SC-100 Design solutions that align with security best practices and priorities Practice Test 5 — 15 Questions

Question 1

A company deploys Microsoft Defender for Cloud Apps. They need to detect anomalous behavior in user activities across multiple cloud apps. Which feature should they enable?

Accepted Answer

Anomaly detection policies. Anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify unusual patterns in user activities across connected cloud apps, such as impossible travel, mass file downloads, or ransomware-like behavior. These policies leverage machine learning and behavioral analytics to establish a baseline of normal user behavior and trigger alerts when deviations occur, making them the correct choice for detecting anomalous behavior.

Answer

Session policies

Answer

Data loss prevention policies

Answer

App governance

Question 2

An organization uses Microsoft Purview Information Protection. They want to automatically apply a sensitivity label to documents containing credit card numbers. Which policy should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview Information Protection automatically apply sensitivity labels to documents and emails that match specified conditions, such as the presence of credit card numbers. This policy uses sensitive information types (e.g., Credit Card Number) to scan content and apply the label without user intervention, meeting the requirement for automatic labeling.

Answer

Retention policy

Answer

Sensitivity label policy

Answer

Data loss prevention policy

Question 3

A company is using Microsoft Intune to manage devices. They need to ensure that only devices with a specific operating system version can access corporate resources. Which Intune policy should they use?

Accepted Answer

Compliance policy. Compliance policies in Microsoft Intune define the rules that devices must meet to be considered compliant, such as requiring a specific operating system version. When a device is marked non-compliant, Conditional Access policies can block access to corporate resources. This directly enforces the requirement that only devices with the correct OS version can access company data.

Answer

App protection policy

Answer

Enrollment restriction

Answer

Device configuration policy

Question 4

A company wants to use Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. Which component enables this correlation?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (the new name for Microsoft 365 Defender) is the unified pre- and post-breach enterprise defense suite that natively correlates signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Its correlation engine uses machine learning and the Microsoft Intelligent Security Graph to fuse alerts across these domains into a single incident, enabling security teams to see the full attack chain from email to endpoint to identity.

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 5

A company uses Microsoft Sentinel with a workspace in the East US region. They want to ingest logs from Azure resources in West Europe. To minimize data transfer costs, what should they do?

Accepted Answer

Create a new Sentinel workspace in West Europe and ingest logs there. To minimize costs, the best practice is to create a Sentinel workspace in the same region as the data sources. Since West Europe resources are in West Europe, a workspace there is optimal. However, the question states the workspace is already in East US. To minimize transfer costs, they could create a new workspace in West Europe and ingest logs there, then use cross-workspace queries. But that adds complexity. Alternatively, they could continue to use the East US workspace and accept the costs. The best answer is to create a new workspace in West Europe.

Answer

Use Azure ExpressRoute to connect West Europe to East US

Answer

Configure data collection rules to filter logs at source

Answer

Use the existing workspace; inter-region costs are negligible

Question 6

A company uses Microsoft Entra ID Governance. They need to automate the process of granting access to a SaaS application based on the user's department attribute. Which feature should they use?

Accepted Answer

Entitlement management. Entitlement management in Microsoft Entra ID Governance allows you to create access packages that define collections of resources (like SaaS apps) and policies for who can request access. By configuring a dynamic membership rule based on the user's department attribute, you can automate granting access to the SaaS application without manual intervention. This directly meets the requirement to automate access based on a user attribute.

Answer

Lifecycle workflows

Answer

Access reviews

Answer

Privileged identity management

Question 7

Which TWO actions are part of the Microsoft Cybersecurity Reference Architecture (MCRA) for a Zero Trust implementation?

Accepted Answer

Treat identity as the primary security perimeter. Option C is correct because the MCRA explicitly identifies identity as the primary security perimeter in a Zero Trust model, shifting trust from the network to user and device identity. This principle underpins all other controls, as every access request must be authenticated and authorized regardless of location.

Answer

Use a single security vendor for all solutions

Answer

Block all legacy authentication protocols

Answer

Require multifactor authentication for all users

Question 8

Which THREE components are included in Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR (Extended Detection and Response) is a unified security suite that natively integrates Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Endpoint. These three components work together to correlate signals across email, identity, and endpoint layers, providing a single-pane-of-glass view for threat detection and automated response. Microsoft Defender for Office 365 protects against email-based threats like phishing and malware, Defender for Identity monitors on-premises Active Directory and cloud identities for lateral movement and privilege escalation, and Defender for Endpoint provides endpoint detection and response (EDR) for Windows, macOS, Linux, Android, and iOS devices.

Answer

Microsoft Defender for IoT

Answer

Microsoft Defender for Cloud

Question 9

Which TWO are best practices for securing Microsoft Entra ID?

Accepted Answer

Use a Conditional Access policy to require MFA for all users. Option A is correct because requiring MFA via Conditional Access is a foundational security control that mitigates the risk of credential theft. Conditional Access policies allow granular enforcement based on user, location, device, and risk signals, making them more flexible than security defaults while still ensuring MFA is applied to all users.

Answer

Disable sign-in logs to reduce storage costs

Answer

Allow users to create Microsoft 365 groups without approval

Answer

Assign Global Administrator to all users for simplicity

Question 10

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. What is the effect of this policy?

Accepted Answer

Blocks sign-ins from users with high user risk. The policy JSON specifies `"userRiskLevels": ["high"]` under the conditions block, which means it targets only users whose user risk level is assessed as high by Microsoft Entra ID Protection. The grant control is set to `"builtInControls": ["block"]`, so the policy blocks sign-ins for those high-risk users. Option B is correct because the policy explicitly blocks sign-ins from users with high user risk, not sign-in risk or all users.

Answer

Blocks sign-ins from locations with high sign-in risk

Answer

Blocks all sign-ins from any user

Answer

Requires multifactor authentication for high-risk users

Question 11

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Identify malware alerts on unmanaged devices. The query uses the `DeviceInfo` table to filter for devices where `IsManaged` is `false`, then joins with `SecurityAlert` to find alerts where `AlertName` contains 'Malware'. This specifically identifies malware alerts generated on unmanaged devices, not all malware alerts or a general device inventory.

Answer

Correlate malware alerts with device OS version

Answer

List all malware alerts in the last 7 days

Answer

Show device inventory for unmanaged devices

Question 12

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. Which security best practice is implemented?

Accepted Answer

Deny all network traffic by default. The template sets supportsHttpsTrafficOnly to true (enforces HTTPS) and minimumTlsVersion to TLS1_2 (requires TLS 1.2). It also sets networkAcls defaultAction to Deny (denies all traffic by default). All these are security best practices. However, the question asks for which practice is implemented; the most notable is the network ACL default deny. The answer could also be enforcing HTTPS. But typical exam focuses on network access restriction.

Answer

Enforce HTTPS traffic only

Answer

Restrict network access by IP address

Answer

Enable soft delete for blobs

Question 13

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to prioritize remediation of high-severity findings based on the greatest potential business impact. Which security policy or framework should you configure to align remediation with business priorities?

Accepted Answer

Enable the Regulatory Compliance dashboard. The Regulatory Compliance dashboard in Microsoft Defender for Cloud allows you to map security controls to specific regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS) and track compliance posture. By selecting a framework that aligns with your organization's business obligations (e.g., a standard required by customers or regulators), you can prioritize remediation of high-severity findings based on the greatest potential business impact, such as fines or loss of certification.

Answer

Use the Azure Security Benchmark initiative

Answer

Set up workflow automation for high-severity findings

Answer

Configure the Secure Score dashboard

Question 14

A company is designing a Zero Trust architecture for their hybrid identity environment. They plan to require multifactor authentication (MFA) for all users accessing sensitive applications. Which Microsoft Entra ID capability should they use to enforce MFA based on risk level?

Accepted Answer

Conditional Access. Option D is correct because Conditional Access policies can enforce MFA based on sign-in risk and user risk. Option A is wrong because Identity Protection detects risks but doesn't enforce access controls by itself. Option B is wrong because PIM manages roles, not access conditions. Option C is wrong because SSPR is unrelated to MFA enforcement.

Answer

Self-service password reset

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra ID Protection

Question 15

Your organization is deploying Microsoft Copilot for Security and wants to ensure that the AI model does not expose sensitive data in its responses. You need to configure data loss prevention (DLP) policies that apply to Copilot interactions. Which Microsoft Purview capability should you use?

Accepted Answer

Communication Compliance. Communication Compliance in Microsoft Purview is specifically designed to detect and prevent sensitive data exposure in communication channels, including Microsoft Copilot for Security interactions. It allows you to configure policies that scan AI prompts and responses for sensitive information, such as credit card numbers or confidential business data, and take automated actions like blocking or alerting. This makes it the correct capability for DLP in Copilot contexts, as it directly addresses the risk of AI models inadvertently leaking sensitive data.

Answer

eDiscovery

Answer

Data Loss Prevention policies

Answer

Information Protection and sensitivity labels