Design Solutions for Security Operations SC-100 Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company has a security operations center that uses Microsoft Sentinel. They want to improve their incident response by using threat intelligence. They have a paid threat intelligence feed that provides indicators of compromise (IOCs). They want to use these IOCs to detect threats and automate the response. What should they do?

   • AUse a Logic App to manually add the IOCs to a watchlist and create a custom detection rule.
   • BUse Microsoft Defender for Endpoint's threat intelligence feature to import the IOCs and automatically block them.
   • CUse Microsoft Graph security API to import the IOCs directly into Sentinel and create automation rules.
   • DImport the IOCs into Sentinel using the Threat Intelligence - Upload Indicators API and create analytics rules that use the TI map to detect threats.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which capability is essential for a monitoring solution to support a multicloud environment?

   • AAbility to ingest logs from multiple cloud providers
   • BAbility to manage virtual machines in all clouds
   • CAbility to enforce firewall rules across clouds
   • DAbility to provide a single identity for all clouds
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company's incident response team wants to use threat hunting to proactively search for indicators of compromise (IOCs) across their endpoints and email. They want to use a single query language. Which tool should they use?

   • AAzure Monitor log queries
   • BMicrosoft Sentinel hunting queries
   • CMicrosoft Purview eDiscovery
   • DMicrosoft Defender XDR advanced hunting
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   Contoso Pharmaceuticals has Microsoft 365 E5 and Microsoft Defender for Endpoint deployed. The security team wants to automate the initial triage of high-severity alerts from Defender for Endpoint, including enrichment with user risk data from Microsoft Entra ID Protection, and then create an incident in Microsoft Sentinel for further investigation. The team wants to minimize the number of separate tools and manual steps. What should you recommend?

   • ACreate a Sentinel automation rule that triggers on incidents and runs a playbook that calls the Microsoft Graph security API to get the user risk and create a task in the incident.
   • BConfigure Microsoft Defender XDR to automatically create incidents in Microsoft Sentinel and use a Sentinel automation rule with a playbook that enriches the incident with user risk data from Microsoft Graph.
   • CUse Microsoft Defender for Cloud Apps to forward all alerts to Sentinel and then create a custom workbook to manually review and triage each alert.
   • DSet up a logic app in Azure that polls Defender for Endpoint alerts every minute, enriches them with user risk, and creates a separate incident in Sentinel using the API.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is deploying Microsoft Sentinel in a new Azure region to meet data residency requirements. They have existing on-premises security tools that generate logs in a proprietary format. They want to ingest these logs into Sentinel without building custom parsers. They also need to retain logs for six years for compliance. What should they do?

   • AUse Azure Data Explorer to ingest the logs and then export them to Sentinel.
   • BStore the logs in Azure Blob Storage and use a Logic App to import them into Sentinel on a schedule.
   • CUse the Log Analytics agent to collect logs directly from the proprietary tools and send them to Sentinel.
   • DUse a syslog forwarder to send logs to Sentinel and configure a custom table with a six-year retention policy.
   Reveal Solution Discussion Select an answer first