SC-100 Zero Trust & Threat Protection Solutions 5 — Questions and Answers
Question 1: Which Microsoft capability allows security operations teams to automate threat response workflows triggered by Microsoft Sentinel alerts, such as disabling a compromised account?
- Microsoft Sentinel Fusion
- Microsoft Sentinel Playbooks (Azure Logic Apps) (Correct answer)
- Microsoft Sentinel Workbooks
- Microsoft Sentinel Hunting
Correct answer: Microsoft Sentinel Playbooks (Azure Logic Apps)
Microsoft Sentinel Playbooks are built on Azure Logic Apps and enable automated, codified responses to security alerts, such as blocking users or isolating devices.
Question 2: A Zero Trust architecture requires that all data in transit between Azure services and on-premises systems be encrypted. Which protocol is recommended for securing hybrid connectivity?
- HTTP with OAuth tokens
- IPsec/IKEv2 or TLS 1.2/1.3 (Correct answer)
- SFTP tunneling
- SMB 2.0
Correct answer: IPsec/IKEv2 or TLS 1.2/1.3
IPsec/IKEv2 (for VPN Gateway) and TLS 1.2/1.3 (for application traffic) are the recommended encryption protocols for securing hybrid network connections in Zero Trust designs.
Question 3: An organization needs to evaluate the blast radius of a potential identity compromise. Which Microsoft tool visualizes lateral movement paths showing how an attacker could escalate from a standard user to domain admin?
- Microsoft Sentinel Investigation Graph
- Microsoft Defender for Identity Lateral Movement Paths (Correct answer)
- Azure AD Identity Protection risky users report
- Microsoft Secure Score
Correct answer: Microsoft Defender for Identity Lateral Movement Paths
Microsoft Defender for Identity's Lateral Movement Paths feature graphically shows how an attacker could chain compromised accounts and credentials to reach sensitive targets.
Question 4: Which Microsoft Defender for Cloud plan provides threat detection specifically for containers and Kubernetes clusters running in Azure, AWS, and GCP?
- Defender for Servers
- Defender for Containers (Correct answer)
- Defender for App Service
- Defender for Storage
Correct answer: Defender for Containers
Microsoft Defender for Containers provides runtime threat detection, vulnerability assessments, and security hardening for containerized workloads across multicloud Kubernetes environments.
Question 5: In a Zero Trust design, which approach to network access replaces traditional VPN by granting access per application rather than per network segment?
- Split tunneling VPN
- Zero Trust Network Access (ZTNA) (Correct answer)
- Site-to-site IPsec VPN
- Network Access Control (NAC)
Correct answer: Zero Trust Network Access (ZTNA)
ZTNA grants access to specific applications based on identity and device posture rather than placing users on a trusted network segment as traditional VPNs do.
Question 6: An architect wants to detect when OAuth applications are granted excessive permissions in Microsoft 365 as part of a consent phishing attack. Which solution provides this detection?
- Microsoft Entra ID Protection
- Microsoft Defender for Cloud Apps with app governance (Correct answer)
- Microsoft Defender for Office 365 Safe Links
- Azure AD Conditional Access
Correct answer: Microsoft Defender for Cloud Apps with app governance
Microsoft Defender for Cloud Apps with app governance detects OAuth apps with overprivileged or suspicious permissions, flagging potential consent phishing attacks.
Question 7: Which SC-100 design principle states that security controls should be distributed across multiple layers so that failure of one control does not expose the entire system?
- Zero Trust
- Least privilege
- Defense in depth (Correct answer)
- Assume breach
Correct answer: Defense in depth
Defense in depth applies layered security controls so that if one layer is bypassed, additional controls continue to protect the system.
SC-100 Zero Trust & Threat Protection Solutions 5
Which Microsoft capability allows security operations teams to automate threat response workflows triggered by Microsoft Sentinel alerts, such as disabling a compromised account?