Design Solutions for Security Operations SC-100 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC wants to automatically block a user's account when Microsoft Defender for Endpoint detects a high-confidence ransomware attack on their device. They also want to create an incident in Sentinel for tracking. Which approach should they use?

   • AUse Defender for Endpoint's built-in response actions to disable the user account
   • BCreate a Sentinel automation rule that triggers a playbook to disable the user account and create an incident
   • CUse Azure AD conditional access to block the user
   • DUse Microsoft Defender for Cloud Apps to block the user
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of Security Orchestration, Automation, and Response (SOAR) in a security operations center?

   • ATo provide a data lake for storing all security logs
   • BTo automate and streamline incident response processes
   • CTo replace the need for security analysts
   • DTo enforce compliance with regulatory standards
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A multinational company is deploying Microsoft Sentinel as its central SIEM. They need to collect security logs from AWS CloudTrail, Google Cloud Platform (GCP) Audit Logs, and on-premises Windows servers. The security team wants a single data connector per source and minimal administrative overhead for log ingestion. What should you configure?

   • AUse the legacy Log Analytics agent for on-premises servers and create custom API-based connectors for AWS and GCP because native connectors do not exist.
   • BUse Azure Policy to deploy the Microsoft Monitoring Agent to all on-premises servers and configure the AWS and GCP connectors in Sentinel.
   • CConfigure the AWS and GCP connectors in Sentinel and use System Center Operations Manager to forward Windows logs to the Sentinel workspace.
   • DInstall Azure Arc on the on-premises servers, then use Azure Policy to deploy the Azure Monitor Agent, and enable the AWS and GCP data connectors in Sentinel.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company wants to centralize logging and auditing for all Microsoft 365 services, Azure resources, and on-premises Active Directory. They want to use Microsoft Sentinel for analysis and Microsoft Purview for compliance auditing. What should they configure?

   • AEnable Microsoft Purview Audit for Microsoft 365, use the Azure Activity connector and Azure Monitor Agent for Azure and on-premises logs, and send all to Sentinel.
   • BUse Microsoft Purview to collect all Azure and on-premises logs directly, and then export them to Sentinel.
   • CUse Azure Monitor to collect Microsoft 365 audit logs and on-premises AD logs, and then send them to Purview.
   • DUse the Office 365 Management API to send logs directly to Sentinel and use Azure Policy to collect on-premises AD logs.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company runs workloads in Azure, on-premises, and in AWS. They want to use Microsoft Sentinel as their single security monitoring platform. They need to ensure that security events from all environments are collected and correlated, and they want to use MITRE ATT&CK coverage to identify gaps. What should you implement?

   • ADeploy Azure Arc on AWS EC2 instances and on-premises servers, then use the Azure Monitor Agent to collect logs into Sentinel.
   • BUse the native AWS connector for CloudTrail, install the Azure Monitor Agent on on-premises servers, and enable the Sentinel MITRE ATT&CK solution.
   • CUse Azure Monitor to collect logs from all environments and then export them to Sentinel for analysis.
   • DSet up a syslog forwarder in AWS and on-premises to send all logs to Sentinel, and use a custom workbook to map to MITRE ATT&CK.
   Reveal Solution Discussion Select an answer first