Design Solutions for Security Operations SC-100 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A global organization has a hybrid environment with Azure, on-premises, and mobile devices. They want to use MITRE ATT&CK to evaluate their threat detection coverage across all platforms. They have Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Cloud Apps. They want to identify gaps in their coverage for mobile devices and ICS/OT environments, which they are just starting to deploy. What should they do?

   • ACreate a custom MITRE ATT&CK matrix in Excel and manually map all detections from all sources.
   • BUse only the MITRE ATT&CK for Enterprise matrix and ignore mobile and ICS because they are not yet fully deployed.
   • CUse the MITRE ATT&CK coverage dashboard in Microsoft 365 Defender to view coverage for all platforms, and use the Sentinel MITRE ATT&CK solution to map additional data sources.
   • DDeploy Microsoft Defender for IoT and use its built-in coverage dashboard, but do not integrate with Sentinel.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company wants to improve their threat detection coverage by integrating Microsoft Defender XDR with Microsoft Sentinel. They want to use MITRE ATT&CK to evaluate their coverage. They also want to ensure that high-severity incidents are automatically escalated to the SOC manager. What should they do?

   • ACreate a custom API integration to send incidents from Defender XDR to a third-party ticketing system.
   • BUse Microsoft Defender for Cloud's alert rules to escalate high-severity incidents.
   • CUse Microsoft Defender XDR's built-in incident escalation feature to notify the SOC manager.
   • DEnable the Microsoft Defender XDR connector in Sentinel, use the MITRE ATT&CK solution, and create an automation rule that sends an email to the SOC manager for high-severity incidents.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   A security operations team wants to automate responses to common alerts, such as disabling a compromised user account, without manual intervention. Which Microsoft solution provides SOAR capabilities that integrate with Microsoft Sentinel and Microsoft Defender XDR?

   • AMicrosoft Entra ID
   • BMicrosoft Sentinel playbooks
   • CMicrosoft Purview
   • DAzure Policy
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company wants to improve its threat detection coverage by using MITRE ATT&CK techniques. They have Microsoft Defender for Endpoint and Microsoft Defender for Office 365. They want to see which techniques are covered by their current detections and identify gaps. They also want to automate the creation of incidents for high-confidence detections. What should they use?

   • AUse Microsoft Defender for Cloud's regulatory compliance dashboard to view MITRE ATT&CK coverage.
   • BUse Microsoft Sentinel's MITRE ATT&CK solution and create automation rules to generate incidents from all alerts.
   • CUse the Microsoft 365 Defender portal's MITRE ATT&CK coverage dashboard and create automated incident rules for high-confidence alerts.
   • DExport all alerts to a third-party SIEM and use its MITRE ATT&CK mapping feature.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A security architect is designing a detection and response solution to provide unified visibility across endpoints, email, identity, and cloud apps. Which Microsoft capability is specifically designed to correlate signals across these domains and enable automated response?

   • AMicrosoft Defender XDR
   • BMicrosoft Purview
   • CMicrosoft Entra ID
   • DMicrosoft Defender for Cloud
   Reveal Solution Discussion Select an answer first