SC-100 heavily focuses on Microsoft Defender, Microsoft Sentinel,
Entra ID, Purview, and Azure security services.
Question 1: Which principle is central to Zero Trust security?
- A. Trust internal networks
- B. Implicit access
- C. Verify explicitly ✅
- D. Perimeter-based security
Explanation: Zero Trust requires continuous verification of every access request.
Question 2: Which Microsoft service is used for SIEM and SOAR?
- A. Microsoft Defender for Cloud
- B. Microsoft Sentinel ✅
- C. Azure Firewall
- D. Microsoft Purview
Explanation: Microsoft Sentinel provides SIEM and SOAR capabilities.
Question 3: Which identity solution supports Conditional Access?
- A. Active Directory Domain Services
- B. Azure VPN
- C. Microsoft Entra ID ✅
- D. Azure Key Vault
Explanation: Entra ID enables Conditional Access and identity protection.
Question 4: You have a Microsoft 365 E5 subscription and an Azure subscription. You are designing a Microsoft deployment. You need to recommend a solution for the security operations team. The solution must include custom views and a dashboard for analyzing security events. What should you recommend using in Microsoft Sentinel?
- A. notebooks
- B. playbooks
- C. workbooks ✅
- D. threat intelligence
Explanation: After you connected your data sources to Microsoft Sentinel, you get instant visualization and analysis of data so that you can know what's happening across all your connected data sources. Microsoft Sentinel gives you workbooks that provide you with the full power of tools already available in Azure as well as tables and charts that are built in to provide you with analytics for your logs and queries. You can either use built-in workbooks or create a new workbook easily, from scratch or based on an existing workbook.
Question 5: Your company has a Microsoft 365 subscription and uses Microsoft Defender for Identity. You are informed about incidents that relate to compromised identities. You need to recommend a solution to expose several accounts for attackers to exploit. When the attackers attempt to exploit the accounts, an alert must be triggered. Which Defender for Identity feature should you include in the recommendation?
- A. sensitivity labels
- B. custom user tags
- C. standalone sensors
- D. honeytoken entity tags ✅
Explanation: Honeytoken entities are used as traps for malicious actors. Any authentication associated with these honeytoken entities triggers an alert. Incorrect: Not B: custom user tags - After you apply system tags or custom tags to users, you can use those tags as filters in alerts, reports, and investigation.
Download/Practice full SC-100 exam questions..