A security architect needs to enable auditing of user and admin activities across Microsoft 365 services, such as Exchange Online and SharePoint Online. Which Microsoft Purview solution should be used?

Microsoft Purview Communication Compliance

Microsoft Purview Information Protection

Microsoft Purview Data Lifecycle Management

A SOC manager wants to improve the efficiency of their incident response process. They have Microsoft Sentinel and Microsoft Defender XDR. They want to ensure that all incidents are properly documented, and that the response process is consistent across the team. They also want to automate the collection of evidence from affected devices. What should they do?

Use Microsoft Defender XDR's built-in incident management features to document and collect evidence.

Use a manual process where each analyst collects evidence and documents it in a shared spreadsheet.

Create a Sentinel playbook that automatically collects evidence from affected devices using Defender for Endpoint's live response, and adds a task list to the incident for documentation.

Use Azure Automation runbooks to collect evidence from all devices, regardless of whether they are involved in the incident.

A company runs workloads in Azure, Google Cloud Platform (GCP), and on-premises. They want to monitor security events across all environments and use advanced hunting queries to detect threats. Which approach should they take?

Use Azure Monitor with a single workspace and enable Azure Sentinel

Use Microsoft Defender for Cloud to monitor GCP and on-premises and export to Azure Sentinel

Use Azure Arc to connect GCP and on-premises resources to Azure Monitor only

Use Microsoft Sentinel with connectors for GCP and on-premises, and enable Microsoft Defender XDR advanced hunting

A company's incident response (IR) team uses Microsoft Sentinel. They want to ensure that every incident is assigned to an analyst, has a severity level, and follows a standardized investigation workflow. Which feature should they use?

Microsoft Purview compliance portal

Microsoft Defender XDR incident queue

Incident management in Sentinel with custom severity, assignment, and automation rules

A security team wants to identify gaps in their detection coverage for enterprise endpoints. They plan to map their existing detections to the MITRE ATT&CK framework and then create new analytics rules for techniques that are not covered. Which tool should they use to automate this mapping?

Microsoft Purview Audit log search

Azure Monitor workbooks with custom KQL

Microsoft Defender for Endpoint's threat analytics

Microsoft Sentinel's MITRE ATT&CK coverage workbook

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 1

Design Solutions for Security Operations SC-100 Practice Questions (Page 8)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

25–30%of the exam

Questions 36–40

36foundation · easy
A security architect needs to enable auditing of user and admin activities across Microsoft 365 services, such as Exchange Online and SharePoint Online. Which Microsoft Purview solution should be used?
Select an answer first
37expert · hard
A SOC manager wants to improve the efficiency of their incident response process. They have Microsoft Sentinel and Microsoft Defender XDR. They want to ensure that all incidents are properly documented, and that the response process is consistent across the team. They also want to automate the collection of evidence from affected devices. What should they do?
Select an answer first
38application · medium
A company runs workloads in Azure, Google Cloud Platform (GCP), and on-premises. They want to monitor security events across all environments and use advanced hunting queries to detect threats. Which approach should they take?
Select an answer first
39application · medium
A company's incident response (IR) team uses Microsoft Sentinel. They want to ensure that every incident is assigned to an analyst, has a severity level, and follows a standardized investigation workflow. Which feature should they use?
Select an answer first
40application · medium
A security team wants to identify gaps in their detection coverage for enterprise endpoints. They plan to map their existing detections to the MITRE ATT&CK framework and then create new analytics rules for techniques that are not covered. Which tool should they use to automate this mapping?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.