SC-100 Design solutions that align with security best practices and priorities Practice Test 7 — 15 Questions

Question 1

An organization uses Microsoft Purview Information Protection. They want to automatically apply a sensitivity label to documents containing credit card numbers. Which policy should they configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policies in Microsoft Purview Information Protection automatically apply sensitivity labels to documents and emails that match specified conditions, such as the presence of credit card numbers. This policy uses sensitive information types (e.g., Credit Card Number) to scan content and apply the label without user intervention, meeting the requirement for automatic labeling.

Answer

Retention policy

Answer

Sensitivity label policy

Answer

Data loss prevention policy

Question 2

A company is using Microsoft Intune to manage devices. They need to ensure that only devices with a specific operating system version can access corporate resources. Which Intune policy should they use?

Accepted Answer

Compliance policy. Compliance policies in Microsoft Intune define the rules that devices must meet to be considered compliant, such as requiring a specific operating system version. When a device is marked non-compliant, Conditional Access policies can block access to corporate resources. This directly enforces the requirement that only devices with the correct OS version can access company data.

Answer

App protection policy

Answer

Enrollment restriction

Answer

Device configuration policy

Question 3

A company wants to use Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. Which component enables this correlation?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (the new name for Microsoft 365 Defender) is the unified pre- and post-breach enterprise defense suite that natively correlates signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Its correlation engine uses machine learning and the Microsoft Intelligent Security Graph to fuse alerts across these domains into a single incident, enabling security teams to see the full attack chain from email to endpoint to identity.

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 4

A company uses Microsoft Entra ID Governance. They need to automate the process of granting access to a SaaS application based on the user's department attribute. Which feature should they use?

Accepted Answer

Entitlement management. Entitlement management in Microsoft Entra ID Governance allows you to create access packages that define collections of resources (like SaaS apps) and policies for who can request access. By configuring a dynamic membership rule based on the user's department attribute, you can automate granting access to the SaaS application without manual intervention. This directly meets the requirement to automate access based on a user attribute.

Answer

Lifecycle workflows

Answer

Access reviews

Answer

Privileged identity management

Question 5

Which THREE components are included in Microsoft Defender XDR?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender XDR is the unified extended detection and response suite that correlates signals across Microsoft's first-party security workloads, and its core components include Microsoft Defender for Office 365 (A), which protects email, collaboration tools, and Office apps against phishing, malware, and business email compromise; Microsoft Defender for Identity (C), which monitors on-premises Active Directory Domain Services signals via domain controllers to detect identity-based attacks like lateral movement and credential theft; and Microsoft Defender for Endpoint (D), which provides endpoint detection and response, threat and vulnerability management, and automated investigation on devices. These three feed alerts and incidents into the Defender XDR portal alongside Defender for Cloud Apps to enable cross-domain correlation. Microsoft Defender for IoT (B) is a separate offering for operational technology and IoT/OT environments, and Microsoft Defender for Cloud (E) is a cloud security posture management and workload protection solution (CSPM/CWPP) that, while integrated with the Defender portal, is not one of the three named Defender XDR components tested here.

Answer

Microsoft Defender for IoT

Answer

Microsoft Defender for Cloud

Question 6

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. What is the effect of this policy?

Accepted Answer

Blocks sign-ins from users with high user risk. The policy JSON specifies `"userRiskLevels": ["high"]` under the conditions block, which means it targets only users whose user risk level is assessed as high by Microsoft Entra ID Protection. The grant control is set to `"builtInControls": ["block"]`, so the policy blocks sign-ins for those high-risk users. Option B is correct because the policy explicitly blocks sign-ins from users with high user risk, not sign-in risk or all users.

Answer

Blocks sign-ins from locations with high sign-in risk

Answer

Blocks all sign-ins from any user

Answer

Requires multifactor authentication for high-risk users

Question 7

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Identify malware alerts on unmanaged devices. The query uses the `DeviceInfo` table to filter for devices where `IsManaged` is `false`, then joins with `SecurityAlert` to find alerts where `AlertName` contains 'Malware'. This specifically identifies malware alerts generated on unmanaged devices, not all malware alerts or a general device inventory.

Answer

Correlate malware alerts with device OS version

Answer

List all malware alerts in the last 7 days

Answer

Show device inventory for unmanaged devices

Question 8

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. Which security best practice is implemented?

Accepted Answer

Deny all network traffic by default. The ARM template snippet shows the 'defaultAction' property set to 'Deny' under 'networkAcls', which explicitly denies all network traffic by default. This is a security best practice because it implements a zero-trust network model, ensuring that only explicitly allowed traffic (via IP rules or virtual network rules) can access the storage account. Option C correctly identifies this as the default deny behavior.

Answer

Enforce HTTPS traffic only

Answer

Restrict network access by IP address

Answer

Enable soft delete for blobs

Question 9

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to prioritize remediation of high-severity findings based on the greatest potential business impact. Which security policy or framework should you configure to align remediation with business priorities?

Accepted Answer

Enable the Regulatory Compliance dashboard. The Regulatory Compliance dashboard in Microsoft Defender for Cloud allows you to map security controls to specific regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS) and track compliance posture. By selecting a framework that aligns with your organization's business obligations (e.g., a standard required by customers or regulators), you can prioritize remediation of high-severity findings based on the greatest potential business impact, such as fines or loss of certification.

Answer

Use the Azure Security Benchmark initiative

Answer

Set up workflow automation for high-severity findings

Answer

Configure the Secure Score dashboard

Question 10

A company is designing a Zero Trust architecture for their hybrid identity environment. They plan to require multifactor authentication (MFA) for all users accessing sensitive applications. Which Microsoft Entra ID capability should they use to enforce MFA based on risk level?

Accepted Answer

Conditional Access. Conditional Access is the correct choice because it is the Microsoft Entra ID policy engine that evaluates signals such as user, device, location, and sign-in risk, and can then require MFA for access to sensitive applications. In a Zero Trust hybrid identity design, Conditional Access policies are where you enforce MFA based on risk level, including integration with risk detections from Microsoft Entra ID Protection. Self-service password reset only lets users reset or unlock their own accounts and does not enforce MFA for application access. Privileged Identity Management governs just-in-time role activation and approvals for privileged roles, not general MFA enforcement for sensitive apps. Microsoft Entra ID Protection detects and reports risk but does not itself enforce the MFA requirement; that enforcement is done through Conditional Access.

Answer

Self-service password reset

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra ID Protection

Question 11

Your organization is deploying Microsoft Copilot for Security and wants to ensure that the AI model does not expose sensitive data in its responses. You need to configure data loss prevention (DLP) policies that apply to Copilot interactions. Which Microsoft Purview capability should you use?

Accepted Answer

Data Loss Prevention policies. Microsoft Purview Data Loss Prevention (DLP) policies for Copilot are designed to prevent sensitive data from being exposed in AI interactions. These policies can scan prompts and responses for sensitive information and take actions like blocking or alerting. Communication Compliance (Option D) is intended for monitoring communications, such as emails and Teams messages, but not specifically for DLP in AI interactions. Therefore, DLP policies are the correct capability for this requirement.

Answer

eDiscovery

Answer

Information Protection and sensitivity labels

Answer

Communication Compliance

Question 12

Your company uses Microsoft Sentinel as its SIEM. You need to design a solution that automatically responds to high-severity incidents by creating a ticket in ServiceNow and notifying the security team via Teams. Which Sentinel feature should you configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel are designed to trigger automated responses to incidents based on conditions like severity. They can integrate with external systems via playbooks (Azure Logic Apps) to create ServiceNow tickets and send Teams notifications, making them the correct choice for this requirement.

Answer

Workbooks

Answer

Analytics rules

Answer

Hunting queries

Question 13

Your organization is implementing a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM). The compliance team requires that all privileged role activations be approved by a manager and that an audit trail is maintained for at least one year. Which configuration should you recommend?

Accepted Answer

Set PIM role settings to require approval and enable audit logging. It directly addresses both compliance requirements: requiring approval ensures a manager authorizes each activation, and enabling audit logging in PIM retains activation history for at least one year. PIM role settings allow you to configure approval workflows and automatically log all activations to the Microsoft Entra audit log, which can be exported and retained for compliance purposes.

Answer

Configure access reviews for privileged roles

Answer

Enable Conditional Access policies for privileged roles

Answer

Require Azure MFA for role activation

Question 14

Your company uses Microsoft Intune to manage corporate devices. The security team wants to prevent users from copying sensitive data from corporate apps to personal apps on mobile devices. Which Intune policy should you configure?

Accepted Answer

App protection policies. App protection policies (APP) are the correct Intune policy to prevent data transfer from corporate apps to personal apps on mobile devices. These policies apply at the application layer, allowing you to configure data protection settings such as 'Restrict cut, copy, and paste' and 'Allow app to transfer data to other apps' specifically for managed apps, regardless of the device enrollment state.

Answer

Device configuration policies

Answer

Windows Information Protection

Answer

Device compliance policies

Question 15

Your organization is migrating to Microsoft 365 and wants to implement a data classification strategy. The compliance team needs to automatically detect and label documents containing personal data (e.g., Social Security numbers) in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Auto-labeling policies. Auto-labeling policies in Microsoft Purview are designed to automatically detect sensitive data types (e.g., Social Security numbers) using built-in or custom sensitive information types and apply sensitivity labels to documents in SharePoint Online. This meets the requirement for automatic detection and labeling without user intervention, as the compliance team needs.

Answer

Records Management

Answer

eDiscovery

Answer

Data Loss Prevention policies