How many Troubleshooting Scenario Questions questions are on this page?

This page has 11 Troubleshooting Scenario Questions scenario questions for the SC-100 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SC-100 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to Microsoft Cybersecurity Architect questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise Microsoft Cybersecurity Architect practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SC-100

exam code

Microsoft

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1easymultiple choice

Full question →

A company uses Azure Front Door to load balance traffic across two origin servers in different Azure regions. They notice that failover is not working when one origin becomes unhealthy. What is the most likely cause?

A
Both origins are in the same region.
Why wrong: The scenario states they are in different regions, so this is not the issue.
B
Caching is enabled on the Front Door profile.
Why wrong: Caching affects content delivery, not failover.
C
Session affinity is enabled.
Why wrong: Session affinity ensures traffic is directed to the same origin; it does not prevent failover.
D
The health probe path is set to an incorrect endpoint on the origin servers.
An incorrect health probe path can cause Front Door to consider the origin healthy when it is not, or vice versa.

Full breakdown with real-world context →

Question 2mediumdrag order

Read the full VPN explanation →

Order the steps to troubleshoot an Azure VPN gateway connection failure.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 3mediummultiple choice

Full question →

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to ensure that critical recommendations are automatically remediated. They create a workflow automation that triggers a Logic App for specific recommendations. However, the Logic App fails to run. What is the most likely cause?

A
The managed identity of the Logic App lacks permissions on the target resources.
Logic App needs permissions to perform remediation actions.
B
The subscription is not onboarded to Defender for Cloud.
Why wrong: Workflow automation can still be configured but assessments might be limited.
C
Defender for Cloud is disabled for the resource group.
Why wrong: Defender for Cloud is enabled at the subscription level.
D
The recommendation is disabled in the security policy.
Why wrong: If disabled, the recommendation won't appear, but the automation would not trigger.

Full breakdown with real-world context →

Question 4easymultiple choice

Full question →

Refer to the exhibit. A security administrator created this Azure Policy definition to prevent unauthorized role assignments. However, SOC analysts are unable to assign the Security Operations Contributor role to new team members. What is the most likely cause?

Exhibit

Refer to the exhibit.
```json
{
  "properties": {
    "displayName": "SecurityOperationsPolicy",
    "description": "Policy to assign Security Operations Contributor role to SOC team.",
    "metadata": {
      "category": "Security Center"
    },
    "parameters": {
      "principalId": {
        "type": "String",
        "metadata": {
          "displayName": "Principal ID"
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "type",
        "equals": "Microsoft.Authorization/roleAssignments"
      },
      "then": {
        "effect": "deny",
        "details": {
          "roleDefinitionIds": [
            "/providers/Microsoft.Authorization/roleDefinitions/5cbe2b2a-1c3b-4b4d-9b4e-2b5e6f7a8c9d"
          ],
          "exemption": "deny"
        }
      }
    }
  }
}
```

A
The policy is scoped to a management group that does not include the SOC team's subscription.
Why wrong: The exhibit does not specify scope, but the deny effect is the primary issue.
B
The parameter 'principalId' is required but not provided when assigning the policy.
Why wrong: Parameters are for policy assignment, but the deny effect is applied regardless of parameters.
C
The role definition ID in the policy does not match the Security Operations Contributor role.
Why wrong: The ID shown is a placeholder but likely correct; the issue is the deny effect, not mismatched IDs.
D
The policy uses the 'deny' effect, which blocks any role assignment for the specified role.
The policy denies assignments of the specified role, preventing SOC analysts from assigning it.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

Refer to the exhibit. You are troubleshooting a KQL query in Microsoft Sentinel that is supposed to return alerts for ransomware detections in the last day. The query returns no results, but you know there were ransomware alerts. What is the most likely cause?

Exhibit

Refer to the exhibit.
```kusto
SecurityAlert
| where AlertName == "Malware detected"
| where TimeGenerated > ago(1d)
| extend ThreatFamily = tostring(parse_json(ExtendedProperties).ThreatFamily)
| where ThreatFamily == "Ransomware"
| project TimeGenerated, AlertName, Computer, ThreatFamily
```

A
The ThreatFamily field is an integer, not a string.
Why wrong: ThreatFamily is typically a string.
B
The AlertName filter is too specific and does not match the actual alert name.
Alert names may have prefixes or variations.
C
The TimeGenerated filter uses the wrong time range.
Why wrong: The filter is correct for the last 1 day.
D
The parse_json function is failing due to malformed JSON.
Why wrong: If it failed, the query would error, not return empty results.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

A company uses Microsoft Defender XDR and wants to ensure that all devices are reporting to the service. They notice that some devices are not appearing in the device inventory. Which log source should they check first to troubleshoot?

A
Microsoft Defender for Endpoint deployment log (MDEClientAnalyzer)
This log contains onboarding status and connectivity issues.
B
Microsoft Intune enrollment logs
Why wrong: Intune logs show device management, not Defender onboarding.
C
Windows Event Log - Microsoft-Windows-Windows Defender/Operational
Why wrong: This log shows local Defender events, not onboarding.
D
Syslog from the device
Why wrong: Syslog is typically used for non-Microsoft sensors.

Full breakdown with real-world context →

Question 7easymultiple choice

Full question →

Your organization wants to use Microsoft Defender XDR to automatically investigate and respond to alerts. You need to ensure that the solution can autonomously remediate confirmed threats on endpoints, such as quarantining files and isolating devices. What should you enable?

A
Microsoft Defender for Identity
Why wrong: Defender for Identity monitors on-premises Active Directory for threats, not endpoints.
B
Microsoft Defender for Cloud Apps
Why wrong: Defender for Cloud Apps secures cloud applications, not endpoints.
C
Microsoft Defender for Endpoint
Defender for Endpoint provides automated investigation and remediation, including file quarantine and device isolation.
D
Microsoft Defender for Office 365
Why wrong: Defender for Office 365 protects email and collaboration tools, not endpoints.

Full breakdown with real-world context →

Question 8hardmulti select

Full question →

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that investigates and responds to a ransomware incident. Which three actions should you take? (Choose THREE.)

A
Isolate affected devices using Microsoft Defender for Endpoint.
Isolation prevents the ransomware from spreading.
B
Review the incident timeline in Microsoft Defender XDR.
The timeline provides a detailed view of the attack chain.
C
Create a new workbook to visualize the incident.
Why wrong: Workbooks are for dashboards, not immediate investigation.
D
Delete all log data older than 24 hours to improve performance.
Why wrong: Deleting logs would destroy forensic evidence.
E
Run a hunting query in Microsoft Sentinel to identify affected devices.
Hunting queries help identify the scope of the incident.

Full breakdown with real-world context →

Question 9easymultiple choice

Full question →

Your organization uses Microsoft Purview to manage data governance. The compliance team needs to be able to search for and investigate whether any sensitive data (e.g., credit card numbers) is stored in Microsoft Teams messages. They also need to place a legal hold on specific user's Teams messages for eDiscovery. You need to design the solution. What should you configure?

A
Configure a sensitivity label for credit card numbers and apply it to Teams messages.
Why wrong: Labels do not enable content search or legal hold.
B
Create a Data Loss Prevention policy that monitors Teams messages for credit card numbers.
Why wrong: DLP detects and prevents sharing but does not provide search or hold capabilities.
C
Use Microsoft Purview eDiscovery (Premium) to create a case, search for credit card numbers in Teams messages, and place a hold on the user's mailbox and Teams data.
eDiscovery supports content search and legal hold across Microsoft 365 services.
D
Enable Microsoft Purview Audit to search the audit log for Teams messages containing credit card numbers.
Why wrong: Audit logs metadata, not message content.

Full breakdown with real-world context →

Question 10mediummultiple choice

Full question →

Refer to the exhibit. You receive an alert from Microsoft Defender for Cloud Apps. You need to investigate this alert in Microsoft Sentinel. Which Microsoft Sentinel feature should you use to visualize the relationship between the user account and the IP address?

Exhibit

{
  "alert": {
    "title": "Suspicious sign-in activity",
    "severity": "Medium",
    "description": "User 'jdoe@contoso.com' signed in from an anonymous IP address (111.222.333.444) using a new browser.",
    "source": "Microsoft Defender for Cloud Apps",
    "entities": [
      {"type": "account", "name": "jdoe@contoso.com"},
      {"type": "ip", "address": "111.222.333.444"}
    ]
  }
}

A
Configure an automation rule to trigger a playbook.
Why wrong: Automation rules automate responses, not investigation.
B
Run a hunting query to search for similar alerts.
Why wrong: Hunting is for proactive search, not visual relationship mapping.
C
Use the Investigation graph to explore the entities involved.
The investigation graph visually maps entities and their connections.
D
Create a new workbook to display the alert details.
Why wrong: Workbooks are for custom dashboards, not interactive entity relationship mapping.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Ansible explanation →

Your company is migrating to a cloud-native security operations center (SOC) using Microsoft Sentinel. You need to design a solution that automatically investigates and remediates common incidents like brute-force attacks on Azure VMs. The solution should use playbooks triggered by analytics rules. Which Microsoft service should you use to create the playbooks, and what is the recommended authentication method?

A
Power Automate with user account
Why wrong: Power Automate is for business workflows, not recommended for Sentinel automation; user accounts are not suitable for automated authentication.
B
Azure Automation with service principal
Why wrong: Azure Automation is for runbooks, but Sentinel playbooks are built on Logic Apps.
C
Azure Logic Apps with managed identity
Logic Apps supports managed identity for secure, credential-free authentication to Azure resources.
D
Azure Functions with API key
Why wrong: Functions can be used but are not the primary service for playbooks; API keys are less secure.

Full breakdown with real-world context →

These SC-100 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style SC-100 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SC-100 topic practice pages

Design solutions that align with security best practices and priorities practice questions

Design security operations, identity, and compliance capabilities practice questions

Design security solutions for infrastructure practice questions

Design a Zero Trust strategy and architecture practice questions

Design security solutions for applications and data practice questions

Evaluate GRC and security operations strategies practice questions

Design security for infrastructure practice questions

Design a strategy for data and applications practice questions

Recommend security best practices and priorities practice questions

SC-100 fundamentals practice questions

SC-100 scenario practice questions

SC-100 troubleshooting practice questions

Practice scenarios

A company uses Azure Front Door to load balance traffic across two origin servers in different Azure regions. They notice that failover is not working when one origin becomes unhealthy. What is the most likely cause?

Order the steps to troubleshoot an Azure VPN gateway connection failure.

Refer to the exhibit. A security administrator created this Azure Policy definition to prevent unauthorized role assignments. However, SOC analysts are unable to assign the Security Operations Contributor role to new team members. What is the most likely cause?

Exhibit

Refer to the exhibit. You are troubleshooting a KQL query in Microsoft Sentinel that is supposed to return alerts for ransomware detections in the last day. The query returns no results, but you know there were ransomware alerts. What is the most likely cause?

Exhibit

A company uses Microsoft Defender XDR and wants to ensure that all devices are reporting to the service. They notice that some devices are not appearing in the device inventory. Which log source should they check first to troubleshoot?

Your organization wants to use Microsoft Defender XDR to automatically investigate and respond to alerts. You need to ensure that the solution can autonomously remediate confirmed threats on endpoints, such as quarantining files and isolating devices. What should you enable?

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that investigates and responds to a ransomware incident. Which three actions should you take? (Choose THREE.)

Refer to the exhibit. You receive an alert from Microsoft Defender for Cloud Apps. You need to investigate this alert in Microsoft Sentinel. Which Microsoft Sentinel feature should you use to visualize the relationship between the user account and the IP address?

Exhibit