SC-100 Practice Question: Design solutions that align with security best practices and priorities

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Deploy Microsoft Defender for Identity sensors on domain controllers and configure Microsoft Sentinel to ingest Defender for Identity alerts.

  Why this is correct

  This is correct because Microsoft Defender for Identity sensors installed on domain controllers monitor AD DS traffic and use behavioral analytics to detect advanced attacks like pass-the-hash and reconnaissance. Integrating with Microsoft Sentinel allows centralized incident correlation and response. This directly meets the requirement for detecting on-premises AD DS threats and integrating with Sentinel.

• ✗

  Configure Microsoft Entra ID Protection risk policies and stream risk detections to Microsoft Sentinel.

  Why it's wrong here

  This is incorrect because Microsoft Entra ID Protection detects identity risks in Microsoft Entra ID, such as leaked credentials or atypical sign-ins, not on-premises Active Directory Domain Services attacks like pass-the-hash. It does not monitor domain controller traffic or provide the behavioral analytics needed for AD DS reconnaissance detection. This solution does not address the on-premises threat detection requirement.

• ✗

  Enable Microsoft Defender for Cloud Apps anomaly detection policies and connect them to Microsoft Sentinel.

  Why it's wrong here

  This is incorrect because Microsoft Defender for Cloud Apps focuses on cloud app usage and anomaly detection, not on-premises Active Directory Domain Services attack detection. It cannot detect pass-the-hash or reconnaissance against domain controllers. While it can integrate with Sentinel, it does not provide the required behavioral analytics for on-premises AD DS threats described in the scenario.

• ✗

  Install Microsoft Monitoring Agent on domain controllers and create custom log queries in Microsoft Sentinel to detect suspicious activity.

  Why it's wrong here

  This is incorrect because while Microsoft Monitoring Agent can collect logs, it does not provide the built-in behavioral analytics and specialized detection capabilities of Microsoft Defender for Identity. Custom queries would require significant effort to replicate Defender for Identity's advanced attack detection, and would not natively identify pass-the-hash or reconnaissance with the same fidelity. This approach is less effective and more administratively burdensome.

Go deeper

Related to this question