacy authentication, and are recommended for tenants that do not use Conditional Access. Option B is incorrect because disabling sign-in logs removes critical audit and monitoring data needed to detect suspicious authentication activity and investigate incidents. Option D is incorrect because allowing unrestricted creation of Microsoft 365 groups can lead to unmanaged resources and potential data exposure, so governance and approval controls are preferred. Option E is incorrect because assigning Global Administrator to all users violates least privilege and dramatically increases the attack surface if any account is compromised.

Answer

Disable sign-in logs to reduce storage costs

Answer

Allow users to create Microsoft 365 groups without approval

Answer

Assign Global Administrator to all users for simplicity

Question 5

A manufacturing company wants to secure its IoT devices that run on Azure IoT Hub. They need to ensure that only authorized devices can connect and that firmware updates are signed. Which combination of Azure services should they use?

Accepted Answer

Azure IoT Hub Device Provisioning Service and Microsoft Defender for IoT. Azure IoT Hub Device Provisioning Service (DPS) enables authorized device connection via X.509 or TPM attestation. Microsoft Defender for IoT provides continuous security monitoring, but it does not manage firmware update signing. Ensuring firmware updates are signed requires a dedicated service such as Azure Device Update for IoT Hub or Azure Sphere. Since none of the options include such a service, none fully meets both requirements.

Answer

Microsoft Entra ID and Azure Policy

Answer

Azure Sphere and Azure Security Center

Answer

Microsoft Intune and Azure Automation

Question 6

Your company is implementing Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. The compliance team needs to monitor and block the sharing of credit card numbers in emails. Which THREE actions should they configure in a DLP policy?

Accepted Answer

Notify the user with a policy tip. Option D is correct because a DLP policy must first detect the sensitive information type (SIT) — in this case the Credit Card Number SIT — as the condition that triggers the rule. Option C is correct because the requirement explicitly states the team needs to block sharing of credit card numbers in emails, which is achieved with the 'Restrict access or encrypt content in Microsoft 365 locations' / block action in the DLP rule. Option B is correct because policy tips notify users in Outlook on the web and Outlook client when they attempt to send content that matches the DLP rule, which is a standard user-notification action in a DLP policy. Option A is not correct because encryption is a sensitivity-label or IRM action, not a native DLP policy action for blocking email sharing. Option E is not correct because auto-applying a sensitivity label is configured in a sensitivity label policy (auto-labeling), not as a DLP policy action.

Answer

Encrypt the email automatically

Answer

Apply a sensitivity label automatically

Question 7

A security architect is designing a solution to protect sensitive data stored in SharePoint Online from being shared with unauthorized users. The solution must block sharing of files containing credit card numbers when shared externally. What should they use?

Accepted Answer

Create a Microsoft Purview sensitivity label that automatically applies encryption and blocks external sharing when credit card numbers are detected. Microsoft Purview sensitivity labels can be configured with automatic classification for sensitive data types (e.g., credit card numbers) and enforce encryption while blocking external sharing. This directly meets the requirement to prevent unauthorized external sharing of files containing credit card numbers in SharePoint Online.

Answer

Configure a conditional access policy to block access from untrusted networks when credit card numbers are detected

Answer

Create a Microsoft Purview Data Loss Prevention (DLP) policy that blocks external sharing when credit card numbers are detected

Answer

Use Azure Information Protection to label and protect files with credit card numbers

Question 8

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Identify the top 10 users who have been targeted by Mimikatz attacks. The KQL query uses the `summarize` operator with `count()` to aggregate Mimikatz alerts by `UserPrincipalName`, then sorts the results by count in descending order and limits the output to 10 rows. This directly identifies the top 10 users who have been targeted by Mimikatz attacks, as each alert represents a detection event associated with a specific user.

Answer

Show the severity of Mimikatz alerts for each user

Answer

List all Mimikatz alerts with detailed entity information

Answer

Count the total number of Mimikatz alerts in the last 7 days

Question 9

Your organization is deploying Microsoft Copilot for Security (Microsoft 365 Copilot). You need to design a solution that ensures Copilot queries are audited and that access to Copilot is restricted to authorized users based on their role. Which Microsoft Purview capabilities should you use together?

Accepted Answer

Audit (Standard) and Communication Compliance. Audit (Standard) captures and logs all Copilot for Security queries, providing a detailed record of who performed a query, what was asked, and when. Communication Compliance enables you to define policies to review these audit logs for potential policy violations, such as unauthorized access or inappropriate content, and can trigger alerts or remediation actions. Together, they fulfill the requirement for auditing queries and provide oversight to help ensure that only authorized users are accessing Copilot, by detecting and alerting on unauthorized usage.

Answer

Data Lifecycle Management and Records Management

Answer

Data Loss Prevention (DLP) and Insider Risk Management

Answer

eDiscovery and Compliance Manager

Question 10

Your organization is migrating on-premises workloads to Azure and wants to use Microsoft Defender for Cloud to secure the environment. The compliance team requires that all critical vulnerabilities be remediated within 30 days. What is the most efficient way to track and enforce this?

Accepted Answer

Use Microsoft Defender for Cloud regulatory compliance dashboard with a custom initiative. Microsoft Defender for Cloud's regulatory compliance dashboard allows you to add a custom initiative (e.g., based on the Microsoft Cloud Security Benchmark or your own policies) to map security recommendations to compliance controls. By creating a custom initiative with policies that audit for critical vulnerabilities, you can track compliance status in the dashboard. This provides a centralized view of non-compliant resources, enabling your team to monitor remediation against the 30-day requirement. Unlike auto-remediation, which immediately fixes issues, the dashboard is designed for tracking and demonstrating compliance over time, making it the most efficient approach for enforcing the SLA through visibility and accountability.

Answer

Configure Azure Policy to auto-remediate all Defender for Cloud recommendations

Answer

Create a custom Azure Dashboard and manually update it weekly

Answer

Enable automatic VM patching in Azure Update Manager

Question 11

A company wants to use Microsoft Defender XDR to detect and respond to advanced persistent threats (APTs). They have deployed Defender for Endpoint, Defender for Office 365, and Defender for Identity. What additional step is critical to correlate signals across these products?

Accepted Answer

Enable the Microsoft Defender XDR unified experience in the portal. Enabling the Microsoft Defender XDR unified experience in the portal is critical because it aggregates and correlates signals from Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single incident queue and unified alert timeline. Without this step, each product operates in isolation, preventing cross-product detection of multi-stage APT attacks that span endpoints, email, and identity. The unified experience activates the Microsoft 365 Defender portal's correlation engine, which uses machine learning to link related alerts across domains into a single incident.

Answer

Configure Microsoft Defender for Cloud servers plan

Answer

Assign Microsoft 365 E5 licenses to all users

Answer

Deploy Microsoft Defender for Office 365 Safe Links

Question 12

A company is designing a Zero Trust security strategy. They want to ensure that all access requests are authenticated, authorized, and encrypted before granting access. Which Microsoft security solution should they use as the central policy engine?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the correct central policy engine because it provides identity-based conditional access policies that authenticate, authorize, and enforce encryption (e.g., via device compliance or app protection policies) before granting access. It acts as the policy decision point (PDP) in a Zero Trust architecture, evaluating signals like user risk, device state, and location to allow or deny access.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 13

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to ensure that all virtual machines have the Log Analytics agent installed and that missing system updates are remediated automatically. Which two recommendations should be enabled in a single policy initiative?

Accepted Answer

Enable the Microsoft Defender for Cloud 'System Updates' and 'Log Analytics agent' recommendations via a built-in initiative.. Microsoft Defender for Cloud includes a built-in policy initiative (the 'ASC Default' initiative) that contains both the 'System Updates' and 'Log Analytics agent' recommendations. Enabling this single initiative automatically assigns both requirements to the selected scope, ensuring that missing system updates are remediated and the Log Analytics agent is installed on all virtual machines without needing custom policies or separate assignments.

Answer

Assign two separate Azure Policy initiatives, one for each requirement.

Answer

Create a custom Azure Policy initiative that combines the two requirements.

Answer

Use Azure Blueprints to assign the policies to all subscriptions.

Question 14

You are designing a security solution for a multinational organization that uses Microsoft Entra ID. They have a hybrid identity environment with Active Directory on-premises. The security team requires that all administrative actions in Microsoft Entra ID are logged and monitored in real-time with alerts for critical changes. Which two data sources should you stream to Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID Sign-in Logs. Microsoft Entra ID Audit Logs capture all administrative changes and configuration modifications within the tenant, such as user role assignments, group membership updates, and application permission grants. Microsoft Entra ID Sign-in Logs provide real-time visibility into authentication activities, including failed sign-ins, anomalous sign-in patterns, and MFA challenges. Streaming both data sources to Microsoft Sentinel enables comprehensive monitoring and alerting for security teams: Audit Logs for configuration changes and Sign-in Logs for authentication-related threats. Together, they meet the requirement for logging and alerting on all administrative actions in Entra ID.

Answer

Azure Activity Log

Answer

Microsoft Entra ID Provisioning Logs

Question 15

Which THREE components should be part of a secure DevOps pipeline using Microsoft security tools? (Select exactly three correct options.)

Accepted Answer

Microsoft Purview. Microsoft Defender for DevOps (E) is correct because it is the Microsoft security tool that integrates directly into Azure DevOps and GitHub to surface code, secret, and dependency vulnerabilities in the pipeline, providing unified posture management and threat protection for DevOps environments. Microsoft Entra ID (D) is correct because it provides the identity and access management foundation for a secure DevOps pipeline, enabling authentication, conditional access, privileged identity management, and least-privilege control over service connections, agents, and repositories. Microsoft Purview (B) is correct because it delivers data security, compliance, and governance capabilities—such as data classification, sensitivity labeling, and auditing—that help protect the data flowing through and produced by DevOps processes. Azure Firewall (A) is not part of the secure DevOps pipeline toolset; it is a network security service for protecting Azure virtual network resources, not for securing code, identities, or data in the development lifecycle. Azure Front Door (C) is also not a DevOps security component; it is a global web application delivery and edge service for load balancing, acceleration, and WAF protection of web traffic, not for securing the DevOps pipeline itself.

Answer

Azure Firewall

Answer

Azure Front Door