SC-100 Practice Question: Design solutions that align with security best practices and priorities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Microsoft Defender for Cloud regulatory compliance

  Why it's wrong here

  Microsoft Defender for Cloud regulatory compliance evaluates your hybrid cloud workloads against industry standards such as CIS, NIST, and Azure Security Benchmark, producing a compliance score and recommendations. It is a security posture assessment tool that checks misconfigurations and compliance controls, but it does not inspect the actual content within data files to classify sensitive information. Therefore, while it can indicate a workload is compliant with a regulation, it never identifies or labels the data itself, so it cannot fulfill a data governance classification requirement.

• ✓

  Microsoft Purview Data Map scanning rules

  Why this is correct

  Microsoft Purview Data Map scanning rules automatically connect to various data sources, both on-premises and multi-cloud, and run scans to profile and classify assets. These rules apply built-in or custom classification patterns—like regex for PII, financial, or health information—and assign sensitivity labels to structured and unstructured data. This is exactly the mechanism that enables data governance by building a searchable, classified inventory of enterprise data, making it the correct choice for a company using Purview.

• ✗

  Microsoft Sentinel data connectors

  Why it's wrong here

  Microsoft Sentinel data connectors integrate with many log sources, such as Azure AD, Microsoft 365, and third-party security products, to aggregate telemetry for threat detection, investigation, and hunting. The connectors focus entirely on activity and event logs, not on the payload or content of stored documents and databases, so they cannot identify or classify sensitive data attributes. Even though Sentinel might capture information about access to data, it does not perform static data classification or label documents, which is outside its scope as a SIEM.

• ✗

  Microsoft Entra ID Protection

  Why it's wrong here

  Microsoft Entra ID Protection leverages anomaly detection and heuristic algorithms to evaluate sign-in behavior, user risk, and compromised credentials, generating policies for conditional access. It analyzes identity-related signals such as impossible travel, leaked credentials, and atypical locations, but it never inspects data repositories or file content for sensitive data types. Since its sole purpose is to protect identities and not to classify data assets, it is irrelevant to the data governance requirement of discovering and labeling sensitive information.

Go deeper

Related to this question