SC-100 Design solutions that align with security best practices and priorities Practice Test 5 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel for security operations. You need to design a solution to automatically respond to a DDoS attack detected by Azure DDoS Protection. The response should include blocking the attacker's IP address in Azure Firewall and sending an alert to the security team. Which approach should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an automation rule in Microsoft Sentinel that triggers a playbook to block the IP in Azure Firewall. Microsoft Sentinel automation rules can trigger a playbook (an Azure Logic App) when a DDoS attack detection alert fires. The playbook can execute an action to block the attacker's IP address in Azure Firewall via its REST API or PowerShell cmdlets, and simultaneously send an alert to the security team (e.g., via email or Teams). This provides an automated, orchestrated response directly from the SIEM, aligning with security operations best practices.

Answer

Configure an alert rule in Azure Monitor to send an email to the security team

Answer

Use Azure Policy to deny network traffic from the attacker's IP range

Answer

Configure a resource lock on the Azure Firewall to prevent changes

Question 2

Your organization is deploying Microsoft Copilot for Security (Microsoft 365 Copilot). You need to design a solution that ensures Copilot queries are audited and that access to Copilot is restricted to authorized users based on their role. Which Microsoft Purview capabilities should you use together?

Accepted Answer

Audit (Standard) and Communication Compliance. Audit (Standard) captures and logs all Copilot for Security queries, providing a detailed record of who performed a query, what was asked, and when. Communication Compliance enables you to define policies to review these audit logs for potential policy violations, such as unauthorized access or inappropriate content, and can trigger alerts or remediation actions. Together, they fulfill the requirement for auditing queries and provide oversight to help ensure that only authorized users are accessing Copilot, by detecting and alerting on unauthorized usage.

Answer

Data Lifecycle Management and Records Management

Answer

Data Loss Prevention (DLP) and Insider Risk Management

Answer

eDiscovery and Compliance Manager

Question 3

Your organization is designing a secure access solution for a partner company that needs to access specific SharePoint Online sites. You need to implement Microsoft Entra ID B2B collaboration. Which THREE configurations are essential for a secure B2B collaboration setup?

Accepted Answer

Configure cross-tenant access settings in Microsoft Entra ID. Cross-tenant access settings in Microsoft Entra ID allow you to control inbound and outbound access for B2B collaboration, including trust settings for MFA and device compliance. This is essential to define which partner tenants can access your resources and under what conditions, preventing unauthorized access.

Answer

Use B2B direct connect for SharePoint site access

Answer

Allow all external domains to invite users without restrictions

Question 4

Your organization is implementing Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to design a policy that prevents users from sharing credit card numbers via email. Which THREE components are required to build this DLP policy?

Accepted Answer

A rule that includes a sensitive info type for credit card numbers. A DLP policy must include a rule that defines the sensitive data to detect. For credit card numbers, Microsoft Purview provides a built-in sensitive info type (SIT) that uses pattern matching, checksum validation, and keyword proximity to accurately identify credit card numbers. Without this rule, the policy would have no criteria to trigger actions.

Answer

A policy tip to warn users before sending

Answer

A trainable classifier for financial data

Question 5

You are designing a Zero Trust architecture for a company that uses Microsoft Entra ID and Microsoft Intune. The security team wants to enforce device compliance before granting access to cloud apps. Which policy should you implement?

Accepted Answer

Microsoft Entra Conditional Access policy requiring compliant device. Microsoft Entra Conditional Access policies can require that devices are marked as compliant by Microsoft Intune before granting access to cloud apps. This directly enforces device compliance as a condition for access, which is a core Zero Trust principle of verifying every access request based on device health.

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Azure AD Identity Protection sign-in risk policy

Question 6

Your organization is migrating on-premises workloads to Azure and wants to use Microsoft Defender for Cloud to secure the environment. The compliance team requires that all critical vulnerabilities be remediated within 30 days. What is the most efficient way to track and enforce this?

Accepted Answer

Use Microsoft Defender for Cloud regulatory compliance dashboard with a custom initiative. Microsoft Defender for Cloud's regulatory compliance dashboard allows you to add a custom initiative (e.g., based on the Microsoft Cloud Security Benchmark or your own policies) to map security recommendations to compliance controls. By creating a custom initiative with policies that audit for critical vulnerabilities, you can track compliance status in the dashboard. This provides a centralized view of non-compliant resources, enabling your team to monitor remediation against the 30-day requirement. Unlike auto-remediation, which immediately fixes issues, the dashboard is designed for tracking and demonstrating compliance over time, making it the most efficient approach for enforcing the SLA through visibility and accountability.

Answer

Configure Azure Policy to auto-remediate all Defender for Cloud recommendations

Answer

Create a custom Azure Dashboard and manually update it weekly

Answer

Enable automatic VM patching in Azure Update Manager

Question 7

A company wants to use Microsoft Defender XDR to detect and respond to advanced persistent threats (APTs). They have deployed Defender for Endpoint, Defender for Office 365, and Defender for Identity. What additional step is critical to correlate signals across these products?

Accepted Answer

Enable the Microsoft Defender XDR unified experience in the portal. Enabling the Microsoft Defender XDR unified experience in the portal is critical because it aggregates and correlates signals from Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single incident queue and unified alert timeline. Without this step, each product operates in isolation, preventing cross-product detection of multi-stage APT attacks that span endpoints, email, and identity. The unified experience activates the Microsoft 365 Defender portal's correlation engine, which uses machine learning to link related alerts across domains into a single incident.

Answer

Configure Microsoft Defender for Cloud servers plan

Answer

Assign Microsoft 365 E5 licenses to all users

Answer

Deploy Microsoft Defender for Office 365 Safe Links

Question 8

Your organization uses Microsoft Intune to manage devices. You need to ensure that only devices with a specific minimum OS version can access corporate resources. Which configuration should you use?

Accepted Answer

Device compliance policy with minimum OS version rule. A device compliance policy with a minimum OS version rule is the correct choice because Intune compliance policies evaluate device attributes—including OS version—against defined rules before granting access to corporate resources. When a device fails the minimum OS version check, Conditional Access blocks access until the device is updated or remediated, ensuring only compliant devices can connect.

Answer

Device configuration profile

Answer

Enrollment restrictions

Answer

App protection policy

Question 9

A company uses Microsoft Entra ID with P2 licenses. They want to implement a Zero Trust approach that requires step-up authentication for accessing high-value data in SharePoint. The solution must use risk-based policies and minimize user friction. Which combination should you recommend?

Accepted Answer

Microsoft Entra Conditional Access with sign-in risk policy and authentication context for sensitive data. It combines Conditional Access with a sign-in risk policy (from Identity Protection) and an authentication context that is applied to sensitive SharePoint data. This enforces step-up authentication only when risk is detected and the user accesses high-value data, minimizing friction for low-risk sessions while meeting Zero Trust requirements.

Answer

Microsoft Entra Conditional Access with trusted locations policy

Answer

Azure AD Conditional Access with MFA for all SharePoint access

Answer

Microsoft Entra Identity Protection user risk policy with MFA

Question 10

Your organization plans to use Microsoft Defender for Cloud to secure Azure resources. The security team wants to continuously assess compliance against the CIS Azure Foundations Benchmark. What should you do?

Accepted Answer

Enable the CIS Azure Foundations Benchmark in Defender for Cloud regulatory compliance dashboard. Microsoft Defender for Cloud's regulatory compliance dashboard includes built-in support for the CIS Azure Foundations Benchmark. By enabling this standard in the dashboard, Defender for Cloud continuously assesses your Azure resources against all CIS controls, providing automated compliance scores and remediation recommendations without requiring custom definitions or manual policy assignments.

Answer

Create a custom Azure Blueprint for CIS

Answer

Deploy Azure Security Center (legacy)

Answer

Assign Azure Policy for all CIS controls manually

Question 11

A company uses Microsoft Entra ID and wants to enable passwordless authentication for all users to reduce phishing risks. Users are already using Microsoft Authenticator for MFA. Which passwordless method should you prioritize?

Accepted Answer

Microsoft Authenticator passwordless sign-in. The organization already uses Microsoft Authenticator for MFA, making the transition to passwordless sign-in via Authenticator the most seamless and cost-effective path. This method leverages the existing app registration and push notification infrastructure, allowing users to authenticate with a biometric or PIN gesture without deploying additional hardware or certificates.

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Answer

Certificate-based authentication

Question 12

Which TWO are best practices for designing a Microsoft 365 Defender (XDR) deployment to ensure optimal detection and response?

Accepted Answer

Configure automated investigation and response for common incident types. B is correct because configuring automated investigation and response (AIR) for common incident types is a core best practice in Microsoft 365 Defender. AIR leverages built-in playbooks to automatically triage, investigate, and remediate alerts, reducing mean time to respond (MTTR) and allowing security teams to focus on complex threats. This aligns with the XDR principle of using automation to handle high-volume, predictable incidents efficiently.

Answer

Deploy Defender for Endpoint on unsupported operating systems with limited functionality

Answer

Rely solely on manual alert triage to avoid missing complex attacks

Answer

Configure each workload (Endpoint, Identity, etc.) in SILO mode to avoid false positives

Question 13

Which THREE are components of Microsoft's Zero Trust model?

Accepted Answer

Data. Data is one of the six foundational pillars of Microsoft's Zero Trust model (identities, endpoints, data, apps, infrastructure, and network). The Zero Trust model explicitly treats data as a critical asset that must be protected regardless of location, using encryption, labeling, and Data Loss Prevention (DLP) policies to enforce least-privilege access and continuous validation.

Answer

Assume breach

Answer

Microsoft Defender for Cloud

Question 14

Which TWO should you implement to protect privileged accounts in Microsoft Entra ID?

Accepted Answer

Conditional Access policies requiring MFA for privileged roles. Conditional Access policies can enforce multifactor authentication (MFA) specifically for users assigned to privileged roles in Microsoft Entra ID. This directly protects those accounts by requiring a second authentication factor, reducing the risk of credential theft or reuse. It is a core identity security control recommended by Microsoft for privileged access.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Cloud security score

Answer

Microsoft Defender Vulnerability Management

Question 15

A company is designing a Zero Trust security strategy. They want to ensure that all access requests are authenticated, authorized, and encrypted before granting access. Which Microsoft security solution should they use as the central policy engine?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the correct central policy engine because it provides identity-based conditional access policies that authenticate, authorize, and enforce encryption (e.g., via device compliance or app protection policies) before granting access. It acts as the policy decision point (PDP) in a Zero Trust architecture, evaluating signals like user risk, device state, and location to allow or deny access.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Intune