A company uses Microsoft Defender XDR and Sentinel. They want to avoid duplicate incidents when Defender XDR creates an incident and Sentinel also creates an incident from the same alert. They also want to use Sentinel's SOAR capabilities for response. What should they do?

Use Sentinel's incident creation rule for all alerts and disable Defender XDR incident creation

Use automation rules to merge duplicate incidents

Use the Microsoft Defender XDR incident connector in Sentinel and enable incident creation from Defender XDR, then disable Sentinel analytics rules for Defender alerts

Create separate analytics rules in Sentinel for each Defender product alert

A company has a multicloud environment with Azure and AWS. They want to use Microsoft Sentinel for SIEM and SOAR. They also want to automate response to AWS CloudTrail alerts. Which approach should they use?

Use Azure Arc to connect AWS resources to Azure Monitor

Use AWS native CloudWatch alarms to trigger Lambda functions

Use Microsoft Defender for Cloud to monitor AWS and export to Sentinel

Use the AWS CloudTrail connector in Sentinel and create automation rules with playbooks for response

Which capability is a core function of a Security Information and Event Management (SIEM) system?

Blocking malicious network traffic in real time

Managing user identities and access permissions

Aggregating and correlating security events from multiple sources

Enforcing data loss prevention policies on endpoints

What is the primary purpose of a centralized logging and auditing solution?

To replace the need for identity management

To provide a single source of truth for security events and user activities across the organization

To automatically block malicious IP addresses

A multinational company has a complex hybrid and multicloud environment with Azure, AWS, GCP, and on-premises data centers. They want to use Microsoft Sentinel as their central SIEM. They have a limited security budget and want to minimize data ingestion costs while still meeting their security monitoring requirements. They also want to use MITRE ATT&CK to prioritize their detection efforts. What should they do?

Use a third-party SIEM instead of Sentinel to reduce costs.

Ingest all logs from all sources into Sentinel and use the MITRE ATT&CK solution to identify gaps.

Ingest only Azure logs into Sentinel and ignore AWS, GCP, and on-premises logs to save costs.

Use the native connectors for AWS and GCP, and use Azure Arc to collect on-premises logs, but only ingest logs that are relevant to the MITRE ATT&CK techniques they want to cover.

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 1

Design Solutions for Security Operations SC-100 Practice Questions (Page 1)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

25–30%of the exam

Questions 1–5

1expert · hard
A company uses Microsoft Defender XDR and Sentinel. They want to avoid duplicate incidents when Defender XDR creates an incident and Sentinel also creates an incident from the same alert. They also want to use Sentinel's SOAR capabilities for response. What should they do?
Select an answer first
2expert · hard
A company has a multicloud environment with Azure and AWS. They want to use Microsoft Sentinel for SIEM and SOAR. They also want to automate response to AWS CloudTrail alerts. Which approach should they use?
Select an answer first
3foundation · easy
Which capability is a core function of a Security Information and Event Management (SIEM) system?
Select an answer first
4foundation · easy
What is the primary purpose of a centralized logging and auditing solution?
Select an answer first
5expert · hard
A multinational company has a complex hybrid and multicloud environment with Azure, AWS, GCP, and on-premises data centers. They want to use Microsoft Sentinel as their central SIEM. They have a limited security budget and want to minimize data ingestion costs while still meeting their security monitoring requirements. They also want to use MITRE ATT&CK to prioritize their detection efforts. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.