SC-100 Security Operations 5 — Questions and Answers
Question 1: A security architect must design a solution to detect when Azure resource configurations drift from a secure baseline and automatically remediate. Which combination of services achieves this?
- Microsoft Defender for Cloud recommendations combined with Azure Policy DeployIfNotExists effects for automated remediation (Correct answer)
- Azure Monitor alerts on configuration changes and manual remediation tickets in ServiceNow
- Microsoft Sentinel analytics rules querying Azure Activity logs with playbook-triggered remediation
- Azure Blueprints with locked policy assignments and manual drift reviews monthly
Correct answer: Microsoft Defender for Cloud recommendations combined with Azure Policy DeployIfNotExists effects for automated remediation
Defender for Cloud identifies configuration drift from secure baselines, while Azure Policy with DeployIfNotExists automatically remediates non-compliant resources.
Question 2: An organization experiences a DDoS attack targeting its Azure-hosted web applications. Which Microsoft service provides real-time attack telemetry and mitigation metrics that a SOC can monitor during the event?
- Azure DDoS Protection diagnostic logs and metrics in Azure Monitor with DDoS attack analytics (Correct answer)
- Microsoft Defender for Cloud network security recommendations dashboard
- Azure Front Door WAF rule match logs in Log Analytics
- Microsoft Sentinel network anomaly detection analytics rules
Correct answer: Azure DDoS Protection diagnostic logs and metrics in Azure Monitor with DDoS attack analytics
Azure DDoS Protection Standard provides real-time attack telemetry, mitigation metrics, and post-attack analytics through Azure Monitor diagnostic logs.
Question 3: A SOC analyst needs to perform a live response on a compromised endpoint to collect forensic artifacts without physically accessing the device. Which Microsoft Defender for Endpoint capability enables this?
- Live Response to run commands, collect files, and run scripts remotely on the isolated device (Correct answer)
- Automated investigation and remediation (AIR) to collect artifacts automatically
- Advanced hunting queries against DeviceFileEvents to identify modified files remotely
- Microsoft Intune remote wipe to collect a compliance snapshot before device reset
Correct answer: Live Response to run commands, collect files, and run scripts remotely on the isolated device
Defender for Endpoint's Live Response provides a remote shell-like capability to collect forensic artifacts, run scripts, and investigate compromised endpoints without physical access.
Question 4: Which Microsoft Sentinel feature should a security architect use to create a list of known vulnerable assets that analysts should prioritize during threat hunting sessions?
- Watchlists containing vulnerable asset identifiers that can be joined with hunting queries using the _GetWatchlist() function (Correct answer)
- Custom analytics rules that alert on any activity involving assets from the vulnerability scanner
- A dedicated Log Analytics workspace for vulnerability data ingested from Defender for Cloud
- Microsoft Secure Score remediation tasks filtered by asset type and criticality
Correct answer: Watchlists containing vulnerable asset identifiers that can be joined with hunting queries using the _GetWatchlist() function
Sentinel Watchlists store reference data like vulnerable asset lists that can be dynamically joined with hunting queries using the _GetWatchlist() KQL function.
Question 5: A security architect is evaluating the security operations model for a multi-tenant environment where a Managed Security Service Provider (MSSP) manages Sentinel. Which feature enables the MSSP to manage multiple customer workspaces from a single portal?
- Azure Lighthouse to project customer Sentinel workspaces into the MSSP's managing tenant with appropriate RBAC (Correct answer)
- Microsoft 365 Lighthouse for managing multiple M365 tenants from a single admin interface
- Azure B2B guest access for MSSP analysts to access each customer tenant individually
- Microsoft Defender XDR multi-tenant management console for cross-tenant incident viewing
Correct answer: Azure Lighthouse to project customer Sentinel workspaces into the MSSP's managing tenant with appropriate RBAC
Azure Lighthouse allows MSSPs to project multiple customer resources, including Sentinel workspaces, into their managing tenant for centralized management with granular RBAC.
Question 6: During post-incident review, a security team determines that an attacker maintained persistence using a scheduled task. Which Microsoft Defender for Endpoint table should be queried in Advanced Hunting to find all scheduled tasks created on endpoints?
- DeviceProcessEvents filtered for schtasks.exe or TaskScheduler events with creation parameters (Correct answer)
- DeviceRegistryEvents for Run key modifications associated with persistence
- DeviceNetworkEvents for command-and-control connections from scheduled task processes
- DeviceLogonEvents for service account logons associated with scheduled task execution
Correct answer: DeviceProcessEvents filtered for schtasks.exe or TaskScheduler events with creation parameters
Querying DeviceProcessEvents for schtasks.exe with creation parameters identifies scheduled tasks created by attackers as a persistence mechanism.
Question 7: A cybersecurity architect needs to ensure that Sentinel's ingestion costs are controlled without losing visibility. Which two strategies should be recommended?
- Use data collection rules (DCRs) to filter and transform logs before ingestion, combined with basic logs tier for verbose high-volume tables (Correct answer)
- Reduce the number of connected data sources to only Microsoft-native products and disable third-party connectors
- Set a daily ingestion cap on the Log Analytics workspace to prevent cost overruns and discard excess data
- Move all log sources to a third-party SIEM for pre-filtering and forward only critical alerts to Sentinel
Correct answer: Use data collection rules (DCRs) to filter and transform logs before ingestion, combined with basic logs tier for verbose high-volume tables
DCRs filter noise before data reaches Sentinel while the basic logs tier stores high-volume verbose logs at reduced cost, together controlling ingestion spend without losing data.
SC-100 Security Operations 5
A security architect must design a solution to detect when Azure resource configurations drift from a secure baseline and automatically remediate.
Which combination of services achieves this?