SC-100 Design solutions that align with security best practices and priorities Practice Test 4 — 15 Questions

Question 1

Your company uses Microsoft Defender for Endpoint (MDE) and wants to integrate threat intelligence from an external source to improve detection. The security team needs to ingest custom indicators of compromise (IOCs) into MDE. Which feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Custom indicators (IOCs). The Custom Indicators (IOCs) feature in Microsoft Defender for Endpoint allows security teams to manually ingest and manage threat intelligence from external sources, such as IP addresses, URLs, domains, or file hashes. These indicators are then used by MDE to create or block alerts, enabling tailored detection beyond built-in threat intelligence feeds.

Answer

Advanced Hunting

Answer

Threat Analytics

Answer

Automated investigation and response

Question 2

Your organization is designing a Microsoft Sentinel solution to detect and respond to threats across multi-cloud environments (Azure, AWS, GCP). Which TWO components are essential for this design?

Accepted Answer

Data connectors for AWS and GCP. Data connectors are the foundational component for ingesting logs from external cloud providers into Microsoft Sentinel. For AWS, you typically use the AWS CloudTrail connector via S3 and SQS; for GCP, you use the GCP Security Command Center connector or a custom log ingestion pipeline. Without these connectors, Sentinel cannot receive telemetry from those environments, making multi-cloud detection impossible.

Answer

Azure Policy assignments

Answer

Microsoft Defender for Cloud

Answer

Azure Automation accounts

Question 3

Your company is implementing Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. The compliance team needs to monitor and block the sharing of credit card numbers in emails. Which THREE actions should they configure in a DLP policy?

Accepted Answer

Notify the user with a policy tip. Policy Tips are a core feature of Microsoft Purview DLP that provide real-time, non-blocking notifications to users when they attempt to share sensitive data like credit card numbers. This allows the compliance team to educate users and enforce policy without immediately disrupting workflow, which is a key requirement for monitoring and blocking scenarios.

Answer

Encrypt the email automatically

Answer

Apply a sensitivity label automatically

Question 4

Your organization is implementing a Zero Trust network architecture in Azure. Which TWO principles are foundational to Zero Trust?

Accepted Answer

Verify explicitly. 'Verify explicitly' is a core principle of Zero Trust, which mandates that every access request must be authenticated and authorized based on all available data points (e.g., user identity, device health, location) before granting access. This eliminates implicit trust based solely on network location, aligning with Azure's conditional access policies and Microsoft Entra ID authentication.

Answer

Use network segmentation

Answer

Rely on perimeter security

Answer

Trust but verify

Question 5

A security architect is designing a solution to detect and respond to advanced threats across email, endpoints, and identities. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct solution because it provides unified pre- and post-breach detection, investigation, and response across email, endpoints, and identities. It correlates signals from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single incident queue, enabling automated remediation of advanced multi-vector attacks.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 6

A company wants to enforce that all administrators use just-in-time (JIT) access to privileged roles in Microsoft Entra ID. Which feature should they enable?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by enabling time-bound and approval-based role activation. This directly meets the requirement to enforce JIT access for administrators, as PIM allows roles to be activated only when needed and for a limited duration, reducing standing access.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Protection

Question 7

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They need to ensure that all resources are compliant with the Payment Card Industry Data Security Standard (PCI DSS). What should they do?

Accepted Answer

Enable the PCI DSS regulatory compliance standard in Microsoft Defender for Cloud. Microsoft Defender for Cloud includes built-in regulatory compliance standards, such as PCI DSS, that can be enabled directly. Once enabled, Defender for Cloud continuously assesses your Azure subscriptions against the PCI DSS controls and provides a compliance score with detailed remediation steps. This is the simplest and most effective method to monitor compliance without creating custom policies or blueprints.

Answer

Create Azure Policy initiatives to enforce PCI DSS controls

Answer

Use Microsoft Purview to classify data and apply PCI DSS labels

Answer

Deploy Azure Blueprints that include PCI DSS policies

Question 8

A security architect is designing a solution to protect sensitive data stored in SharePoint Online from being shared with unauthorized users. The solution must block sharing of files containing credit card numbers when shared externally. What should they use?

Accepted Answer

Create a Microsoft Purview sensitivity label that automatically applies encryption and blocks external sharing when credit card numbers are detected. Microsoft Purview sensitivity labels can be configured with automatic classification for sensitive data types (e.g., credit card numbers) and enforce encryption while blocking external sharing. This directly meets the requirement to prevent unauthorized external sharing of files containing credit card numbers in SharePoint Online.

Answer

Configure a conditional access policy to block access from untrusted networks when credit card numbers are detected

Answer

Create a Microsoft Purview Data Loss Prevention (DLP) policy that blocks external sharing when credit card numbers are detected

Answer

Use Azure Information Protection to label and protect files with credit card numbers

Question 9

Which TWO actions align with the Zero Trust principle of 'verify explicitly'? (Select two.)

Accepted Answer

Use conditional access policies to evaluate user and device risk before granting access. Conditional access policies evaluate real-time signals such as user identity, device compliance, location, and risk level before granting access to resources. This aligns with the Zero Trust principle of 'verify explicitly' by requiring continuous validation of every access request rather than trusting based on network location alone.

Answer

Deploy a VPN for remote access

Answer

Encrypt all data at rest

Answer

Implement network segmentation to limit lateral movement

Question 10

Which THREE are security best practices for Microsoft Entra ID? (Select three.)

Accepted Answer

Block legacy authentication protocols. Legacy authentication protocols (e.g., POP3, SMTP, IMAP4, and older versions of Office clients) do not support modern security controls like multifactor authentication (MFA) or conditional access. Blocking these protocols is a critical security best practice because they bypass MFA requirements, leaving accounts vulnerable to password spray and credential-stuffing attacks. Microsoft Entra ID allows administrators to block legacy authentication via Conditional Access policies or tenant-wide settings.

Answer

Disable self-service password reset for users

Answer

Synchronize all on-premises user accounts to Microsoft Entra ID

Question 11

Which TWO are recommended practices for securing Microsoft 365 workloads? (Select two.)

Accepted Answer

Enable unified audit logging in Microsoft Purview. Unified audit logging in Microsoft Purview is a recommended practice because it provides a centralized, searchable record of user and admin activities across Microsoft 365 workloads, which is essential for security investigations, compliance, and threat detection. Enabling this logging ensures that events such as mailbox access, file downloads, and admin role changes are captured and retained, supporting incident response and forensic analysis.

Answer

Allow external sharing for all SharePoint sites

Answer

Disable multifactor authentication for users who access from trusted IPs

Answer

Allow all third-party apps to access Microsoft 365 data

Question 12

Refer to the exhibit. You are reviewing a conditional access policy. What is the effect of this policy?

Accepted Answer

Requires multifactor authentication for Global Administrators and Security Administrators. The exhibit shows a conditional access policy that targets the 'Global Administrators' and 'Security Administrators' directory roles, and the policy is configured to 'Require multifactor authentication' for those roles. The policy is enabled (as indicated by the 'On' toggle), so it actively enforces MFA for members of those two admin roles, blocking access if they do not complete MFA. This aligns with the principle of securing high-privilege roles with stronger authentication.

Answer

The policy is disabled and has no effect

Answer

Blocks access for all users

Answer

Requires multifactor authentication for all users

Question 13

Refer to the exhibit. A security analyst runs this KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Identify the top 10 users who have been targeted by Mimikatz attacks. The KQL query uses the `summarize` operator with `count()` to aggregate Mimikatz alerts by `UserPrincipalName`, then sorts the results by count in descending order and limits the output to 10 rows. This directly identifies the top 10 users who have been targeted by Mimikatz attacks, as each alert represents a detection event associated with a specific user.

Answer

Show the severity of Mimikatz alerts for each user

Answer

List all Mimikatz alerts with detailed entity information

Answer

Count the total number of Mimikatz alerts in the last 7 days

Question 14

Refer to the exhibit. You are reviewing an ARM template snippet for an Azure Storage container. Which security best practice does this configuration enforce?

Accepted Answer

Disables anonymous public access to the container. The ARM template snippet sets the `publicAccess` property of the container to `None`. This explicitly disables anonymous public access to the container, enforcing the security best practice of preventing unauthenticated access to Azure Storage data. By default, Azure Storage containers allow anonymous read access if enabled at the account level, but this configuration overrides that to block any public requests.

Answer

Allows public access from the internet

Answer

Configures a firewall rule to restrict access to specific IPs

Answer

Enables encryption at rest for the container

Question 15

Your organization uses Microsoft Defender XDR for incident response. You need to design a process to automatically isolate a compromised device when a high-severity incident is triggered. Which automation approach should you use?

Accepted Answer

Use automation rules in Microsoft Sentinel with a playbook that runs a Defender for Endpoint isolation action. Microsoft Sentinel's automation rules can directly trigger a playbook (Azure Logic App) that executes the Microsoft Defender for Endpoint 'Isolate device' action. This provides near-real-time, event-driven isolation without polling, aligning with the requirement to automatically isolate a compromised device when a high-severity incident is triggered in Defender XDR.

Answer

Create a compliance policy in Microsoft Intune that marks the device as noncompliant

Answer

Configure an Azure Automation runbook to poll Defender alerts and isolate devices

Answer

Set up a Power Automate flow triggered by email notifications from Defender