SC-100 Security Operations 3 — Questions and Answers
Question 1: A security team needs to investigate a suspected supply chain compromise. Which Microsoft Defender XDR capability provides a unified timeline of the attack across all affected endpoints, identities, and applications?
- The Microsoft Defender XDR incident graph and attack story view (Correct answer)
- Microsoft Secure Score remediation recommendations
- Microsoft Defender for Cloud Apps activity log
- Azure AD Identity Protection risk event timeline
Correct answer: The Microsoft Defender XDR incident graph and attack story view
The Defender XDR incident graph correlates signals across endpoints, identities, email, and cloud apps into a single attack story timeline.
Question 2: Which action should a cybersecurity architect recommend to contain an active ransomware attack that has compromised multiple endpoints managed by Microsoft Defender for Endpoint?
- Use the Isolate device action in Defender for Endpoint to cut network access while maintaining management channel (Correct answer)
- Disable all affected user accounts in Azure Active Directory immediately
- Trigger a full antivirus scan on all endpoints via Intune compliance policies
- Revoke all active sessions using Microsoft Defender for Cloud Apps conditional access
Correct answer: Use the Isolate device action in Defender for Endpoint to cut network access while maintaining management channel
Device isolation in Defender for Endpoint blocks all network traffic except the management channel, containing the ransomware spread while preserving the ability to investigate and remediate.
Question 3: An organization uses Microsoft Sentinel and wants to share threat intelligence indicators (IOCs) with a partner organization. Which protocol and Microsoft feature should be used?
- TAXII server in Sentinel's Threat Intelligence blade to expose indicators via STIX/TAXII 2.x (Correct answer)
- Export Sentinel watchlists as CSV files and share via SharePoint
- Use Microsoft Graph Security API to push indicators to the partner's tenant
- Configure a Logic App to email IOCs daily from Sentinel incidents
Correct answer: TAXII server in Sentinel's Threat Intelligence blade to expose indicators via STIX/TAXII 2.x
Sentinel's Threat Intelligence platform supports STIX/TAXII 2.x, allowing organizations to share and consume threat intelligence using industry-standard protocols.
Question 4: A SOC manager needs to measure the effectiveness of the incident response process. Which Microsoft Sentinel feature provides built-in metrics on incident handling time and analyst performance?
- The Security Operations Efficiency workbook in Microsoft Sentinel (Correct answer)
- Microsoft Defender for Cloud regulatory compliance dashboard
- Azure Monitor metrics for Log Analytics query performance
- Microsoft Secure Score improvement actions tracking
Correct answer: The Security Operations Efficiency workbook in Microsoft Sentinel
Sentinel includes the Security Operations Efficiency workbook that tracks MTTR, MTTD, incident volume, and analyst performance metrics.
Question 5: During threat hunting, an analyst suspects a living-off-the-land (LotL) attack using PowerShell. Which KQL query approach in Microsoft Sentinel would best surface suspicious PowerShell activity?
- Query DeviceProcessEvents for PowerShell executions with encoded commands, unusual parent processes, or network connections (Correct answer)
- Search SecurityEvent table for EventID 4688 with powershell.exe in the CommandLine field only
- Alert on all PowerShell processes with CPU usage above 50% from Azure Monitor
- Use the Defender for Endpoint threat and vulnerability management report for script-based attacks
Correct answer: Query DeviceProcessEvents for PowerShell executions with encoded commands, unusual parent processes, or network connections
Querying DeviceProcessEvents for encoded commands, suspicious parent processes, and network connections covers multiple LotL indicators beyond simple process name matching.
Question 6: A security architect must ensure that critical Sentinel analytics rules are not accidentally modified or deleted. Which Azure capability should be used to enforce this governance requirement?
- Azure Resource Locks applied to the Microsoft Sentinel workspace resources
- Azure Policy with deny effect for Sentinel rule modification operations
- Azure RBAC restricting the Microsoft Sentinel Contributor role to specific users (Correct answer)
- Activity log alerts to notify when analytics rules are changed or deleted
Correct answer: Azure RBAC restricting the Microsoft Sentinel Contributor role to specific users
Restricting the Microsoft Sentinel Contributor role using Azure RBAC controls who can modify analytics rules, preventing accidental changes by unauthorized users.
Question 7: An attacker has performed a credential stuffing attack against Azure AD. Which Microsoft Sentinel analytics rule template is specifically designed to detect this pattern?
- Explicitly Compromised Accounts — Password Spray Attack rule template (Correct answer)
- Multiple Password Resets from a Single IP address rule
- Brute force attack against Azure Portal rule template
- Sign-ins from IPs that attempt sign-ins to disabled accounts rule
Correct answer: Explicitly Compromised Accounts — Password Spray Attack rule template
The Password Spray Attack rule template in Sentinel detects credential stuffing and password spray patterns by identifying many failed authentications from one source against multiple accounts.
SC-100 Security Operations 3
A security team needs to investigate a suspected supply chain compromise.
Which Microsoft Defender XDR capability provides a unified timeline of the attack across all affected endpoints, identities, and applications?