SC-100 Design solutions that align with security best practices and priorities Practice Test 9 — 15 Questions

Question 1

Which TWO are best practices for designing a Microsoft 365 Defender (XDR) deployment to ensure optimal detection and response?

Accepted Answer

Configure automated investigation and response for common incident types. B is correct because configuring automated investigation and response (AIR) for common incident types is a core best practice in Microsoft 365 Defender. AIR leverages built-in playbooks to automatically triage, investigate, and remediate alerts, reducing mean time to respond (MTTR) and allowing security teams to focus on complex threats. This aligns with the XDR principle of using automation to handle high-volume, predictable incidents efficiently.

Answer

Deploy Defender for Endpoint on unsupported operating systems with limited functionality

Answer

Rely solely on manual alert triage to avoid missing complex attacks

Answer

Configure each workload (Endpoint, Identity, etc.) in SILO mode to avoid false positives

Question 2

Which THREE are components of Microsoft's Zero Trust model?

Accepted Answer

Data. Option A is correct because data is one of the six foundational pillars of Microsoft's Zero Trust model (identities, endpoints, data, apps, infrastructure, and network). The Zero Trust model explicitly treats data as a critical asset that must be protected regardless of location, using encryption, labeling, and Data Loss Prevention (DLP) policies to enforce least-privilege access and continuous validation.

Answer

Assume breach

Answer

Microsoft Defender for Cloud

Question 3

Which TWO should you implement to protect privileged accounts in Microsoft Entra ID?

Accepted Answer

Conditional Access policies requiring MFA for privileged roles. Option B is correct because Conditional Access policies can enforce multifactor authentication (MFA) specifically for users assigned to privileged roles in Microsoft Entra ID. This directly protects those accounts by requiring a second authentication factor, reducing the risk of credential theft or reuse. It is a core identity security control recommended by Microsoft for privileged access.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Cloud security score

Answer

Microsoft Defender Vulnerability Management

Question 4

A company is designing a Zero Trust security strategy. They want to ensure that all access requests are authenticated, authorized, and encrypted before granting access. Which Microsoft security solution should they use as the central policy engine?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the correct central policy engine because it provides identity-based conditional access policies that authenticate, authorize, and enforce encryption (e.g., via device compliance or app protection policies) before granting access. It acts as the policy decision point (PDP) in a Zero Trust architecture, evaluating signals like user risk, device state, and location to allow or deny access.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 5

A company uses Microsoft Defender for Cloud to manage security across hybrid workloads. They need to ensure that all Azure VMs have guest-level threat detection enabled. Which security policy should they assign?

Accepted Answer

Microsoft cloud security benchmark. The Azure Security Benchmark includes built-in policies for guest configuration. Option A is wrong because it's a general benchmark. Option B is wrong because it's not a policy initiative. Option D is wrong because it's a different product.

Answer

Azure Security Benchmark

Answer

Microsoft Defender for Cloud Apps

Answer

NIST SP 800-53

Question 6

A multinational corporation is implementing a privileged access strategy. They need to ensure that all users with permanent administrative roles sign in using phishing-resistant authentication methods. Which Microsoft Entra ID feature should they enforce?

Accepted Answer

Authentication Strengths in Conditional Access. Authentication Strengths in Conditional Access allows organizations to enforce specific authentication methods, such as FIDO2 security keys or certificate-based authentication, which are phishing-resistant. This directly meets the requirement to ensure users with permanent administrative roles use phishing-resistant methods, unlike general MFA policies that may allow weaker methods like SMS or OTP.

Answer

Privileged Identity Management (PIM) with access reviews

Answer

Multifactor authentication (MFA) with Conditional Access

Answer

Conditional Access policies requiring MFA for all admins

Question 7

A company wants to protect sensitive email data from being exfiltrated by malicious insiders. They need a solution that can detect and block anomalous outbound email traffic in real time. Which Microsoft solution should they use?

Accepted Answer

Microsoft Defender for Office 365. Microsoft Defender for Office 365 (MDO) is the correct solution because it provides real-time detection and blocking of anomalous outbound email traffic through its outbound spam filtering and anti-phishing policies. MDO uses machine learning models to analyze email sending patterns, such as sudden spikes in volume or unusual recipient domains, and can automatically quarantine or block suspicious outbound messages to prevent data exfiltration by malicious insiders.

Answer

Microsoft Purview Information Protection

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 8

A company is designing a security operations center (SOC). They want to use Microsoft Sentinel as their SIEM. They need to ensure that all security events from on-premises servers are collected. Which data connector should they configure?

Accepted Answer

Windows Security Events via Azure Monitor Agent (AMA). Option D is correct because the Windows Security Events via Azure Monitor Agent (AMA) connector is the recommended method for collecting security events from on-premises Windows servers into Microsoft Sentinel. AMA is the current generation agent that supports data collection rules (DCRs) for granular filtering and is fully supported by Sentinel, replacing the legacy Log Analytics Agent. This ensures comprehensive collection of Windows security logs such as Event ID 4625 (failed logons) and 4688 (process creation) for SOC analysis.

Answer

Windows Firewall via Legacy Agent

Answer

Syslog via AMA

Answer

Azure Activity Log

Question 9

A company uses Microsoft Defender for Endpoint to protect endpoints. They want to configure attack surface reduction rules to block executable files from running unless they meet a specific prevalence, age, or trust level. Which ASR rule should they enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria. Option D is correct because the ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is specifically designed to block executables that do not meet Microsoft's cloud-based prevalence, age, or trustworthiness criteria. This rule uses the Microsoft Intelligent Security Graph to evaluate files against global telemetry, blocking those that are new, rare, or unsigned, which directly matches the requirement to block executables based on prevalence, age, or trust level.

Answer

Block Office communication application from creating child processes

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block untrusted and unsigned processes that run from USB

Question 10

A company is implementing Microsoft Purview to protect sensitive data in SharePoint Online. They need to automatically apply a 'Highly Confidential' label to documents that contain credit card numbers. What should they create?

Accepted Answer

An auto-labeling policy for sensitivity labels. Option D is correct because Microsoft Purview auto-labeling policies for sensitivity labels can automatically detect sensitive data types (e.g., credit card numbers) in SharePoint Online documents and apply a 'Highly Confidential' label without user intervention. This meets the requirement for automatic, policy-driven labeling based on content inspection.

Answer

A communication compliance policy

Answer

A data loss prevention (DLP) rule

Answer

A manual labeling policy

Question 11

A company uses Microsoft Intune to manage devices. They want to ensure that all devices accessing corporate email are compliant with security policies before they can connect. Which feature should they enable?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it enforces compliance-based access control at the authentication layer. By integrating with Intune compliance policies, Conditional Access can block or allow device access to corporate email (e.g., Exchange Online) based on real-time compliance status, ensuring only compliant devices can connect.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Intune App Protection Policies

Answer

Mobile Device Management (MDM) enrollment

Question 12

A company is designing a security strategy for their AI-powered applications using Microsoft Azure OpenAI Service. They need to ensure that the AI models are not used to generate harmful content and that the data sent to the models is protected. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) for AI. Microsoft Purview Data Loss Prevention (DLP) for AI is the correct feature because it is specifically designed to monitor and control the data sent to and from AI applications, including Azure OpenAI Service, to prevent the generation of harmful content and protect sensitive data. It uses deep content analysis and policy-based controls to detect and block policy violations in real-time, directly addressing the dual requirements of content safety and data protection.

Answer

Microsoft Purview Endpoint DLP

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Question 13

A company is implementing Microsoft Defender for Cloud to protect their Azure environment. Which TWO of the following are security best practices that should be enabled? (Choose two.)

Accepted Answer

Cloud Security Posture Management (CSPM). Cloud Security Posture Management (CSPM) is a core feature of Microsoft Defender for Cloud that continuously assesses your Azure environment against security benchmarks (e.g., Azure Security Benchmark) and provides actionable recommendations to harden configurations. Enabling CSPM is a foundational best practice because it proactively identifies misconfigurations (like open management ports or unencrypted storage) before they can be exploited, directly aligning with the 'prevent' phase of the shared responsibility model.

Answer

Microsoft Defender for Office 365

Answer

Microsoft Defender for Endpoint onboarding

Answer

Microsoft Sentinel integration

Question 14

A company is designing a data security strategy using Microsoft Purview. They need to identify sensitive data across their data estate, including on-premises SQL Server, Azure SQL Database, and Amazon S3. Which THREE components should they use? (Choose three.)

Accepted Answer

Microsoft Purview Data Estate Insights. Microsoft Purview Data Estate Insights provides visibility into data estate health and security posture, including sensitive data discovery across on-premises SQL Server, Azure SQL Database, and Amazon S3. It aggregates scan results and offers dashboards to identify where sensitive data resides, enabling targeted classification and protection actions.

Answer

Microsoft Purview External Identities

Answer

Microsoft Purview Compliance Manager

Question 15

A company is deploying Microsoft Entra ID Governance. They need to implement a least privilege access model for their Azure resources. Which TWO features should they use? (Choose two.)

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is correct because it provides just-in-time (JIT) privileged access to Azure resources, enabling time-bound and approval-based role activation. This directly supports a least privilege model by ensuring users only have elevated permissions when needed, reducing standing access.

Answer

Identity Protection

Answer

Conditional Access policies

Answer

Microsoft Intune compliance policies