SC-100 Design solutions that align with security best practices and priorities Practice Test 6 — 15 Questions

Question 1

Your company uses Microsoft Sentinel as its SIEM. You need to design a solution that automatically responds to high-severity incidents by creating a ticket in ServiceNow and notifying the security team via Teams. Which Sentinel feature should you configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel are designed to trigger automated responses to incidents based on conditions like severity. They can integrate with external systems via playbooks (Azure Logic Apps) to create ServiceNow tickets and send Teams notifications, making them the correct choice for this requirement.

Answer

Workbooks

Answer

Analytics rules

Answer

Hunting queries

Question 2

A manufacturing company wants to secure its IoT devices that run on Azure IoT Hub. They need to ensure that only authorized devices can connect and that firmware updates are signed. Which combination of Azure services should they use?

Accepted Answer

Azure IoT Hub Device Provisioning Service and Microsoft Defender for IoT. Option A is correct because Azure IoT Hub Device Provisioning Service (DPS) enables zero-touch, just-in-time provisioning of IoT devices while enforcing authentication via X.509 certificates or TPM attestation, ensuring only authorized devices connect. Microsoft Defender for IoT provides continuous threat monitoring and firmware integrity validation, including cryptographic signing verification for firmware updates, which aligns with the requirement for signed updates.

Answer

Microsoft Entra ID and Azure Policy

Answer

Azure Sphere and Azure Security Center

Answer

Microsoft Intune and Azure Automation

Question 3

Your organization is implementing a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM). The compliance team requires that all privileged role activations be approved by a manager and that an audit trail is maintained for at least one year. Which configuration should you recommend?

Accepted Answer

Set PIM role settings to require approval and enable audit logging. Option B is correct because it directly addresses both compliance requirements: requiring approval ensures a manager authorizes each activation, and enabling audit logging in PIM retains activation history for at least one year. PIM role settings allow you to configure approval workflows and automatically log all activations to the Microsoft Entra audit log, which can be exported and retained for compliance purposes.

Answer

Configure access reviews for privileged roles

Answer

Enable Conditional Access policies for privileged roles

Answer

Require Azure MFA for role activation

Question 4

Your company uses Microsoft Intune to manage corporate devices. The security team wants to prevent users from copying sensitive data from corporate apps to personal apps on mobile devices. Which Intune policy should you configure?

Accepted Answer

App protection policies. App protection policies (APP) are the correct Intune policy to prevent data transfer from corporate apps to personal apps on mobile devices. These policies apply at the application layer, allowing you to configure data protection settings such as 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' specifically for managed apps, regardless of the device enrollment state.

Answer

Device configuration policies

Answer

Windows Information Protection

Answer

Device compliance policies

Question 5

Your organization is migrating to Microsoft 365 and wants to implement a data classification strategy. The compliance team needs to automatically detect and label documents containing personal data (e.g., Social Security numbers) in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview are designed to automatically detect sensitive data types (e.g., Social Security numbers) using built-in or custom sensitive information types and apply sensitivity labels to documents in SharePoint Online. This meets the requirement for automatic detection and labeling without user intervention, as the compliance team needs.

Answer

Records Management

Answer

eDiscovery

Answer

Data Loss Prevention policies

Question 6

Your company uses Microsoft Defender for Endpoint (MDE) and wants to integrate threat intelligence from an external source to improve detection. The security team needs to ingest custom indicators of compromise (IOCs) into MDE. Which feature should they use?

Accepted Answer

Custom indicators (IOCs). Option D is correct because the Custom Indicators (IOCs) feature in Microsoft Defender for Endpoint allows security teams to manually ingest and manage threat intelligence from external sources, such as IP addresses, URLs, domains, or file hashes. These indicators are then used by MDE to create or block alerts, enabling tailored detection beyond built-in threat intelligence feeds.

Answer

Advanced Hunting

Answer

Threat Analytics

Answer

Automated investigation and response

Question 7

Your organization is designing a Microsoft Sentinel solution to detect and respond to threats across multi-cloud environments (Azure, AWS, GCP). Which TWO components are essential for this design?

Accepted Answer

Data connectors for AWS and GCP. Data connectors are the foundational component for ingesting logs from external cloud providers into Microsoft Sentinel. For AWS, you typically use the AWS CloudTrail connector via S3 and SQS; for GCP, you use the GCP Security Command Center connector or a custom log ingestion pipeline. Without these connectors, Sentinel cannot receive telemetry from those environments, making multi-cloud detection impossible.

Answer

Azure Policy assignments

Answer

Microsoft Defender for Cloud

Answer

Azure Automation accounts

Question 8

Your company is implementing Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft 365. The compliance team needs to monitor and block the sharing of credit card numbers in emails. Which THREE actions should they configure in a DLP policy?

Accepted Answer

Notify the user with a policy tip. Correct answers: A, B, C. DLP policies can detect sensitive info types (credit card numbers), block sharing, and notify users. Option D is wrong because encryption is a separate feature, not a DLP action. Option E is wrong because auto-labeling is a classification action, not a DLP enforcement action.

Answer

Encrypt the email automatically

Answer

Apply a sensitivity label automatically

Question 9

Your organization is implementing a Zero Trust network architecture in Azure. Which TWO principles are foundational to Zero Trust?

Accepted Answer

Verify explicitly. Option B is correct because 'Verify explicitly' is a core principle of Zero Trust, which mandates that every access request must be authenticated and authorized based on all available data points (e.g., user identity, device health, location) before granting access. This eliminates implicit trust based solely on network location, aligning with Azure's conditional access policies and Microsoft Entra ID authentication.

Answer

Use network segmentation

Answer

Rely on perimeter security

Answer

Trust but verify

Question 10

A company is migrating its on-premises Active Directory to Microsoft Entra ID. They need to ensure that all user authentication for cloud apps uses passwordless methods. Which security best practice should they implement?

Accepted Answer

Implement Microsoft Entra ID passwordless authentication. Option B is correct because implementing Microsoft Entra ID passwordless authentication (e.g., FIDO2 keys, Windows Hello for Business) aligns with the Zero Trust principle of eliminating passwords. Option A is wrong because MFA alone still relies on a password. Option C is wrong because conditional access policies can enforce passwordless but are not the best practice itself. Option D is wrong because privileged identity management addresses just-in-time access, not passwordless.

Answer

Configure conditional access policies to block legacy authentication

Answer

Enable Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Require multifactor authentication (MFA) for all users

Question 11

A security architect is designing a solution to detect and respond to advanced threats across email, endpoints, and identities. Which Microsoft security solution should they use?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (Extended Detection and Response) is the correct solution because it provides unified pre- and post-breach detection, investigation, and response across email, endpoints, and identities. It correlates signals from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity into a single incident queue, enabling automated remediation of advanced multi-vector attacks.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 12

A company uses Microsoft Sentinel and wants to prioritize incidents using user risk scores from Microsoft Entra ID Protection. Which configuration should they use to automatically assign a Sentinel severity based on the user's risk level?

Accepted Answer

Create a custom analytics rule that uses the RiskLevel field to set severity. A is correct because Microsoft Sentinel's custom analytics rules can directly reference the `RiskLevel` field from Microsoft Entra ID Protection user risk data ingested via the UEBA connector. By writing a KQL query that checks the user's risk level (e.g., `RiskLevel == 'high'`) and mapping it to a Sentinel severity (e.g., High, Medium, Low) within the rule's incident creation settings, you automate severity assignment without external dependencies. This native integration ensures real-time synchronization of risk levels to incident priority.

Answer

Configure an automation rule to set severity when risk is high

Answer

Use a watchlist to map risk levels to severity

Answer

Create a playbook that assigns severity based on risk

Question 13

A company wants to enforce that all administrators use just-in-time (JIT) access to privileged roles in Microsoft Entra ID. Which feature should they enable?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) provides just-in-time (JIT) privileged access by enabling time-bound and approval-based role activation. This directly meets the requirement to enforce JIT access for administrators, as PIM allows roles to be activated only when needed and for a limited duration, reducing standing access.

Answer

Microsoft Entra ID Conditional Access

Answer

Microsoft Entra ID Access Reviews

Answer

Microsoft Entra ID Protection

Question 14

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They need to ensure that all resources are compliant with the Payment Card Industry Data Security Standard (PCI DSS). What should they do?

Accepted Answer

Enable the PCI DSS regulatory compliance standard in Microsoft Defender for Cloud. Microsoft Defender for Cloud includes built-in regulatory compliance standards, such as PCI DSS, that can be enabled directly. Once enabled, Defender for Cloud continuously assesses your Azure subscriptions against the PCI DSS controls and provides a compliance score with detailed remediation steps. This is the simplest and most effective method to monitor compliance without creating custom policies or blueprints.

Answer

Create Azure Policy initiatives to enforce PCI DSS controls

Answer

Use Microsoft Purview to classify data and apply PCI DSS labels

Answer

Deploy Azure Blueprints that include PCI DSS policies

Question 15

A security architect is designing a solution to protect sensitive data stored in SharePoint Online from being shared with unauthorized users. The solution must block sharing of files containing credit card numbers when shared externally. What should they use?

Accepted Answer

Create a Microsoft Purview sensitivity label that automatically applies encryption and blocks external sharing when credit card numbers are detected. Option B is correct because Microsoft Purview sensitivity labels can be configured with automatic classification for sensitive data types (e.g., credit card numbers) and enforce encryption while blocking external sharing. This directly meets the requirement to prevent unauthorized external sharing of files containing credit card numbers in SharePoint Online.

Answer

Configure a conditional access policy to block access from untrusted networks when credit card numbers are detected

Answer

Create a Microsoft Purview Data Loss Prevention (DLP) policy that blocks external sharing when credit card numbers are detected

Answer

Use Azure Information Protection to label and protect files with credit card numbers