SC-100 Security Operations 4 — Questions and Answers
Question 1: A security operations center must triage incidents across Microsoft 365 Defender and Microsoft Sentinel simultaneously. What is the recommended integration approach to avoid duplicate incident management?
- Enable the Microsoft Defender XDR connector in Sentinel with incident sync to manage incidents in a single pane (Correct answer)
- Create separate response procedures for each portal and reconcile weekly
- Use Microsoft Sentinel as the primary SIEM and manually close Defender XDR alerts after handling
- Configure Logic Apps to merge incidents from both portals into a ServiceNow ticket
Correct answer: Enable the Microsoft Defender XDR connector in Sentinel with incident sync to manage incidents in a single pane
The Defender XDR connector with bi-directional incident sync allows analysts to manage incidents from either portal without duplication, maintaining a single source of truth.
Question 2: Which Microsoft Defender for Cloud feature should a security architect enable to receive prioritized security alerts based on the potential blast radius and exploitability of vulnerabilities?
- Defender for Cloud's attack path analysis to identify risks with internet exposure and lateral movement potential (Correct answer)
- Continuous export of Defender for Cloud alerts to Microsoft Sentinel
- Regulatory compliance assessments against CIS Benchmark controls
- Just-in-time VM access to reduce the attack surface of management ports
Correct answer: Defender for Cloud's attack path analysis to identify risks with internet exposure and lateral movement potential
Attack path analysis in Defender for Cloud identifies and prioritizes exploitable paths to high-value resources, considering real exploitability and blast radius.
Question 3: A security team needs to investigate whether sensitive data was exfiltrated during a breach. Which Microsoft Purview capability integrates with Defender XDR to add data sensitivity context to incidents?
- Microsoft Purview Information Protection sensitivity labels surfaced in Defender for Cloud Apps alerts (Correct answer)
- Microsoft Purview Compliance Manager risk assessments
- Microsoft Purview Audit (Premium) log search for file access events
- Microsoft Purview Data Map catalog for classifying on-premises data assets
Correct answer: Microsoft Purview Information Protection sensitivity labels surfaced in Defender for Cloud Apps alerts
Purview Information Protection labels are surfaced in Defender for Cloud Apps alerts, providing data sensitivity context that helps prioritize exfiltration incidents.
Question 4: An organization's SOC needs to respond to an insider threat where a user is suspected of stealing intellectual property. Which combination of tools provides the most comprehensive investigation capability?
- Microsoft Purview Insider Risk Management for behavioral signals combined with Defender for Cloud Apps activity logs and Sentinel UEBA (Correct answer)
- Azure AD Identity Protection risk user report and Defender for Endpoint timeline only
- Microsoft Compliance Manager and SharePoint audit logs reviewed manually
- Azure Monitor diagnostic logs and Microsoft Secure Score recommendations
Correct answer: Microsoft Purview Insider Risk Management for behavioral signals combined with Defender for Cloud Apps activity logs and Sentinel UEBA
Combining Purview Insider Risk Management, Defender for Cloud Apps, and Sentinel UEBA provides behavioral, cloud activity, and entity analytics coverage for comprehensive insider threat investigation.
Question 5: A security architect is designing the alert triage workflow for a 24/7 SOC. Which Microsoft Sentinel capability allows analysts to add context to incidents without resolving them, enabling shift handover?
- Incident comments and tasks added by analysts to the active incident in Sentinel (Correct answer)
- Azure DevOps work items linked to Sentinel incidents via Logic Apps
- Microsoft Teams channel notifications with investigation notes pinned
- Custom workbooks with analyst annotations saved per incident ID
Correct answer: Incident comments and tasks added by analysts to the active incident in Sentinel
Sentinel's incident comments and tasks feature allows analysts to document investigation progress, add context, and create handover notes directly within the incident.
Question 6: Which approach should a security architect use to ensure Microsoft Sentinel analytics rules remain aligned with the MITRE ATT&CK framework across the organization?
- Map each analytics rule to MITRE ATT&CK tactics and techniques using Sentinel's built-in MITRE ATT&CK coverage view (Correct answer)
- Manually maintain a spreadsheet mapping Sentinel rules to ATT&CK techniques reviewed quarterly
- Subscribe to the Microsoft Sentinel GitHub repository to get community-contributed ATT&CK-mapped rules
- Use Microsoft Defender Threat Intelligence to import ATT&CK-tagged IOCs into Sentinel watchlists
Correct answer: Map each analytics rule to MITRE ATT&CK tactics and techniques using Sentinel's built-in MITRE ATT&CK coverage view
Sentinel's built-in MITRE ATT&CK coverage view displays which tactics and techniques are covered by active rules and highlights gaps in detection coverage.
Question 7: A security operations team wants to automatically enrich Sentinel incidents with VirusTotal reputation data for IP addresses and file hashes. What is the correct implementation approach?
- Create a Sentinel Playbook (Logic App) that calls the VirusTotal API when an incident is created and adds findings as comments (Correct answer)
- Configure a Sentinel analytics rule to query VirusTotal using the externaldata() KQL operator
- Use the Microsoft Threat Intelligence TAXII connector to pull VirusTotal indicators into Sentinel
- Enable the VirusTotal UEBA enrichment feature in the Sentinel Entity Behavior settings
Correct answer: Create a Sentinel Playbook (Logic App) that calls the VirusTotal API when an incident is created and adds findings as comments
Sentinel Playbooks (Logic Apps) can call external APIs like VirusTotal during incident creation and write enrichment data back as incident comments or custom fields.
SC-100 Security Operations 4
A security operations center must triage incidents across Microsoft 365 Defender and Microsoft Sentinel simultaneously.
What is the recommended integration approach to avoid duplicate incident management?