Design Solutions for Security Operations SC-100 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which security workflow is primarily focused on proactively searching for signs of malicious activity that may not have triggered existing alerts?

   • AVulnerability management
   • BAccess review
   • CIncident response
   • DThreat hunting
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A manufacturing company wants to improve its threat detection coverage for industrial control systems (ICS) and operational technology (OT) environments. They have Microsoft Defender for IoT and want to integrate its alerts into Microsoft Sentinel. They also want to use the MITRE ATT&CK for ICS framework to identify gaps in their detection coverage. What should you do?

   • AUse the Microsoft Defender for Cloud connector to ingest Defender for IoT alerts and then manually map them to the MITRE ATT&CK for Enterprise matrix.
   • BEnable the Defender for IoT data connector in Sentinel and use the MITRE ATT&CK for ICS solution to map detections.
   • CUse Azure Monitor to collect Defender for IoT logs and then export them to Sentinel for analysis.
   • DCreate a custom API-based connector to pull Defender for IoT alerts into Sentinel and use a custom workbook to map to MITRE ATT&CK for ICS.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary goal of an incident management workflow?

   • ATo assign blame for the incident
   • BTo delete all logs related to the incident
   • CTo prevent all future security incidents
   • DTo restore normal operations as quickly as possible while minimizing impact
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team wants to evaluate their incident response process. They have a Sentinel workspace with analytics rules and playbooks. They want to measure the effectiveness of their detections and response actions. Which approach should they use?

   • AUse Microsoft Defender XDR's threat analytics
   • BUse Microsoft Purview Audit to review incident actions
   • CUse Sentinel's incident metrics and workbooks to track time-to-respond and false positive rates
   • DUse Azure Monitor alerts to track playbook failures
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization wants to automate the response to phishing emails reported by users. When a user reports a phishing email using the Outlook add-in, they want the email to be automatically submitted to Microsoft Defender for Office 365 for analysis, and if it is confirmed as phishing, they want the user to be notified and the email to be removed from all mailboxes. They want to use Microsoft Sentinel for orchestration. What should you configure?

   • AUse a Power Automate flow that directly reads the user's mailbox and deletes the email if it contains a phishing link.
   • BUse a Microsoft 365 Defender incident rule to automatically purge any email that is reported by a user, without further analysis.
   • CConfigure a mail flow rule in Exchange Online to automatically delete any email that is reported by a user.
   • DCreate a Sentinel playbook that triggers on the user-reported email, submits it to Defender for Office 365, and if the verdict is phishing, sends a notification and uses the Defender for Office 365 action to purge the email.
   Reveal Solution Discussion Select an answer first