SC-100 Design solutions that align with security best practices and priorities Practice Test 6 — 15 Questions

Question 1

A multinational corporation is implementing a privileged access strategy. They need to ensure that all users with permanent administrative roles sign in using phishing-resistant authentication methods. Which Microsoft Entra ID feature should they enforce?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authentication Strengths in Conditional Access. Authentication Strengths in Conditional Access allows organizations to enforce specific authentication methods, such as FIDO2 security keys or certificate-based authentication, which are phishing-resistant. This directly meets the requirement to ensure users with permanent administrative roles use phishing-resistant methods, unlike general MFA policies that may allow weaker methods like SMS or OTP.

Answer

Privileged Identity Management (PIM) with access reviews

Answer

Multifactor authentication (MFA) with Conditional Access

Answer

Conditional Access policies requiring MFA for all admins

Question 2

A company is designing a security operations center (SOC). They want to use Microsoft Sentinel as their SIEM. They need to ensure that all security events from on-premises servers are collected. Which data connector should they configure?

Accepted Answer

Windows Security Events via Azure Monitor Agent (AMA). The Windows Security Events via Azure Monitor Agent (AMA) connector is the recommended method for collecting security events from on-premises Windows servers into Microsoft Sentinel. AMA is the current generation agent that supports data collection rules (DCRs) for granular filtering and is fully supported by Sentinel, replacing the legacy Log Analytics Agent. This ensures comprehensive collection of Windows security logs such as Event ID 4625 (failed logons) and 4688 (process creation) for SOC analysis.

Answer

Windows Firewall via Legacy Agent

Answer

Syslog via AMA

Answer

Azure Activity Log

Question 3

A company is implementing Microsoft Purview to protect sensitive data in SharePoint Online. They need to automatically apply a 'Highly Confidential' label to documents that contain credit card numbers. What should they create?

Accepted Answer

An auto-labeling policy for sensitivity labels. Microsoft Purview auto-labeling policies for sensitivity labels can automatically detect sensitive data types (e.g., credit card numbers) in SharePoint Online documents and apply a 'Highly Confidential' label without user intervention. This meets the requirement for automatic, policy-driven labeling based on content inspection.

Answer

A communication compliance policy

Answer

A data loss prevention (DLP) rule

Answer

A manual labeling policy

Question 4

A company uses Microsoft Intune to manage devices. They want to ensure that all devices accessing corporate email are compliant with security policies before they can connect. Which feature should they enable?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it enforces compliance-based access control at the authentication layer. By integrating with Intune compliance policies, Conditional Access can block or allow device access to corporate email (e.g., Exchange Online) based on real-time compliance status, ensuring only compliant devices can connect.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Intune App Protection Policies

Answer

Mobile Device Management (MDM) enrollment

Question 5

A company is implementing Microsoft Defender for Cloud to protect their Azure environment. Which TWO of the following are security best practices that should be enabled? (Choose two.)

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is a core feature of Microsoft Defender for Cloud that continuously assesses your Azure environment against security benchmarks (e.g., Azure Security Benchmark) and provides actionable recommendations to harden configurations. Enabling CSPM is a foundational best practice because it proactively identifies misconfigurations (like open management ports or unencrypted storage) before they can be exploited, directly aligning with the 'prevent' phase of the shared responsibility model.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint onboarding

Answer

Microsoft Sentinel integration

Question 6

A company is deploying Microsoft Entra ID Governance. They need to implement a least privilege access model for their Azure resources. Which TWO features should they use? (Choose two.)

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is correct because it provides just-in-time (JIT) privileged access to Azure resources, enabling time-bound and approval-based role activation. This directly supports a least privilege model by ensuring users only have elevated permissions when needed, reducing standing access.

Answer

Identity Protection

Answer

Conditional Access policies

Answer

Microsoft Intune compliance policies

Question 7

Your organization uses Microsoft Purview Information Protection to classify and protect sensitive data. The compliance team wants to automatically apply a 'Highly Confidential' sensitivity label to emails that contain credit card numbers. Which solution should you configure?

Accepted Answer

Microsoft Purview auto-labeling policy. Microsoft Purview auto-labeling policies can automatically apply sensitivity labels to emails containing credit card numbers based on sensitive information types. Option B (Microsoft Defender for Office 365 Safe Attachments) is incorrect because it focuses on scanning email attachments for malware, not on classification. Option C (Microsoft 365 DLP policy) is incorrect because DLP policies can block or warn but do not directly apply sensitivity labels. Option D (Microsoft Endpoint DLP) is incorrect because it applies to data on endpoints, not to emails.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Microsoft 365 Data Loss Prevention (DLP) policy

Answer

Microsoft Endpoint DLP

Question 8

An organization wants to ensure that all Windows 10 devices are compliant with security policies before they can access corporate email. Microsoft Intune is used for device management. Which component should be used to enforce compliance and block non-compliant devices?

Accepted Answer

Microsoft Entra ID Conditional Access policy integrated with Intune compliance. Microsoft Entra ID Conditional Access policies can evaluate Intune device compliance status in real time. When a device is marked non-compliant by an Intune compliance policy, the Conditional Access policy blocks access to corporate email (e.g., Exchange Online) until the device is remediated. This integration enforces a 'compliant device required' gate that cannot be achieved by Intune compliance alone, which only reports status without blocking access.

Answer

Intune device compliance policy alone

Answer

Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint device risk score

Question 9

Your organization uses Microsoft Sentinel to centralize security logs from multiple clouds. They need to ensure that logs from Amazon Web Services (AWS) are ingested and analyzed for threats. Which connector should you implement?

Accepted Answer

AWS S3 connector. The AWS S3 connector is the correct choice because it is the native Microsoft Sentinel data connector designed specifically to ingest AWS CloudTrail logs (and other AWS service logs) from an S3 bucket. It uses an AWS Simple Queue Service (SQS) to poll for new log files, then streams them into Sentinel for analysis, enabling threat detection across multi-cloud environments.

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor Agent

Answer

Azure Event Hubs

Question 10

You are designing a security solution for a multinational organization that uses Microsoft Entra ID. They have a hybrid identity environment with Active Directory on-premises. The security team requires that all administrative actions in Microsoft Entra ID are logged and monitored in real-time with alerts for critical changes. Which two data sources should you stream to Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID Sign-in Logs. Microsoft Entra ID Audit Logs capture all administrative changes and configuration modifications within the tenant, such as user role assignments, group membership updates, and application permission grants. Microsoft Entra ID Sign-in Logs provide real-time visibility into authentication activities, including failed sign-ins, anomalous sign-in patterns, and MFA challenges. Streaming both data sources to Microsoft Sentinel enables comprehensive monitoring and alerting for security teams: Audit Logs for configuration changes and Sign-in Logs for authentication-related threats. Together, they meet the requirement for logging and alerting on all administrative actions in Entra ID.

Answer

Azure Activity Log

Answer

Microsoft Entra ID Provisioning Logs

Question 11

Your organization uses Microsoft Defender for Office 365 to protect against phishing attacks. The security team wants to implement a custom advanced phishing threshold policy that blocks suspicious emails more aggressively. Which policy type should they modify?

Accepted Answer

Anti-phishing policy. The Anti-phishing policy in Microsoft Defender for Office 365 includes the Advanced Phishing Threshold (APT) settings that allow administrators to control the aggressiveness of phishing detection. By modifying the anti-phishing policy, you can set the phishing threshold to 'Aggressive' or 'Most Aggressive,' which applies more stringent machine learning models to block suspicious emails earlier. This is the correct policy type because it directly governs the phishing threshold level, not attachment or link scanning.

Answer

ATP policy

Answer

Safe Attachments policy

Answer

Safe Links policy

Question 12

A company plans to use Microsoft Purview to manage data governance across their on-premises SQL Server databases and Azure SQL databases. They need to classify sensitive data and create a unified data map. Which resource should they deploy?

Accepted Answer

Microsoft Purview. Microsoft Purview is the correct choice because it provides a unified data governance service that can scan both on-premises SQL Server and Azure SQL databases, automatically classify sensitive data using built-in classifiers (e.g., PII, financial info), and build a centralized data map. This aligns with the requirement to manage data governance across hybrid environments with a single pane of glass.

Answer

Azure Synapse Analytics

Answer

Azure Data Factory

Answer

Azure SQL Database

Question 13

Which TWO Microsoft security solutions should be integrated to provide a comprehensive Zero Trust architecture that includes identity protection, endpoint detection, and response? (Select exactly two correct options.)

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (B) is correct because it provides unified endpoint detection and response (EDR) across devices, email, and identities, integrating signals from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity. Microsoft Entra ID (C) is correct because it delivers identity protection through Conditional Access, risk-based policies, and identity governance, forming the identity pillar of a Zero Trust architecture. Together, they cover identity protection and endpoint detection/response, two core Zero Trust components.

Answer

Microsoft 365 E5

Answer

Microsoft Sentinel

Answer

Microsoft Purview

Question 14

Which THREE components should be part of a secure DevOps pipeline using Microsoft security tools? (Select exactly three correct options.)

Accepted Answer

Microsoft Purview. Microsoft Purview is correct because it provides data governance and compliance capabilities, including data classification, labeling, and data loss prevention (DLP) policies, which are essential for securing sensitive data within a DevOps pipeline. It integrates with Azure DevOps and GitHub to automatically detect and protect secrets, credentials, and other sensitive information in code repositories and CI/CD artifacts, ensuring that data security policies are enforced throughout the development lifecycle.

Answer

Azure Firewall

Answer

Azure Front Door

Question 15

Which TWO Microsoft services can be used to implement a cloud security posture management (CSPM) solution? (Select exactly two correct options.)

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud is correct because it provides cloud security posture management (CSPM) capabilities by continuously assessing the security configuration of Azure, AWS, and GCP resources against built-in security benchmarks (e.g., Azure Security Benchmark, CIS, NIST). It generates a secure score, identifies misconfigurations, and offers remediation recommendations, making it a core CSPM tool.

Answer

Microsoft Purview

Answer

Microsoft Intune

Answer

Microsoft Sentinel