Design solutions that align with security best practices and priorities →easyMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
Tailwind Traders is a small business that uses Microsoft 365 Business Premium. They have no dedicated IT staff. The owner wants to implement basic security measures to protect against common threats like phishing, ransomware, and unauthorized access. They need a simple, cost-effective solution that aligns with Microsoft's security best practices for small businesses. Which set of actions should you recommend?
⚠ Common exam trap
The trap here is that candidates often over-engineer the solution by selecting advanced identity or endpoint management options (like PIM, Intune, or Azure AD Premium P2) that are technically valid but inappropriate for a small business with no IT staff, ignoring the cost and complexity constraints explicitly stated in the scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Security Defaults in Microsoft Entra ID to enforce MFA for all users. Configure Microsoft Defender for Office 365 to protect against phishing and malware. Use Microsoft Defender for Business (included) for endpoint protection. Regularly review the Microsoft 365 Secure Score and implement top recommendations.
It aligns with Microsoft's security best practices for small businesses with no dedicated IT staff. Security Defaults in Microsoft Entra ID provide a baseline of MFA enforcement without requiring complex configuration. Microsoft Defender for Office 365 and Defender for Business (included in Microsoft 365 Business Premium) offer integrated phishing, malware, and endpoint protection. Regularly reviewing the Secure Score ensures continuous improvement against common threats like ransomware and unauthorized access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement Privileged Identity Management (PIM) for all accounts. Use Azure Information Protection to classify all emails. Set up a SIEM using Microsoft Sentinel.
Why it's wrong here
PIM for all accounts introduces just-in-time access and elevated roles, which require Azure AD Premium P2 licensing and constant approval workflows that a small business rarely needs. Azure Information Protection for all emails adds classification and encryption overhead across every message and demands training and policy tuning. Microsoft Sentinel is a full SIEM that requires agent deployment, log ingestion costs, and a dedicated security analyst to manage alerts—far beyond the operational capacity of a small business with limited IT staff.
- ✗
Deploy Microsoft Intune to manage devices. Configure Conditional Access policies to require compliant devices. Use Microsoft Defender for Endpoint for antivirus. Set up a VPN for remote access.
Why it's wrong here
Microsoft Intune for full device management requires device enrollment, compliance policies, and ongoing patching oversight, which is significant administrative overhead for a small business. Conditional Access policies requiring compliant devices depend on Intune enrollment and licensing, and forcing VPN for remote access is an outdated pattern when cloud apps like Microsoft 365 already encrypt traffic and can be protected with MFA and Conditional Access. Defender for Endpoint is enterprise-focused; for a small business, Defender for Business provides similar endpoint protection with far less deployment complexity.
- ✗
Purchase Azure AD Premium P2 for all users. Use Identity Protection to detect risks. Configure Conditional Access with session controls. Use Azure AD Identity Governance for access reviews.
Why it's wrong here
Azure AD Premium P2 licensing for every user is a substantial per-user cost that small businesses often cannot justify when basic security defaults are available for free. Identity Protection risk-based policies, session controls, and Identity Governance access reviews are designed for large enterprises with complex role structures, audit requirements, and compliance obligations. For a small business, these features add administrative overhead without a meaningful security gain, especially when Security Defaults already enforce MFA for all users.
- ✓
Enable Security Defaults in Microsoft Entra ID to enforce MFA for all users. Configure Microsoft Defender for Office 365 to protect against phishing and malware. Use Microsoft Defender for Business (included) for endpoint protection. Regularly review the Microsoft 365 Secure Score and implement top recommendations.
Why this is correct
Security Defaults in Microsoft Entra ID automatically enforce MFA for all users and block legacy authentication, providing a strong baseline without extra licensing or complex policy setup. Defender for Office 365 protects against phishing, malware, and malicious links in email, which is critical for small businesses that rely heavily on email communication. Defender for Business is included in Microsoft 365 Business plans and provides managed endpoint protection tailored to smaller organizations. Regularly reviewing the Secure Score helps prioritize low-effort, high-impact security improvements that align with the business's actual risk profile.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.