SC-100 Design solutions that align with security best practices and priorities Practice Test 3 — 15 Questions

Question 1

Which TWO Microsoft security solutions can help enforce Zero Trust principles by verifying identity and device health before granting access to resources?

Accepted Answer

Microsoft Intune. Microsoft Intune is correct because it enforces Zero Trust by managing device compliance and health policies. When a device attempts to access resources, Intune evaluates its configuration (e.g., encryption status, patch level, jailbreak detection) and reports this status to Microsoft Entra ID. Conditional Access policies then block or grant access based on that health signal, directly verifying the device's trustworthiness before access is allowed.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 2

Which THREE components are essential for implementing a successful SIEM strategy using Microsoft Sentinel?

Accepted Answer

Automation rules. Automation rules are essential because they allow you to centrally manage and automate incident response actions, such as assigning incidents, running playbooks, or triggering suppression logic, based on specific conditions. Without automation rules, your SOC would have to manually handle every alert, which is not scalable for a successful SIEM strategy.

Answer

Workbooks

Answer

Watchlists

Question 3

Which TWO Microsoft Purview solutions are used to discover and protect sensitive data across Microsoft 365, Azure, and on-premises environments?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map (B) is correct because it provides automated scanning and classification of sensitive data across Microsoft 365, Azure, and on-premises sources, creating a unified map of data assets and their sensitivity labels. Microsoft Purview Data Loss Prevention (DLP) (E) is correct because it enforces policies to detect and prevent unauthorized sharing or leakage of sensitive data across these same environments, integrating with the classification from Data Map. Together, they discover sensitive data via classification and protect it through policy enforcement.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Information Protection

Question 4

Refer to the exhibit. You are analyzing an Azure PowerShell script that checks a blob property. The output of the last command returns 'False'. What does this indicate about the blob storage configuration?

Accepted Answer

Access time tracking is disabled for the storage account.. The property 'IsAccessTimeTrackingEnabled' indicates whether access time tracking is enabled for the storage account. When set to 'False', it means access time tracking is disabled, which is used for lifecycle management policies. Option A is incorrect because diagnostic logging is unrelated to access time tracking. Option C is incorrect because immutability policy does not affect this property. Option D is incorrect because server-side encryption is independent of access time tracking.

Answer

Diagnostic logging is not configured for the container.

Answer

The blob has an immutability policy applied.

Answer

Server-side encryption is disabled for the blob.

Question 5

A company is implementing a Zero Trust security model. Which principle requires verifying every access request as if it originates from an uncontrolled network?

Accepted Answer

Verify explicitly. The 'Assume breach' principle is not about verifying requests. 'Verify explicitly' is the Zero Trust principle that mandates authenticating and authorizing every access request. 'Least privilege' limits access rights. 'Micro-segmentation' is a network isolation technique.

Answer

Least privilege

Answer

Micro-segmentation

Answer

Assume breach

Question 6

An organization uses Microsoft Purview Information Protection. They want to automatically apply a sensitivity label to documents containing credit card numbers. Which policy should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview Information Protection automatically apply sensitivity labels to documents and emails that match specified conditions, such as the presence of credit card numbers. This policy uses sensitive information types (e.g., Credit Card Number) to scan content and apply the label without user intervention, meeting the requirement for automatic labeling.

Answer

Retention policy

Answer

Sensitivity label policy

Answer

Data loss prevention policy

Question 7

A company uses Microsoft Sentinel with a workspace in the East US region. They want to ingest logs from Azure resources in West Europe. To minimize data transfer costs, what should they do?

Accepted Answer

Create a new Sentinel workspace in West Europe and ingest logs there. To minimize costs, the best practice is to create a Sentinel workspace in the same region as the data sources. Since West Europe resources are in West Europe, a workspace there is optimal. However, the question states the workspace is already in East US. To minimize transfer costs, they could create a new workspace in West Europe and ingest logs there, then use cross-workspace queries. But that adds complexity. Alternatively, they could continue to use the East US workspace and accept the costs. The best answer is to create a new workspace in West Europe.

Answer

Use Azure ExpressRoute to connect West Europe to East US

Answer

Configure data collection rules to filter logs at source

Answer

Use the existing workspace; inter-region costs are negligible

Question 8

Which TWO actions are part of the Microsoft Cybersecurity Reference Architecture (MCRA) for a Zero Trust implementation?

Accepted Answer

Treat identity as the primary security perimeter. The MCRA explicitly identifies identity as the primary security perimeter in a Zero Trust model, shifting trust from the network to user and device identity. This principle underpins all other controls, as every access request must be authenticated and authorized regardless of location.

Answer

Use a single security vendor for all solutions

Answer

Block all legacy authentication protocols

Answer

Require multifactor authentication for all users

Question 9

Which THREE components are included in Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR (Extended Detection and Response) is a unified security suite that natively integrates Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Endpoint. These three components work together to correlate signals across email, identity, and endpoint layers, providing a single-pane-of-glass view for threat detection and automated response. Microsoft Defender for Office 365 protects against email-based threats like phishing and malware, Defender for Identity monitors on-premises Active Directory and cloud identities for lateral movement and privilege escalation, and Defender for Endpoint provides endpoint detection and response (EDR) for Windows, macOS, Linux, Android, and iOS devices.

Answer

Microsoft Defender for IoT

Answer

Microsoft Defender for Cloud

Question 10

Which TWO are best practices for securing Microsoft Entra ID?

Accepted Answer

Use a Conditional Access policy to require MFA for all users. Requiring MFA via Conditional Access is a foundational security control that mitigates the risk of credential theft. Conditional Access policies allow granular enforcement based on user, location, device, and risk signals, making them more flexible than security defaults while still ensuring MFA is applied to all users.

Answer

Disable sign-in logs to reduce storage costs

Answer

Allow users to create Microsoft 365 groups without approval

Answer

Assign Global Administrator to all users for simplicity

Question 11

A company is designing a Zero Trust architecture for their hybrid identity environment. They plan to require multifactor authentication (MFA) for all users accessing sensitive applications. Which Microsoft Entra ID capability should they use to enforce MFA based on risk level?

Accepted Answer

Conditional Access. Conditional Access policies can enforce MFA based on sign-in risk and user risk. Option D is wrong because Identity Protection detects risks but doesn't enforce access controls by itself. Option B is wrong because PIM manages roles, not access conditions. Option A is wrong because SSPR is unrelated to MFA enforcement.

Answer

Self-service password reset

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra ID Protection

Question 12

Your organization is deploying Microsoft Copilot for Security and wants to ensure that the AI model does not expose sensitive data in its responses. You need to configure data loss prevention (DLP) policies that apply to Copilot interactions. Which Microsoft Purview capability should you use?

Accepted Answer

Data Loss Prevention policies. Microsoft Purview Data Loss Prevention (DLP) policies for Copilot are designed to prevent sensitive data from being exposed in AI interactions. These policies can scan prompts and responses for sensitive information and take actions like blocking or alerting. Communication Compliance (Option D) is intended for monitoring communications, such as emails and Teams messages, but not specifically for DLP in AI interactions. Therefore, DLP policies are the correct capability for this requirement.

Answer

eDiscovery

Answer

Information Protection and sensitivity labels

Answer

Communication Compliance

Question 13

Your company uses Microsoft Sentinel as its SIEM. You need to design a solution that automatically responds to high-severity incidents by creating a ticket in ServiceNow and notifying the security team via Teams. Which Sentinel feature should you configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel are designed to trigger automated responses to incidents based on conditions like severity. They can integrate with external systems via playbooks (Azure Logic Apps) to create ServiceNow tickets and send Teams notifications, making them the correct choice for this requirement.

Answer

Workbooks

Answer

Analytics rules

Answer

Hunting queries

Question 14

A manufacturing company wants to secure its IoT devices that run on Azure IoT Hub. They need to ensure that only authorized devices can connect and that firmware updates are signed. Which combination of Azure services should they use?

Accepted Answer

Azure IoT Hub Device Provisioning Service and Microsoft Defender for IoT. Azure IoT Hub Device Provisioning Service (DPS) enables authorized device connection via X.509 or TPM attestation. Microsoft Defender for IoT provides continuous security monitoring, but it does not manage firmware update signing. Ensuring firmware updates are signed requires a dedicated service such as Azure Device Update for IoT Hub or Azure Sphere. Since none of the options include such a service, none fully meets both requirements.

Answer

Microsoft Entra ID and Azure Policy

Answer

Azure Sphere and Azure Security Center

Answer

Microsoft Intune and Azure Automation

Question 15

Your company uses Microsoft Intune to manage corporate devices. The security team wants to prevent users from copying sensitive data from corporate apps to personal apps on mobile devices. Which Intune policy should you configure?

Accepted Answer

App protection policies. App protection policies (APP) are the correct Intune policy to prevent data transfer from corporate apps to personal apps on mobile devices. These policies apply at the application layer, allowing you to configure data protection settings such as 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' specifically for managed apps, regardless of the device enrollment state.

Answer

Device configuration policies

Answer

Windows Information Protection

Answer

Device compliance policies