Which statement best describes the primary purpose of an Extended Detection and Response (XDR) solution?

To provide a single console for managing firewall rules across on-premises and cloud networks

To integrate and correlate security telemetry from multiple domains to detect and respond to complex threats

To collect and analyze security logs from multiple sources for compliance reporting

To replace the need for a SIEM by storing all security logs indefinitely

A company has a hybrid environment with on-premises Active Directory and Azure AD. They need to monitor sign-in logs and audit logs from both environments in a single SIEM. Which data sources should they connect to Microsoft Sentinel?

Microsoft Defender for Identity only

Azure AD diagnostic settings and Windows Security Events from on-premises domain controllers

A security team wants to assess their detection coverage for mobile devices. They plan to map their existing mobile detections to the MITRE ATT&CK for Mobile framework and identify gaps. Which Microsoft product provides detections that can be mapped to this framework?

Microsoft Defender for Identity

Microsoft Defender for Office 365

Microsoft Defender for Endpoint on mobile devices

A company uses Microsoft Sentinel in a single Log Analytics workspace. They are adding new data sources and are concerned about cost and performance. They want to ensure that high-volume, low-value logs (e.g., firewall logs) are retained for only 30 days, while security alerts are retained for 1 year. Which configuration should they use?

Use multiple workspaces for each data source

Use a single workspace with default retention of 1 year

Use Azure Storage for long-term retention of all logs

Use table-level retention settings in the Log Analytics workspace

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 1

Design Solutions for Security Operations SC-100 Practice Questions (Page 7)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

25–30%of the exam

Questions 31–35

31foundation · easy
Which statement best describes the primary purpose of an Extended Detection and Response (XDR) solution?
Select an answer first
32application · medium
A company has a hybrid environment with on-premises Active Directory and Azure AD. They need to monitor sign-in logs and audit logs from both environments in a single SIEM. Which data sources should they connect to Microsoft Sentinel?
Select an answer first
33application · medium
A security team wants to assess their detection coverage for mobile devices. They plan to map their existing mobile detections to the MITRE ATT&CK for Mobile framework and identify gaps. Which Microsoft product provides detections that can be mapped to this framework?
Select an answer first
34expert · hard
A company uses Microsoft Sentinel in a single Log Analytics workspace. They are adding new data sources and are concerned about cost and performance. They want to ensure that high-volume, low-value logs (e.g., firewall logs) are retained for only 30 days, while security alerts are retained for 1 year. Which configuration should they use?
Select an answer first
35foundation · easy
A company has workloads running in Azure, on-premises, and in AWS. The security team wants a single monitoring solution to collect security logs from all these environments. Which Azure service is designed to support hybrid and multicloud monitoring?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.

Design Solutions for Security Operations SC-100 Practice Questions (Page 7)

Questions 31–35

Which statement best describes the primary purpose of an Extended Detection and Response (XDR) solution?

A company has a hybrid environment with on-premises Active Directory and Azure AD. They need to monitor sign-in logs and audit logs from both environments in a single SIEM. Which data sources should they connect to Microsoft Sentinel?

A security team wants to assess their detection coverage for mobile devices. They plan to map their existing mobile detections to the MITRE ATT&CK for Mobile framework and identify gaps. Which Microsoft product provides detections that can be mapped to this framework?

A company has workloads running in Azure, on-premises, and in AWS. The security team wants a single monitoring solution to collect security logs from all these environments. Which Azure service is designed to support hybrid and multicloud monitoring?

Keep studying — Design security operations, identity, and compliance capabilities