SC-100 Security Operations 5

Question 1

A security architect must design a solution to detect when Azure resource configurations drift from a secure baseline and automatically remediate. Which combination of services achieves this?

Accepted Answer

Microsoft Defender for Cloud recommendations combined with Azure Policy DeployIfNotExists effects for automated remediation

Answer

Defender for Cloud identifies configuration drift from secure baselines, while Azure Policy with DeployIfNotExists automatically remediates non-compliant resources.

Question 2

An organization experiences a DDoS attack targeting its Azure-hosted web applications. Which Microsoft service provides real-time attack telemetry and mitigation metrics that a SOC can monitor during the event?

Accepted Answer

Azure DDoS Protection diagnostic logs and metrics in Azure Monitor with DDoS attack analytics

Answer

Azure DDoS Protection Standard provides real-time attack telemetry, mitigation metrics, and post-attack analytics through Azure Monitor diagnostic logs.

Question 3

A SOC analyst needs to perform a live response on a compromised endpoint to collect forensic artifacts without physically accessing the device. Which Microsoft Defender for Endpoint capability enables this?

Accepted Answer

Live Response to run commands, collect files, and run scripts remotely on the isolated device

Answer

Defender for Endpoint's Live Response provides a remote shell-like capability to collect forensic artifacts, run scripts, and investigate compromised endpoints without physical access.

Question 4

Which Microsoft Sentinel feature should a security architect use to create a list of known vulnerable assets that analysts should prioritize during threat hunting sessions?

Accepted Answer

Watchlists containing vulnerable asset identifiers that can be joined with hunting queries using the _GetWatchlist() function

Answer

Sentinel Watchlists store reference data like vulnerable asset lists that can be dynamically joined with hunting queries using the _GetWatchlist() KQL function.

Question 5

A security architect is evaluating the security operations model for a multi-tenant environment where a Managed Security Service Provider (MSSP) manages Sentinel. Which feature enables the MSSP to manage multiple customer workspaces from a single portal?

Accepted Answer

Azure Lighthouse to project customer Sentinel workspaces into the MSSP's managing tenant with appropriate RBAC

Answer

Azure Lighthouse allows MSSPs to project multiple customer resources, including Sentinel workspaces, into their managing tenant for centralized management with granular RBAC.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Security Operations 5