Design security operations, identity, and compliance capabilities →mediumMultiple ChoiceObjective-mapped
SC-100 Practice Question: Design security operations, identity, and compliance capabilities
Your organization uses Microsoft Sentinel for security operations. You need to ensure that an attacker cannot disable data collection by deleting the diagnostic settings on the Sentinel workspace. What should you configure?
⚠ Common exam trap
It's easy for candidates to confuse workspace deletion protection (which only prevents workspace deletion) with diagnostic settings deletion protection, or they assume that RBAC alone (Option B) is sufficient to block a privileged attacker, when in fact a resource lock is the only control that enforces a hard deny on deletion regardless of permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a CanNotDelete resource lock on the Log Analytics workspace.
Applying a CanNotDelete resource lock on the Log Analytics workspace prevents any user or process, including an attacker, from deleting the workspace or its diagnostic settings. This lock overrides all role-based permissions, ensuring that even if an attacker gains high-privileged access, they cannot remove the diagnostic settings that stream telemetry to Microsoft Sentinel. Sentinel's data collection relies entirely on these diagnostic settings, so protecting them with a resource lock is the most direct and effective defense against deletion attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Sentinel's workspace deletion protection.
Why it's wrong here
Sentinel's workspace deletion protection is a setting that safeguards the workspace itself from accidental deletion, but it does not extend to the associated diagnostic settings that stream security logs into Sentinel. Those diagnostic settings are independent Azure resources, and a compromised identity with sufficient permissions could still delete them, breaking the data pipeline. Therefore, this control is insufficient for the stated requirement of protecting the diagnostic settings.
- ✗
Assign the Log Analytics Contributor role only to specific users.
Why it's wrong here
Assigning the Log Analytics Contributor role only to specific users reduces the attack surface by limiting who can modify workspace settings, but it does not prevent deletion by a compromised account that holds that role. The Log Analytics Contributor role includes permissions to delete the workspace and its diagnostic settings, so if one of those users' credentials are compromised, an attacker could still remove the diagnostic settings. This is a preventive administrative measure, but it does not provide a hard invariant against deletion.
- ✓
Apply a CanNotDelete resource lock on the Log Analytics workspace.
Why this is correct
Applying a CanNotDelete resource lock on the Log Analytics workspace is the only option that actively blocks any delete operation on the workspace and all its child resources, including diagnostic settings. This lock enforces a deny at the Azure Resource Manager level, overriding even elevated RBAC permissions unless a matching delete lock is removed first. As a result, it provides a robust, unbreakable-by-default safeguard that directly prevents the diagnostic settings from being deleted.
- ✗
Create an Azure Policy to audit diagnostic settings.
Why it's wrong here
Creating an Azure Policy to audit diagnostic settings is a detective control that can alert you when diagnostic settings are missing or misconfigured, but it does not prevent deletion. The policy evaluates compliance after the fact and can trigger remediation tasks, yet those tasks run only after the deletion has already occurred. Thus, it fails to provide the required preventive protection against the deletion of diagnostic settings.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.