SC-100 Security Operations 3

Question 1

A security team needs to investigate a suspected supply chain compromise. Which Microsoft Defender XDR capability provides a unified timeline of the attack across all affected endpoints, identities, and applications?

Accepted Answer

The Microsoft Defender XDR incident graph and attack story view

Answer

The Defender XDR incident graph correlates signals across endpoints, identities, email, and cloud apps into a single attack story timeline.

Question 2

Which action should a cybersecurity architect recommend to contain an active ransomware attack that has compromised multiple endpoints managed by Microsoft Defender for Endpoint?

Accepted Answer

Use the Isolate device action in Defender for Endpoint to cut network access while maintaining management channel

Answer

Device isolation in Defender for Endpoint blocks all network traffic except the management channel, containing the ransomware spread while preserving the ability to investigate and remediate.

Question 3

An organization uses Microsoft Sentinel and wants to share threat intelligence indicators (IOCs) with a partner organization. Which protocol and Microsoft feature should be used?

Accepted Answer

TAXII server in Sentinel's Threat Intelligence blade to expose indicators via STIX/TAXII 2.x

Answer

Sentinel's Threat Intelligence platform supports STIX/TAXII 2.x, allowing organizations to share and consume threat intelligence using industry-standard protocols.

Question 4

A SOC manager needs to measure the effectiveness of the incident response process. Which Microsoft Sentinel feature provides built-in metrics on incident handling time and analyst performance?

Accepted Answer

The Security Operations Efficiency workbook in Microsoft Sentinel

Answer

Sentinel includes the Security Operations Efficiency workbook that tracks MTTR, MTTD, incident volume, and analyst performance metrics.

Question 5

During threat hunting, an analyst suspects a living-off-the-land (LotL) attack using PowerShell. Which KQL query approach in Microsoft Sentinel would best surface suspicious PowerShell activity?

Accepted Answer

Query DeviceProcessEvents for PowerShell executions with encoded commands, unusual parent processes, or network connections

Answer

Querying DeviceProcessEvents for encoded commands, suspicious parent processes, and network connections covers multiple LotL indicators beyond simple process name matching.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Security Operations 3