SC-100 · topic practice

Design security operations, identity, and compliance capabilities practice questions

Q: How should I use these Design security operations, identity, and compliance capabilities practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Design security operations, identity, and compliance capabilities questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Design security operations, identity, and compliance capabilities domain.

Practise Microsoft Cybersecurity Architect Design security operations, identity, and compliance capabilities practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Design security operations, identity, and compliance capabilities

Practice 10 questions Browse domain →

What the exam tests

What to know about Design security operations, identity, and compliance capabilities

Design security operations, identity, and compliance capabilities questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Design security operations, identity, and compliance capabilities exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Design security operations, identity, and compliance capabilities questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Design security operations, identity, and compliance capabilities explanation →

Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents. Which feature should you configure?

Trap 1: Create a playbook and run it manually for each incident

Playbooks require manual triggering or integration with automation rules.

Trap 2: Set up an analytics rule with automatic response

Analytics rules generate alerts/incidents but do not include automatic response actions.

Trap 3: Use a workbook to trigger a playbook

Workbooks are for visualization, not for triggering automated responses.

Study all Design security operations, identity, and compliance capabilities common traps →

A
Configure an automation rule to run a playbook automatically
Automation rules can automatically run playbooks based on incident properties such as severity.
B
Create a playbook and run it manually for each incident
Why wrong: Playbooks require manual triggering or integration with automation rules.
C
Set up an analytics rule with automatic response
Why wrong: Analytics rules generate alerts/incidents but do not include automatic response actions.
D
Use a workbook to trigger a playbook
Why wrong: Workbooks are for visualization, not for triggering automated responses.

Design security operations, identity, and compliance capabilities practice questions

What to know about Design security operations, identity, and compliance capabilities

Common Design security operations, identity, and compliance capabilities exam traps

Design security operations, identity, and compliance capabilities questions

Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents. Which feature should you configure?

A company plans to implement Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from sharing credit card numbers via email. What should they configure?

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) resources are assessed against the same security baseline. What should you do?

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Users have smartphones. Which method should you recommend as the primary authentication method?

Your organization uses Microsoft Sentinel to aggregate logs from on-premises and cloud sources. You need to reduce the cost of data ingestion while ensuring security-critical logs are retained for at least one year. What should you do?

Your organization uses Microsoft Defender for Office 365. You need to protect users from malicious links in emails. What should you configure?

Your organization uses Microsoft Entra ID and needs to ensure that external partners can access only specific applications for 30 days. What should you configure?

Your organization uses Microsoft Defender XDR for detection and response. You need to create a custom detection rule that alerts when a user performs more than 10 failed sign-ins from different countries within 5 minutes. Which component should you use?

Your organization uses Microsoft Purview to classify sensitive data. You need to automatically apply a sensitivity label to documents that contain personally identifiable information (PII). Which TWO components should you configure?

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a unified security operations platform. Which THREE capabilities should you enable?

Your organization uses Microsoft Entra ID and needs to implement a Zero Trust identity strategy. Which THREE principles should you apply?

Your company uses Microsoft Defender for Cloud to manage security posture across hybrid workloads. You need to ensure that critical vulnerabilities found on Azure VMs are automatically remediated without manual intervention. Which feature should you enable?

Your organization uses Microsoft Sentinel to centralize security logs from multiple clouds. The security team needs a solution that automatically investigates low-fidelity alerts and creates incidents only when confirmed malicious. Which Microsoft Sentinel feature should you configure?

Your company is deploying Microsoft Intune for mobile device management. You need to ensure that corporate data on personally owned devices is protected without affecting the user's personal data. Which Intune feature should you use?

Your organization is implementing a data loss prevention (DLP) strategy using Microsoft Purview. The compliance team needs to automatically classify and label sensitive data in Microsoft 365, Azure SQL Database, and Amazon S3. Which Purview feature should you use?

Your organization uses Microsoft Defender XDR to detect and respond to threats. The SOC team wants to automatically isolate a device when a high-severity incident is confirmed. Which automation feature should you configure?

Your company is migrating from on-premises Active Directory to Microsoft Entra ID. You need to ensure that users can authenticate using their existing on-premises credentials while gradually moving to cloud-only authentication. Which authentication method should you implement first?

Your organization uses Microsoft Sentinel as a SIEM. The security team wants to use Microsoft Copilot for Security to assist in incident investigation. You need to ensure that Copilot can access Sentinel data while meeting compliance requirements. Which integration should you configure?

Track your progress over time

Start a Design security operations, identity, and compliance capabilities only practice session

Related SC-100 topic practice pages

Design solutions that align with security best practices and priorities practice questions

Design security operations, identity, and compliance capabilities practice questions

Design security solutions for infrastructure practice questions

Design a Zero Trust strategy and architecture practice questions

Design security solutions for applications and data practice questions

Evaluate GRC and security operations strategies practice questions

Design security for infrastructure practice questions

Design a strategy for data and applications practice questions

Recommend security best practices and priorities practice questions

SC-100 fundamentals practice questions

SC-100 scenario practice questions

SC-100 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid