SC-100 Security Operations 4

Question 1

A security operations center must triage incidents across Microsoft 365 Defender and Microsoft Sentinel simultaneously. What is the recommended integration approach to avoid duplicate incident management?

Accepted Answer

Enable the Microsoft Defender XDR connector in Sentinel with incident sync to manage incidents in a single pane

Answer

The Defender XDR connector with bi-directional incident sync allows analysts to manage incidents from either portal without duplication, maintaining a single source of truth.

Question 2

Which Microsoft Defender for Cloud feature should a security architect enable to receive prioritized security alerts based on the potential blast radius and exploitability of vulnerabilities?

Accepted Answer

Defender for Cloud's attack path analysis to identify risks with internet exposure and lateral movement potential

Answer

Attack path analysis in Defender for Cloud identifies and prioritizes exploitable paths to high-value resources, considering real exploitability and blast radius.

Question 3

A security team needs to investigate whether sensitive data was exfiltrated during a breach. Which Microsoft Purview capability integrates with Defender XDR to add data sensitivity context to incidents?

Accepted Answer

Microsoft Purview Information Protection sensitivity labels surfaced in Defender for Cloud Apps alerts

Answer

Purview Information Protection labels are surfaced in Defender for Cloud Apps alerts, providing data sensitivity context that helps prioritize exfiltration incidents.

Question 4

An organization's SOC needs to respond to an insider threat where a user is suspected of stealing intellectual property. Which combination of tools provides the most comprehensive investigation capability?

Accepted Answer

Microsoft Purview Insider Risk Management for behavioral signals combined with Defender for Cloud Apps activity logs and Sentinel UEBA

Answer

Combining Purview Insider Risk Management, Defender for Cloud Apps, and Sentinel UEBA provides behavioral, cloud activity, and entity analytics coverage for comprehensive insider threat investigation.

Question 5

A security architect is designing the alert triage workflow for a 24/7 SOC. Which Microsoft Sentinel capability allows analysts to add context to incidents without resolving them, enabling shift handover?

Accepted Answer

Incident comments and tasks added by analysts to the active incident in Sentinel

Answer

Sentinel's incident comments and tasks feature allows analysts to document investigation progress, add context, and create handover notes directly within the incident.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Security Operations 4