SC-100 · Domain 2: Design security operations, identity, and compliance capabilities · 28% of the exam
Task 2.1: Design solutions for security operations
XDR and SIEM with Defender XDR and Microsoft Sentinel, centralized logging and Purview Audit, hybrid and multicloud monitoring, automation and response, hunting and incident workflows, and detection coverage mapped to MITRE ATT&CK.
Study it
XDR and SIEM: Defender XDR, Microsoft Sentinel and the unified portal
Lesson coming
Centralized logging and auditing, hybrid and multicloud monitoring
Automation, incident response, hunting and MITRE ATT&CK coverage
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
A retailer is designing its security operations platform for the next five years. It already licenses Microsoft Defender XDR and wants Microsoft Sentinel for firewall, SaaS and custom application logs, with analysts working incidents from both in one place. The draft design has analysts using Sentinel in the Azure portal and Defender XDR in a separate portal. What should you change?
AOnboard the Sentinel workspace to the Microsoft Defender portal and run both from there
BKeep Sentinel in the Azure portal and bring Defender XDR incidents into it with the Defender XDR connector
CDrop Sentinel and rely on Defender XDR alone for the firewall and custom logs
DStore all logs in a Log Analytics workspace without Sentinel and build alerts in Azure Monitor
Show the answer and why
AOnboard the Sentinel workspace to the Microsoft Defender portal and run both from there
Correct
After March 31, 2027 Sentinel is supported only in the Defender portal, which unifies Sentinel and Defender XDR incidents, hunting and automation.
BKeep Sentinel in the Azure portal and bring Defender XDR incidents into it with the Defender XDR connector
Incorrect
Sentinel in the Azure portal won't be supported after March 31, 2027, so a five-year design can't rest on it, and analysts would still switch portals.
CDrop Sentinel and rely on Defender XDR alone for the firewall and custom logs
Incorrect
Defender XDR covers Microsoft's protection products; the third-party and custom sources need a SIEM.
DStore all logs in a Log Analytics workspace without Sentinel and build alerts in Azure Monitor
Incorrect
Azure Monitor alerts don't provide SIEM detections, incidents and SOAR, and don't unify with Defender XDR.
Microsoft Sentinel is available in the Microsoft Defender portal together with Defender XDR, giving one place for incidents, hunting and automation. After March 31, 2027, Sentinel will no longer be supported in the Azure portal, and customers there will be redirected to the Defender portal.
A media company runs workloads in Azure, AWS and Google Cloud. The SOC needs AWS CloudTrail events and GuardDuty findings, and Google Cloud audit logs, in Microsoft Sentinel, using the connectors Microsoft currently recommends. Which two connectors should the design include? (Choose TWO.)
AAzure Arc and the Azure Monitor Agent on the EC2 instances, collecting CloudTrail and GuardDuty data
BThe Amazon Web Services S3 connector, which pulls logs from an S3 bucket
CAzure Lighthouse delegations for the AWS and Google Cloud accounts
DThe legacy CloudTrail connector for every AWS service the company uses
EThe Google Cloud Platform Pub/Sub connectors
Show the answer and why
AAzure Arc and the Azure Monitor Agent on the EC2 instances, collecting CloudTrail and GuardDuty data
Incorrect
CloudTrail events and GuardDuty findings are AWS service logs, not machine logs; the AWS connector pulls them from an S3 bucket.
BThe Amazon Web Services S3 connector, which pulls logs from an S3 bucket
Correct
The S3 connector ingests CloudTrail, GuardDuty and other AWS logs from an S3 bucket; the CloudTrail-only connector is the legacy version.
CAzure Lighthouse delegations for the AWS and Google Cloud accounts
Incorrect
Lighthouse delegates Azure resources across Microsoft Entra tenants, not AWS or Google Cloud accounts.
DThe legacy CloudTrail connector for every AWS service the company uses
Incorrect
The legacy connector covers CloudTrail management and data logs only, not GuardDuty findings.
EThe Google Cloud Platform Pub/Sub connectors
Correct
The GCP Pub/Sub connectors, built on the Codeless Connector Framework, ingest GCP audit logs through Pub/Sub.
The Amazon Web Services connector comes in a legacy version for CloudTrail management and data logs and a newer version that ingests logs from several AWS services, such as CloudTrail, GuardDuty and VPC flow logs, by pulling them from an S3 bucket. For Google Cloud, the GCP Pub/Sub connectors based on the Codeless Connector Framework ingest logs such as audit logs.
A financial regulator requires a bank to keep audit records of its traders' activity in Exchange, SharePoint and Teams for ten years and to search them in Microsoft Purview. The bank currently has Audit (Standard). What does the design need?
AAudit (Standard), whose records are kept for 180 days, exported to a storage account once a year for long-term keeping
BAudit (Premium) with a retention policy and the 10-Year Audit Log Retention add-on
CAudit (Premium) alone, which keeps every record for ten years by default
DA Sentinel workspace with two years of analytics retention
Show the answer and why
AAudit (Standard), whose records are kept for 180 days, exported to a storage account once a year for long-term keeping
Incorrect
Standard retention is 180 days, and yearly exports wouldn't keep records searchable in Purview.
BAudit (Premium) with a retention policy and the 10-Year Audit Log Retention add-on
Correct
Ten-year retention needs Audit (Premium) licensing plus the add-on license for each user whose records must be kept.
CAudit (Premium) alone, which keeps every record for ten years by default
Incorrect
Premium retains records for up to one year by default; ten years needs the add-on.
DA Sentinel workspace with two years of analytics retention
Incorrect
Two years doesn't meet the ten-year requirement, and the bank wants to search in Purview.
Audit (Standard) retains records for 180 days. Audit (Premium) retains records for up to one year by default and supports audit log retention policies; a user also needs the 10-Year Audit Log Retention add-on license for their records to be kept for ten years.
A manufacturer runs two SAP ECC systems, one on Azure virtual machines and one in its own datacenter. The SOC already works in Microsoft Sentinel in the Defender portal. Security wants detections for privilege escalation, unapproved changes and misuse of sensitive transactions inside the SAP application layer, correlated with identity and endpoint signals in the same incidents. What should the security operations design add?
AAzure Monitor for SAP solutions, with Log Analytics alerts on the SAP NetWeaver and HANA providers
BDefender for Servers Plan 2 on the SAP virtual machines and on the Arc-enabled on-premises hosts
CThe Microsoft Sentinel solution for SAP applications, deployed for both ECC systems
DThe Microsoft Sentinel solution for SAP BTP, with its audit log connector
Show the answer and why
AAzure Monitor for SAP solutions, with Log Analytics alerts on the SAP NetWeaver and HANA providers
Incorrect
It monitors the availability, performance and operation of SAP landscapes that run on Azure; it isn't a threat detection solution, and it doesn't cover the system in the company's datacenter.
BDefender for Servers Plan 2 on the SAP virtual machines and on the Arc-enabled on-premises hosts
Incorrect
Defender for Servers protects the machines and their operating systems; it doesn't see SAP business activity such as transactions and authorization changes.
CThe Microsoft Sentinel solution for SAP applications, deployed for both ECC systems
Correct
It monitors the SAP application layers, correlates SAP activity with other signals in Sentinel and detects risks such as privilege escalation, unapproved changes and misuse of sensitive transactions; it's available for SAP ECC in any cloud or on premises.
DThe Microsoft Sentinel solution for SAP BTP, with its audit log connector
Incorrect
The BTP solution monitors SAP Business Technology Platform tenants and BTP-based apps through their audit logs; it's a separate solution that doesn't monitor the ECC application layer.
Microsoft Sentinel has two Microsoft-owned foundation solutions for SAP. The solution for SAP applications monitors the application layers (business logic, applications, databases and operating systems), correlates SAP activity with signals from the rest of the organization, and provides detections for risks such as privilege escalation, unapproved changes, unauthorized access and misuse of sensitive transactions; it's certified for SAP ECC and other NetWeaver-based products running in any cloud or on premises. The solution for SAP BTP is a separate solution for Business Technology Platform tenants. Azure Monitor for SAP solutions watches availability and performance of SAP on Azure, not threats.
For every new high-severity incident, the SOC wants a ticket opened in ServiceNow and a message posted to a Teams channel automatically, and it wants the logic managed centrally rather than inside each analytics rule. How should the design implement this in Microsoft Sentinel?
AAn automation rule on incident creation that runs a playbook calling ServiceNow and Teams
BA workbook that the on-call analyst refreshes every hour to spot new high-severity incidents and then opens tickets by hand
CA hunting query saved with a ServiceNow tag
DA summary rule that writes incident counts to a custom table
Show the answer and why
AAn automation rule on incident creation that runs a playbook calling ServiceNow and Teams
Correct
Automation rules centrally handle incidents and can run playbooks, which are Logic Apps workflows that act in other systems.
BA workbook that the on-call analyst refreshes every hour to spot new high-severity incidents and then opens tickets by hand
Incorrect
A workbook is a visualization; it doesn't act on incidents.
CA hunting query saved with a ServiceNow tag
Incorrect
Hunting queries are run by analysts; they don't open tickets automatically.
DA summary rule that writes incident counts to a custom table
Incorrect
Summary rules aggregate data; they don't call external systems.
Microsoft Sentinel's SOAR capabilities use automation rules, which centrally manage incident handling and can run playbooks, and playbooks, which are Azure Logic Apps workflows that run actions such as creating tickets or posting messages in external systems.
A Log Analytics workspace used by Microsoft Sentinel is in West Europe and collects monitoring data from resources in East US. According to Microsoft's workspace design guidance, which data typically adds bandwidth (egress) charges?
AResource logs that Azure services send through diagnostic settings
BNone, because sending data to a workspace in another region is free
CData that the virtual machines send to the workspace
DOnly data sent from servers outside Azure
Show the answer and why
AResource logs that Azure services send through diagnostic settings
Incorrect
Monitoring data sent through diagnostic settings doesn't incur egress charges.
BNone, because sending data to a workspace in another region is free
Incorrect
Bandwidth charges can apply when a resource in another region sends data to the workspace.
CData that the virtual machines send to the workspace
Correct
These charges typically result from sending data to the workspace from a virtual machine.
DOnly data sent from servers outside Azure
Incorrect
The charges described come from resources in another region, typically Azure virtual machines.
Microsoft's guidance on designing a Log Analytics workspace architecture notes that bandwidth charges might apply when you send data to a workspace from a resource in another region. They typically result from virtual machines sending data; monitoring data from other Azure resources sent through diagnostic settings doesn't incur egress charges.
What is MITRE ATT&CK, which Microsoft Sentinel uses to show detection coverage?
AA public knowledge base of attacker tactics and techniques
BA Microsoft licensing plan that bundles security operations features for SOC teams
CAn encryption standard for log data
DA list of approved cloud regions
Show the answer and why
AA public knowledge base of attacker tactics and techniques
Correct
ATT&CK catalogs tactics and techniques observed in real attacks.
BA Microsoft licensing plan that bundles security operations features for SOC teams
Incorrect
It isn't a Microsoft product or license.
CAn encryption standard for log data
Incorrect
It isn't an encryption standard.
DA list of approved cloud regions
Incorrect
It has nothing to do with regions.
MITRE ATT&CK is a publicly accessible knowledge base of tactics and techniques commonly used by attackers, created and maintained from real-world observations. Microsoft Sentinel maps analytics rules to it to show coverage.
In Microsoft's incident response planning guidance, which role removes the burden of communicating with management from the technical incident leader?
APublic relations
BForward planner
CCommunications liaison
DScribe
Show the answer and why
APublic relations
Incorrect
Public relations drafts public communication for incidents likely to draw attention.
BForward planner
Incorrect
The forward planner looks ahead at likely outcomes and next steps.
CCommunications liaison
Correct
The communications liaison handles management communication so the technical leader stays focused.
DScribe
Incorrect
A scribe records actions and decisions.
The incident roles and responsibilities playbook names a communications liaison who removes the burden of communicating to management from the technical incident leader, alongside roles such as public relations.
A SOC starts monitoring a newly purchased firewall product in Microsoft Sentinel. It wants the product's data connector, parsers, analytics rules and workbooks installed together in one step. What should it deploy from the Content hub?
AAn analytics rule template for the firewall
BA watchlist of the firewall's IP addresses
CThe Microsoft Sentinel solution for the product
DA playbook built on Azure Logic Apps
Show the answer and why
AAn analytics rule template for the firewall
Incorrect
A rule template is a single piece of content; it doesn't bring the connector, parsers and workbooks with it.
BA watchlist of the firewall's IP addresses
Incorrect
A watchlist brings in specific data to improve detections; it doesn't install connectors, parsers or rules.
CThe Microsoft Sentinel solution for the product
Correct
Solutions are packages of Sentinel content for an end-to-end product, domain or industry scenario, installed in a single step.
DA playbook built on Azure Logic Apps
Incorrect
Playbooks automate response; they don't package the other content.
The Microsoft Sentinel Content hub delivers content such as data connectors, parsers, analytics rules, hunting queries, workbooks, watchlists and playbooks as solutions and standalone items. Solutions are packages of Sentinel content or API integrations that support an end-to-end product, domain or industry vertical scenario, and you install them in a single step.