Design solutions that align with security best practices and priorities →hardMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design solutions that align with security best practices and priorities
You are a security architect for a large financial services company. The company has a hybrid identity environment with on-premises Active Directory synchronized to Microsoft Entra ID using Microsoft Entra Connect. They use Microsoft 365 E5 licenses and have deployed Microsoft Defender for Cloud, Microsoft Defender for Identity, Microsoft Sentinel, and Microsoft Purview. The company has recently suffered a ransomware attack where an attacker gained access via a compromised service account that had permanent Global Administrator privileges. The attacker then used the account to create a backdoor user and exfiltrate sensitive data from SharePoint Online. After the incident, the CISO mandates a Zero Trust security transformation with the following requirements: 1. Eliminate standing privileged access for all cloud admins. 2. Require phishing-resistant authentication for all privileged roles. 3. Ensure that all sensitive data in SharePoint Online is automatically classified and protected. 4. Enable detection of lateral movement using anomalous behavior analytics. Which combination of actions should you recommend?
⚠ Common exam trap
A common mix-up: candidates confuse MFA (which can be phishable) with phishing-resistant authentication (e.g., FIDO2 or certificate-based), and they may overlook that automatic classification requires auto-labeling policies, not manual labeling or data discovery tools like Data Map.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.
It directly addresses all four CISO requirements: Privileged Identity Management (PIM) eliminates standing Global Administrator privileges by requiring just-in-time activation; Authentication Strengths with FIDO2 enforces phishing-resistant authentication for privileged roles; auto-labeling policies in Microsoft Purview automatically classify and protect sensitive data like credit card numbers in SharePoint Online; and Defender for Identity lateral movement path detection uses behavioral analytics to detect anomalous lateral movement, fulfilling the detection requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.
Why this is correct
Privileged Identity Management removes standing Global Administrator access and activates roles just-in-time with approval, time limits, and audit trail, meeting the privileged access requirement. Configuring Authentication Strengths to require FIDO2 enforces phishing-resistant MFA specifically for activation and sign-in, satisfying the hardened MFA mandate. Auto-labeling policies for credit card numbers apply sensitivity labels automatically based on sensitive info types, ensuring data protection without manual effort. Defender for Identity lateral movement path detection analyzes entity activities to expose vulnerable paths attackers could exploit, fulfilling the lateral movement detection requirement.
- ✗
Deploy Microsoft Entra Identity Protection for all users, configure Azure AD Conditional Access with MFA, use Microsoft Purview Information Protection with manual labeling, and enable Microsoft Sentinel analytics for lateral movement.
Why it's wrong here
Entra Identity Protection only assesses risk and triggers policies like MFA prompt, but it does not secure admin privileges or eliminate persistent access, and it lacks lateral movement detection. Manual labeling via Microsoft Purview Information Protection is unreliable because users may misclassify or skip labels, leaving credit card data unprotected. Sentinel analytics is fundamentally reactive, alerting after suspicious activity instead of proactively preventing lateral movement, and Azure AD MFA alone is susceptible to phishing attacks. This option fails to address privileged access management and phishing-resistant credentials.
- ✗
Configure Conditional Access to require MFA for admins, enable Microsoft Purview DLP for SharePoint, deploy Defender for Cloud Apps, and use Identity Protection for user risk.
Why it's wrong here
Conditional Access MFA for admins is a baseline control, but without Authentication Strengths it doesn't enforce phishing-resistant FIDO2, and it leaves standing Global Admin privileges untouched. Purview DLP for SharePoint is limited to that workload and, lacking auto-labeling, it won't consistently classify credit card data across the tenant. Defender for Cloud Apps provides visibility and session controls for SaaS apps, not lateral movement path detection on-premises. Identity Protection for user risk merely flags compromised identities and does not provide just-in-time access or hardened MFA for privileged roles.
- ✗
Remove all permanent admin roles and use just-in-time access via PIM, enforce MFA via Conditional Access, apply sensitivity labels via Microsoft Purview Data Map, and use Microsoft Defender for Cloud for network security groups.
Why it's wrong here
While removing permanent admin roles via PIM meets the JIT access requirement, the plan falls short on MFA because Conditional Access should reference Authentication Strengths to mandate FIDO2, not just generic MFA. Microsoft Purview Data Map is for metadata scanning and inventory, not for automatically applying sensitivity labels; that job belongs to auto-labeling policies with sensitive info types. Defender for Cloud bridges hybrid security posture and network security group management, but it is not designed for lateral movement path detection—Defender for Identity is. Additionally, this option lacks any data classification control for credit card numbers, leaving the data protection mandate unsatisfied.
Visual reference
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.