SC-100 Design solutions that align with security best practices and priorities Practice Test 4 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel as its SIEM. The security team needs to detect brute-force attacks against Azure VMs by analyzing Windows Security Event logs. Which data connector should you enable?

Accepted Answer

Windows Security Events via AMA connector. The Windows Security Events via AMA connector (D) is correct because it ingests Windows Event Logs (specifically Security logs with Event ID 4625 for failed logons) from Azure VMs into Microsoft Sentinel, enabling detection of brute-force patterns. This connector uses the Azure Monitor Agent (AMA) to collect events, which is the recommended method for modern Windows event collection in Sentinel.

Answer

Office 365 connector

Answer

Azure Activity log connector

Answer

Microsoft Defender for Cloud connector

Question 2

Your company is migrating on-premises Active Directory to Microsoft Entra ID. The security team requires that users must use passwordless authentication methods for all sign-ins. Which Microsoft Entra ID feature should you enable to support passwordless authentication?

Accepted Answer

Microsoft Entra ID passwordless authentication methods. Option A is correct because Microsoft Entra ID passwordless authentication methods (such as Windows Hello for Business, FIDO2 security keys, and Microsoft Authenticator) are the native features designed to eliminate passwords entirely. These methods satisfy the security team's requirement by enabling users to sign in without a password, using biometrics or cryptographic keys instead.

Answer

Password hash synchronization

Answer

Seamless Single Sign-On (Seamless SSO)

Answer

Pass-through authentication

Question 3

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The compliance team wants to ensure that all storage accounts have secure transfer required enabled. Which action should you take in Defender for Cloud?

Accepted Answer

Implement the 'Secure transfer to storage accounts should be enabled' recommendation. The correct action is to implement the 'Secure transfer to storage accounts should be enabled' recommendation because Microsoft Defender for Cloud provides built-in security recommendations that map to specific controls. This recommendation directly checks whether the 'Secure transfer required' property is enabled on each storage account, and if not, it provides remediation steps to enforce HTTPS-only traffic, which aligns with the compliance team's requirement.

Answer

Configure the regulatory compliance dashboard

Answer

Review the secure score

Answer

Enable the 'Cloud Security Posture Management' plan

Question 4

Your organization is adopting a Zero Trust network strategy. Which Microsoft solution should you use to implement micro-segmentation and enforce identity-based access controls for on-premises and cloud resources?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access enforces identity-based access policies, which is a core component of Zero Trust. Option B is wrong because Microsoft Defender for Cloud Apps is a CASB. Option C is wrong because Microsoft Intune manages devices. Option D is wrong because Microsoft Sentinel is a SIEM.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 5

Your company uses Microsoft Purview to classify and label sensitive data. The data protection team needs to automatically apply a 'Confidential' label to documents that contain a custom sensitive info type for employee IDs. Which should you create?

Accepted Answer

A custom sensitive information type and an auto-labeling policy. To automatically apply a 'Confidential' label based on the presence of a custom sensitive info type (employee IDs), you need both a custom sensitive information type (SIT) to define the pattern and an auto-labeling policy to trigger the label application. The auto-labeling policy uses the SIT to scan documents and automatically applies the specified sensitivity label when a match is found. This is the only option that combines the detection mechanism with automated labeling.

Answer

A trainable classifier

Answer

A sensitivity label

Answer

A retention label

Question 6

Your organization uses Microsoft Sentinel for security operations. The SOC team wants to automatically disable a compromised user account in Microsoft Entra ID when a high-severity alert is generated. Which automation method should you use?

Accepted Answer

An automation rule with a playbook. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when a high-severity alert fires. The playbook can then execute an action to disable the user account in Microsoft Entra ID via the Microsoft Graph API. This is the correct method because it provides the necessary integration between Sentinel alerts and Entra ID identity remediation.

Answer

A workbook

Answer

A KQL query in a hunting rule

Answer

An analytics rule

Question 7

Which TWO Microsoft security solutions can help enforce Zero Trust principles by verifying identity and device health before granting access to resources?

Accepted Answer

Microsoft Intune. Microsoft Entra ID Conditional Access verifies identity and enforces policies. Microsoft Intune manages device compliance and health. Both are used together for Zero Trust access. Option C is wrong because Microsoft Defender for Cloud Apps focuses on cloud app security. Option D is wrong because Microsoft Sentinel is a SIEM. Option E is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 8

Which THREE components are essential for implementing a successful SIEM strategy using Microsoft Sentinel?

Accepted Answer

Automation rules. Automation rules are essential because they allow you to centrally manage and automate incident response actions, such as assigning incidents, running playbooks, or triggering suppression logic, based on specific conditions. Without automation rules, your SOC would have to manually handle every alert, which is not scalable for a successful SIEM strategy.

Answer

Workbooks

Answer

Watchlists

Question 9

Which TWO Microsoft Purview solutions are used to discover and protect sensitive data across Microsoft 365, Azure, and on-premises environments?

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map (B) is correct because it provides automated scanning and classification of sensitive data across Microsoft 365, Azure, and on-premises sources, creating a unified map of data assets and their sensitivity labels. Microsoft Purview Data Loss Prevention (DLP) (E) is correct because it enforces policies to detect and prevent unauthorized sharing or leakage of sensitive data across these same environments, integrating with the classification from Data Map. Together, they discover sensitive data via classification and protect it through policy enforcement.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Information Protection

Question 10

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. The policy is enabled but users with the Global Administrator role are not being prompted for MFA. What is the most likely reason?

Accepted Answer

The policy does not include any users except by role.. Option A is correct because the policy is scoped to 'All users' but the 'Include' filter is set to 'All users' while the 'Exclude' filter includes 'Global Administrator' role. Since the policy excludes Global Administrators, they are not subject to the MFA grant control, even though the policy is enabled. The JSON snippet shows the policy is enabled and includes all users by default, but the exclusion of the Global Administrator role overrides the inclusion, so they are never evaluated for MFA.

Answer

The policy does not include any applications.

Answer

The grant control requires a compliant device instead of MFA.

Answer

The policy state is disabled.

Question 11

Refer to the exhibit. You are analyzing an Azure PowerShell script that checks a blob property. The output of the last command returns 'False'. What does this indicate about the blob storage configuration?

Accepted Answer

Access time tracking is disabled for the storage account.. The property 'IsAccessTimeTrackingEnabled' is a blob storage setting that, when enabled, tracks the last access time of blobs for lifecycle management. A value of 'False' means access time tracking is disabled. Option A is wrong because access time tracking is not related to encryption. Option B is wrong because it is not about immutability. Option D is wrong because it is not about logging.

Answer

Diagnostic logging is not configured for the container.

Answer

The blob has an immutability policy applied.

Answer

Server-side encryption is disabled for the blob.

Question 12

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

To identify accounts with multiple failed logon attempts from a single IP.. The query uses the `SigninLogs` table and filters for `ResultType == 50057`, which specifically indicates a failed user sign-in due to an incorrect password. By then summarizing `count()` by `IPAddress` and `UserPrincipalName` and filtering for `FailedAttempts > 5`, the query identifies accounts that have experienced multiple failed logon attempts from a single IP address. This aligns with detecting brute-force or password-spray attacks, making option A correct.

Answer

To list all successful logon events in the last 7 days.

Answer

To calculate the total number of failed logons per hour.

Answer

To detect account lockout events.

Question 13

A company is implementing a Zero Trust security model. Which principle requires verifying every access request as if it originates from an uncontrolled network?

Accepted Answer

Verify explicitly. The 'Assume breach' principle is not about verifying requests. 'Verify explicitly' is the Zero Trust principle that mandates authenticating and authorizing every access request. 'Least privilege' limits access rights. 'Micro-segmentation' is a network isolation technique.

Answer

Least privilege

Answer

Micro-segmentation

Answer

Assume breach

Question 14

A company uses Microsoft Entra ID for identity management. They want to ensure that only managed devices can access corporate email. Which Conditional Access policy setting should be configured?

Accepted Answer

Require device to be marked as compliant. To ensure only managed devices can access corporate email, you need to enforce device compliance. The Conditional Access policy setting 'Require device to be marked as compliant' checks that the device is enrolled in Microsoft Intune and meets all compliance policies (e.g., encryption, OS version, jailbreak detection) before granting access. This directly restricts access to managed devices only.

Answer

Require multifactor authentication

Answer

Block legacy authentication

Answer

Require approved client app

Question 15

A security team is designing a Microsoft Sentinel deployment. They need to minimize costs while ensuring critical alerts are always processed. Which data retention and ingestion strategy should they use?

Accepted Answer

Use Basic Logs for high-volume low-value data and Analytics Logs for critical alerts. Option D is correct because it aligns with cost optimization and reliability requirements by using Basic Logs for high-volume, low-value data (e.g., firewall logs) and reserving Analytics Logs for critical alerts that require full query capabilities and interactive retention. This tiered approach ensures critical alerts are always processed with full fidelity while reducing storage costs for less important data.

Answer

Use Basic Logs for all data and retain for 90 days

Answer

Use Analytics Logs for all data and retain for 30 days

Answer

Use Basic Logs for critical alerts and retain for 30 days