SC-100 Design solutions that align with security best practices and priorities Practice Test 6 — 15 Questions

Question 1

Your organization plans to use Microsoft Purview to protect sensitive data in Microsoft 365. The compliance team needs to detect when users share credit card numbers via email and automatically apply encryption. Which solution should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data types—such as credit card numbers—in email messages and automatically apply protective actions like encryption. DLP policies can inspect email content in transit via Exchange Online, match patterns against predefined sensitive info types (e.g., credit card number regex), and trigger actions such as 'Encrypt the message' using Azure Rights Management. This directly meets the requirement to detect sharing of credit card numbers and enforce encryption automatically.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Information Protection

Question 2

Your organization uses Microsoft Sentinel as its SIEM. The security team needs to detect brute-force attacks against Azure VMs by analyzing Windows Security Event logs. Which data connector should you enable?

Accepted Answer

Windows Security Events via AMA connector. The Windows Security Events via AMA connector (D) is correct because it ingests Windows Event Logs (specifically Security logs with Event ID 4625 for failed logons) from Azure VMs into Microsoft Sentinel, enabling detection of brute-force patterns. This connector uses the Azure Monitor Agent (AMA) to collect events, which is the recommended method for modern Windows event collection in Sentinel.

Answer

Office 365 connector

Answer

Azure Activity log connector

Answer

Microsoft Defender for Cloud connector

Question 3

Your company is migrating on-premises Active Directory to Microsoft Entra ID. The security team requires that users must use passwordless authentication methods for all sign-ins. Which Microsoft Entra ID feature should you enable to support passwordless authentication?

Accepted Answer

Microsoft Entra ID passwordless authentication methods. Microsoft Entra ID passwordless authentication methods (such as Windows Hello for Business, FIDO2 security keys, and Microsoft Authenticator) are the native features designed to eliminate passwords entirely. These methods satisfy the security team's requirement by enabling users to sign in without a password, using biometrics or cryptographic keys instead.

Answer

Password hash synchronization

Answer

Seamless Single Sign-On (Seamless SSO)

Answer

Pass-through authentication

Question 4

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The compliance team wants to ensure that all storage accounts have secure transfer required enabled. Which action should you take in Defender for Cloud?

Accepted Answer

Implement the 'Secure transfer to storage accounts should be enabled' recommendation. The correct action is to implement the 'Secure transfer to storage accounts should be enabled' recommendation because Microsoft Defender for Cloud provides built-in security recommendations that map to specific controls. This recommendation directly checks whether the 'Secure transfer required' property is enabled on each storage account, and if not, it provides remediation steps to enforce HTTPS-only traffic, which aligns with the compliance team's requirement.

Answer

Configure the regulatory compliance dashboard

Answer

Review the secure score

Answer

Enable the 'Cloud Security Posture Management' plan

Question 5

Your company uses Microsoft Purview to classify and label sensitive data. The data protection team needs to automatically apply a 'Confidential' label to documents that contain a custom sensitive info type for employee IDs. Which should you create?

Accepted Answer

A custom sensitive information type and an auto-labeling policy. To automatically apply a 'Confidential' label based on the presence of a custom sensitive info type (employee IDs), you need both a custom sensitive information type (SIT) to define the pattern and an auto-labeling policy to trigger the label application. The auto-labeling policy uses the SIT to scan documents and automatically applies the specified sensitivity label when a match is found. This is the only option that combines the detection mechanism with automated labeling.

Answer

A trainable classifier

Answer

A sensitivity label

Answer

A retention label

Question 6

Your organization uses Microsoft Sentinel for security operations. The SOC team wants to automatically disable a compromised user account in Microsoft Entra ID when a high-severity alert is generated. Which automation method should you use?

Accepted Answer

An automation rule with a playbook. Automation rules in Microsoft Sentinel can trigger a playbook (an Azure Logic Apps workflow) when a high-severity alert fires. The playbook can then execute an action to disable the user account in Microsoft Entra ID via the Microsoft Graph API. This is the correct method because it provides the necessary integration between Sentinel alerts and Entra ID identity remediation.

Answer

A workbook

Answer

A KQL query in a hunting rule

Answer

An analytics rule

Question 7

Which TWO Microsoft security solutions can help enforce Zero Trust principles by verifying identity and device health before granting access to resources?

Accepted Answer

Microsoft Intune. Microsoft Entra ID Conditional Access (C) is correct because it is the policy engine that evaluates signals such as user identity, group membership, and device compliance state to grant, block, or require MFA before access to resources, directly enforcing the Zero Trust 'verify explicitly' principle. Microsoft Intune (A) is correct because it manages device enrollment, configuration, and compliance policies, producing the device health and compliance signals that Conditional Access consumes to ensure only healthy, trusted devices get access. Together they implement the identity-plus-device verification required by Zero Trust. Microsoft Purview (B) is a data governance, compliance, and information-protection suite, not an access-decision enforcement point. Microsoft Defender for Cloud Apps (D) is a CASB for discovering and controlling cloud app usage, and Microsoft Sentinel (E) is a SIEM/SOAR platform for threat detection and response; neither verifies identity and device health at the point of granting resource access.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 8

Which THREE components are essential for implementing a successful SIEM strategy using Microsoft Sentinel?

Accepted Answer

Automation rules. Data connectors (E) are essential because Microsoft Sentinel must first ingest telemetry from sources such as Microsoft 365, Azure, AWS, and third-party systems via connectors like the Azure Activity or Syslog connector before any detection or response can occur. Analytics rules (C) are essential because they correlate the ingested events and generate alerts/incidents based on scheduled, NRT, or Microsoft security rules, forming the core detection engine of the SIEM. Automation rules (A) are essential because they provide the orchestration and response layer, allowing Sentinel to automatically triage, assign, tag, or trigger playbooks on incidents to reduce response time. Workbooks (B) are valuable for visualization and reporting but are not required for the core detect-and-respond SIEM pipeline, and watchlists (D) are an optional enrichment feature for importing reference data such as IPs or VIP users, not a foundational component of a Sentinel SIEM strategy.

Answer

Workbooks

Answer

Watchlists

Question 9

Refer to the exhibit. You are reviewing a conditional access policy JSON in Microsoft Entra ID. The policy is enabled but users with the Global Administrator role are not being prompted for MFA. What is the most likely reason?

Accepted Answer

The policy does not include any users except by role.. The Conditional Access policy JSON shows that the 'users' object does not include an 'includeUsers' property for all users or specific groups; instead, users are only included by directory role (e.g., through 'includeRoles'). If the 'includeRoles' array is either empty or does not contain the 'Global Administrator' role, then Global Administrators are not targeted by the policy. Therefore, they are not prompted for MFA despite the policy being enabled. This is the most likely reason because the other options are incorrect: the policy may include applications (option B), the grant control could be set to MFA (not requiring compliant device) (option C), and the policy is enabled (option D).

Answer

The policy does not include any applications.

Answer

The grant control requires a compliant device instead of MFA.

Answer

The policy state is disabled.

Question 10

Refer to the exhibit. You are analyzing an Azure PowerShell script that checks a blob property. The output of the last command returns 'False'. What does this indicate about the blob storage configuration?

Accepted Answer

Access time tracking is disabled for the storage account.. Access time tracking is disabled for the storage account. In Azure Storage, the blob property that reports whether last-access time tracking is enabled returns False when the account-level setting `LastAccessTimeTrackingPolicy` is not enabled, meaning the service is not recording last access times for blobs. Options A, C, and D are unrelated to this property: diagnostic logging is configured via Azure Monitor diagnostic settings, immutability policies are set through container/blob immutability settings, and server-side encryption is always enabled for Azure Storage blobs and is not reported by this property.

Answer

Diagnostic logging is not configured for the container.

Answer

The blob has an immutability policy applied.

Answer

Server-side encryption is disabled for the blob.

Question 11

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

To identify accounts with multiple failed logon attempts from a single IP.. The query uses the `SecurityEvent` table and filters for `EventID == 4625`, which indicates a failed logon attempt. By summarizing `count()` by `IPAddress` and `Account` and filtering for `FailedAttempts > 5`, the query identifies accounts with multiple failed logon attempts from a single IP address. This is typical for detecting brute-force or password-spray attacks, making option A correct.

Answer

To list all successful logon events in the last 7 days.

Answer

To calculate the total number of failed logons per hour.

Answer

To detect account lockout events.

Question 12

A company is implementing a Zero Trust security model. Which principle requires verifying every access request as if it originates from an uncontrolled network?

Accepted Answer

Verify explicitly. The 'Assume breach' principle is not about verifying requests. 'Verify explicitly' is the Zero Trust principle that mandates authenticating and authorizing every access request. 'Least privilege' limits access rights. 'Micro-segmentation' is a network isolation technique.

Answer

Least privilege

Answer

Micro-segmentation

Answer

Assume breach

Question 13

A company uses Microsoft Entra ID for identity management. They want to ensure that only managed devices can access corporate email. Which Conditional Access policy setting should be configured?

Accepted Answer

Require device to be marked as compliant. To ensure only managed devices can access corporate email, you need to enforce device compliance. The Conditional Access policy setting 'Require device to be marked as compliant' checks that the device is enrolled in Microsoft Intune and meets all compliance policies (e.g., encryption, OS version, jailbreak detection) before granting access. This directly restricts access to managed devices only.

Answer

Require multifactor authentication

Answer

Block legacy authentication

Answer

Require approved client app

Question 14

A security team is designing a Microsoft Sentinel deployment. They need to minimize costs while ensuring critical alerts are always processed. Which data retention and ingestion strategy should they use?

Accepted Answer

Use Basic Logs for high-volume low-value data and Analytics Logs for critical alerts. It aligns with cost optimization and reliability requirements by using Basic Logs for high-volume, low-value data (e.g., firewall logs) and reserving Analytics Logs for critical alerts that require full query capabilities and interactive retention. This tiered approach ensures critical alerts are always processed with full fidelity while reducing storage costs for less important data.

Answer

Use Basic Logs for all data and retain for 90 days

Answer

Use Analytics Logs for all data and retain for 30 days

Answer

Use Basic Logs for critical alerts and retain for 30 days

Question 15

A company deploys Microsoft Defender for Cloud Apps. They need to detect anomalous behavior in user activities across multiple cloud apps. Which feature should they enable?

Accepted Answer

Anomaly detection policies. Anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify unusual patterns in user activities across connected cloud apps, such as impossible travel, mass file downloads, or ransomware-like behavior. These policies leverage machine learning and behavioral analytics to establish a baseline of normal user behavior and trigger alerts when deviations occur, making them the correct choice for detecting anomalous behavior.

Answer

Session policies

Answer

Data loss prevention policies

Answer

App governance