SC-100 Design solutions that align with security best practices and priorities Practice Test 3 — 15 Questions

Question 1

A company plans to implement a Zero Trust security model. Which of the following is the primary principle that should guide their strategy?

Accepted Answer

Assume breach and verify explicitly. The primary principle of Zero Trust is 'never trust, always verify,' which is operationalized as 'assume breach and verify explicitly.' This means every access request—regardless of source (internal or external)—must be authenticated, authorized, and encrypted before granting access. It eliminates implicit trust based on network location and enforces least-privilege access, which is foundational to the Zero Trust architecture.

Answer

Use a strong perimeter firewall as the primary defense

Answer

Grant trusted users full access to all resources

Answer

Trust but verify all internal traffic

Question 2

Your organization uses Microsoft Defender for Cloud Apps. You need to detect anomalous behavior such as impossible travel. What should you configure?

Accepted Answer

Anomaly detection policies in Microsoft Defender for Cloud Apps. Option A is correct because Microsoft Defender for Cloud Apps uses anomaly detection policies to detect impossible travel and other suspicious activities. Option B is wrong because DLP policies focus on data protection, not activity anomalies. Option C is wrong because app permissions are for OAuth apps. Option D is wrong because session policies control real-time access, not anomaly detection.

Answer

Data loss prevention (DLP) policies in Microsoft Purview

Answer

Session policies in Microsoft Defender for Cloud Apps

Answer

App permission policies in Microsoft Entra ID

Question 3

A company uses Microsoft Sentinel and wants to implement a security orchestration, automation, and response (SOAR) solution. They need a playbook that automatically blocks a user in Microsoft Entra ID when a high-severity incident is created. What should they use?

Accepted Answer

Azure Logic Apps integrated with Microsoft Sentinel. Option C is correct because Azure Logic Apps provides the native integration with Microsoft Sentinel to create automated playbooks that trigger on incident creation. Logic Apps connectors allow direct interaction with Microsoft Entra ID to block a user via the Microsoft Graph API, enabling a seamless SOAR workflow without additional licensing or services.

Answer

Microsoft Defender XDR automated investigation and response

Answer

Power Automate cloud flows

Answer

Microsoft Purview Compliance Manager

Question 4

Your organization is implementing Microsoft Entra ID Conditional Access. You need to require multi-factor authentication (MFA) for all users accessing financial applications, but only when the sign-in risk is medium or higher. What is the most efficient way to achieve this?

Accepted Answer

Create a Conditional Access policy that targets the financial applications, uses sign-in risk as a condition, and requires MFA. Option D is correct because it uses a single Conditional Access policy to target the specific financial applications and sets the sign-in risk condition to medium or higher, which triggers MFA only when the risk threshold is met. This approach is efficient as it avoids per-user MFA configuration and leverages Microsoft Entra ID Protection's risk detection to dynamically enforce MFA based on real-time sign-in risk, aligning with the principle of adaptive access control.

Answer

Create a Microsoft Entra ID Protection user risk policy to require MFA

Answer

Enable MFA per user for all users in the financial team

Answer

Create a Conditional Access policy that targets all users, includes a named location, and requires MFA

Question 5

A company uses Microsoft Defender for Endpoint (MDE) and needs to ensure that all devices report their security configuration to Microsoft Defender XDR. Which setting should they verify?

Accepted Answer

Devices are onboarded to Microsoft Defender XDR. Devices must be onboarded to Microsoft Defender XDR to report their security configuration. Onboarding registers the device with the Defender for Endpoint service, enabling the collection and forwarding of security telemetry to the Microsoft 365 Defender portal. Without onboarding, the device cannot communicate its security state, regardless of other integrations.

Answer

Devices are enrolled in Microsoft Intune

Answer

Microsoft Sentinel is connected to Defender for Endpoint

Answer

Microsoft Purview Information Protection is enabled

Question 6

Your organization is adopting Microsoft Copilot for Security. You need to ensure that the AI model does not expose sensitive data during interactions. What is the primary security control you should implement?

Accepted Answer

Microsoft Purview Data Loss Prevention policies for Copilot. Microsoft Purview Data Loss Prevention (DLP) policies for Copilot for Security are the primary control to prevent sensitive data exposure because they can inspect and block sensitive information (e.g., credit card numbers, health records) in real-time during Copilot interactions. DLP policies integrate directly with Copilot to enforce data protection rules on both prompts and responses, ensuring that sensitive data is not leaked through the AI model. This is the most direct and effective control for preventing data exposure in AI interactions.

Answer

Microsoft Entra Conditional Access policies

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Purview Information Protection sensitivity labels

Question 7

A company uses Microsoft Purview to manage data governance. They need to classify sensitive data automatically in Azure SQL Database. What should they configure?

Accepted Answer

Microsoft Purview Data Map scanning rules. Microsoft Purview Data Map scanning rules are the correct choice because they enable automated classification of sensitive data in Azure SQL Database by scanning the database schema and content against built-in or custom sensitive data types. This is the native mechanism within Purview to discover and label sensitive columns, such as credit card numbers or PII, directly in Azure SQL Database.

Answer

Microsoft Defender for Cloud regulatory compliance

Answer

Microsoft Sentinel data connectors

Answer

Microsoft Entra ID Protection

Question 8

Your organization uses Microsoft Intune for mobile device management. You need to ensure that only devices compliant with security policies can access corporate email. What should you implement?

Accepted Answer

Conditional Access policy requiring compliant device. A is correct because a Conditional Access policy in Microsoft Entra ID can evaluate device compliance status reported by Intune before granting access to corporate email. By configuring a policy that requires a device to be marked as compliant, only devices that meet your security policies (e.g., encryption, OS version, threat level) will be allowed to authenticate and access email. This directly enforces the requirement that only compliant devices can access corporate email.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Defender for Endpoint integration

Answer

Microsoft Intune App Protection Policies

Question 9

A company needs to design a secure DevOps pipeline using GitHub Actions and Microsoft Defender for Cloud. They want to scan infrastructure-as-code (IaC) templates for misconfigurations before deployment. What should they integrate?

Accepted Answer

Microsoft Defender for Cloud Infrastructure as Code scanning. Microsoft Defender for Cloud includes a native Infrastructure as Code (IaC) scanning capability that integrates directly with GitHub Actions. This feature automatically analyzes IaC templates (such as ARM, Bicep, Terraform, and CloudFormation) for security misconfigurations during the CI/CD pipeline, providing pre-deployment guardrails. By failing the pipeline on critical findings, it ensures only compliant infrastructure is deployed, aligning with the secure DevOps principle of shifting security left.

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps

Question 10

Which TWO of the following are key components of a Zero Trust architecture according to Microsoft? (Choose two.)

Accepted Answer

Use least privilege access. In Microsoft's Zero Trust model, 'least privilege access' (Option C) is a core principle that ensures users and devices are granted only the minimum permissions necessary to perform their tasks, reducing the attack surface. This is enforced through technologies like Azure AD Conditional Access and Privileged Identity Management (PIM), which dynamically limit access based on risk and context.

Answer

Trust but verify

Answer

Implicit trust for internal traffic

Answer

Rely on a strong perimeter

Question 11

Which THREE of the following are valid ways to protect sensitive data in Microsoft 365 using Microsoft Purview? (Choose three.)

Accepted Answer

Sensitivity labels. Sensitivity labels are a core Microsoft Purview Information Protection capability that allows you to classify and protect data at the item level. They can apply encryption, visual markings (headers/footers/watermarks), and enforce rights management (Azure RMS) directly on documents and emails, ensuring protection persists even when data leaves Microsoft 365.

Answer

Conditional Access policies

Answer

Microsoft Defender for Endpoint

Question 12

Which TWO of the following are benefits of using Microsoft Defender XDR (Extended Detection and Response)? (Choose two.)

Accepted Answer

Cross-domain correlation of alerts. Option C is correct because Microsoft Defender XDR correlates alerts across endpoints, email, identities, and cloud apps to provide a unified incident view. This cross-domain correlation enables security teams to detect multi-stage attacks that span different attack surfaces, which is a core benefit of an XDR solution.

Answer

Scans for vulnerabilities in VMs

Answer

Provides compliance assessments

Answer

Replaces the need for a firewall

Question 13

Your organization is implementing a Zero Trust security model. Which Microsoft security solution should you use to enforce conditional access policies based on user, device, location, and real-time risk signals?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct solution because it is the native policy engine in Azure AD that evaluates signals from user identity, device compliance, location (IP ranges or countries), and real-time risk from Microsoft Entra ID Protection to enforce access decisions. It directly implements the 'explicit verification' and 'assume breach' principles of Zero Trust by blocking or requiring step-up authentication based on these dynamic conditions.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Answer

Microsoft Purview

Question 14

Your company uses Microsoft Defender XDR to protect endpoints. The security team wants to implement automated response actions when a malicious file is detected on a device. Which Microsoft security feature should you configure to automatically isolate the affected device from the network?

Accepted Answer

Automated investigation and response (AIR) capabilities. Automated investigation and response (AIR) in Microsoft Defender XDR is the correct feature because it includes built-in playbooks that can automatically isolate a device from the network when a malicious file is detected. AIR leverages the Microsoft 365 Defender portal's automation capabilities to run investigation steps and execute response actions, such as device isolation, without manual intervention. This directly meets the requirement for automated response upon file detection.

Answer

Microsoft Sentinel automation rules

Answer

Attack surface reduction rules

Answer

Microsoft Intune compliance policies

Question 15

Your organization plans to use Microsoft Purview to protect sensitive data in Microsoft 365. The compliance team needs to detect when users share credit card numbers via email and automatically apply encryption. Which solution should you implement?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data types—such as credit card numbers—in email messages and automatically apply protective actions like encryption. DLP policies can inspect email content in transit via Exchange Online, match patterns against predefined sensitive info types (e.g., credit card number regex), and trigger actions such as 'Encrypt the message' using Azure Rights Management. This directly meets the requirement to detect sharing of credit card numbers and enforce encryption automatically.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Information Protection