Design Solutions for Security Operations SC-100 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   A security team needs a central platform to aggregate security logs from firewalls, servers, and cloud workloads, and to run queries for threat detection. Which Microsoft solution is designed for this purpose?

   • AAzure Policy
   • BMicrosoft Defender for Endpoint
   • CMicrosoft Purview Audit
   • DMicrosoft Sentinel
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company operates industrial control systems (ICS) and wants to improve threat detection coverage for their OT environment. They plan to map detections to the MITRE ATT&CK for ICS framework. Which Microsoft solution should they use to collect and analyze OT security events?

   • AMicrosoft Defender for Endpoint on OT devices
   • BMicrosoft Defender for Cloud with regulatory compliance
   • CAzure Monitor with custom KQL queries
   • DMicrosoft Defender for IoT with Sentinel
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational company has offices in the US and Europe and uses Azure, AWS, and on-premises servers. The security team needs a single dashboard to correlate security alerts from all environments and meet a regulatory requirement to retain audit logs for 7 years. Which solution should they implement?

   • AMicrosoft Defender for Cloud with regulatory compliance dashboard
   • BMicrosoft Purview Audit with a 7-year retention policy
   • CAzure Monitor with a single Log Analytics workspace and archive to Azure Storage
   • DMicrosoft Sentinel with data connectors for Azure, AWS, and on-premises sources, and a long-term retention policy on the Log Analytics workspace
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security operations center (SOC) wants to standardize its incident response process. They currently use Microsoft Sentinel and Microsoft Defender XDR. They want to ensure that every new incident is automatically assigned to the correct analyst team based on the type of attack, and that the incident is updated with relevant playbook steps. What should you implement?

   • ACreate a Sentinel automation rule that triggers on incident creation and runs a playbook that assigns the incident to a team based on the incident's MITRE ATT&CK tactic and adds a task list.
   • BConfigure a mail flow rule in Exchange Online to automatically delete any email that is reported by a user.
   • CUse Microsoft Defender XDR's built-in incident assignment feature and manually add tasks to each incident.
   • DUse a Power Automate flow that directly reads the user's mailbox and deletes the email if it contains a phishing link.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security operations center (SOC) receives hundreds of low-severity alerts daily. They want to automatically triage and respond to common alerts (e.g., impossible travel) without manual intervention, while escalating complex incidents to analysts. Which solution should they implement?

   • AMicrosoft Defender XDR automated investigation and response (AIR) for all alerts
   • BMicrosoft Sentinel automation rules with playbooks that run on alert creation and escalate to incidents when needed
   • CMicrosoft Defender for Cloud Apps session policies to block impossible travel
   • DAzure Logic Apps manually triggered by analysts for each alert
   Reveal Solution Discussion Select an answer first