Microsoft Cybersecurity Architect SC-100 practice test

Refer to the exhibit. You are reviewing a Conditional Access policy in Azure AD. The policy requires MFA and a compliant device for all users and all cloud apps. Some users report that they are able to access apps without being prompted for MFA even though their devices are compliant. What is the most likely reason?

Exhibit

{
  "policy": {
    "tenantId": "contoso.onmicrosoft.com",
    "displayName": "Require MFA for all users",
    "state": "enabled",
    "conditions": {
      "applications": {
        "includeApplications": ["All"]
      },
      "users": {
        "includeUsers": ["All"]
      }
    },
    "grantControls": {
      "builtInControls": ["mfa", "compliantDevice"]
    }
  }
}

Trap 1: The policy does not include all cloud apps

The policy includes 'All' applications.

Trap 2: The policy excludes specific locations

No location exclusion is shown in the policy.

Trap 3: The policy does not include session controls to enforce MFA…

Session controls are not required for MFA; the grant control itself triggers MFA.

A
The policy does not include all cloud apps
Why wrong: The policy includes 'All' applications.
B
The policy is set to 'Report-only' mode
In report-only mode, policies are not enforced, so users are not prompted for MFA.
C
The policy excludes specific locations
Why wrong: No location exclusion is shown in the policy.
D
The policy does not include session controls to enforce MFA re-prompt
Why wrong: Session controls are not required for MFA; the grant control itself triggers MFA.

Question 2mediummultiple choice

A company, Fabrikam, has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. They have implemented a Zero Trust strategy that includes requiring multi-factor authentication (MFA) for all users accessing cloud applications. They use Conditional Access policies to enforce MFA. Recently, they noticed that users who authenticate from the on-premises network are not being prompted for MFA when accessing cloud apps, even though the Conditional Access policy is configured to require MFA for all users. The network location is not excluded in the policy. The Conditional Access policy is enabled and in 'Enforce' mode. The users' devices are not domain-joined. What is the most likely reason for this behavior?

Trap 1: Azure AD Connect is not configured for Pass-through Authentication

Pass-through Authentication is not required for MFA; password hash sync works and MFA is still enforced.

Trap 2: The Conditional Access policy does not include session controls

Session controls are not required for MFA; grant controls are sufficient.

Trap 3: The Conditional Access policy is not targeting the correct user…

The policy targets all users, so this is not the issue.

A
Azure AD Connect is not configured for Pass-through Authentication
Why wrong: Pass-through Authentication is not required for MFA; password hash sync works and MFA is still enforced.
B
The Conditional Access policy does not include session controls
Why wrong: Session controls are not required for MFA; grant controls are sufficient.
C
The Conditional Access policy is not targeting the correct user group
Why wrong: The policy targets all users, so this is not the issue.
D
Users are using legacy authentication protocols that do not support MFA
Legacy authentication protocols like POP, IMAP, SMTP do not support MFA and can bypass Conditional Access policies if not blocked.

Question 3mediummultiple choice

A company is deploying Microsoft Defender for Cloud to secure their hybrid cloud environment. They need to ensure that regulatory compliance with PCI DSS is continuously monitored and reported. Which solution should they use to automatically assess and report compliance posture?

Trap 1: Azure Policy

Azure Policy is used for policy enforcement, not for continuous compliance assessment and reporting.

Trap 2: Microsoft Purview Information Protection

Microsoft Purview Information Protection is for data classification and labeling, not for compliance reporting.

Trap 3: Microsoft Entra ID Governance

Microsoft Entra ID Governance manages identity lifecycle and access reviews, not cloud compliance.

A
Azure Policy
Why wrong: Azure Policy is used for policy enforcement, not for continuous compliance assessment and reporting.
B
Microsoft Purview Information Protection
Why wrong: Microsoft Purview Information Protection is for data classification and labeling, not for compliance reporting.
C
Regulatory compliance dashboard in Microsoft Defender for Cloud
The regulatory compliance dashboard in Defender for Cloud continuously monitors compliance with standards like PCI DSS and generates reports.
D
Microsoft Entra ID Governance
Why wrong: Microsoft Entra ID Governance manages identity lifecycle and access reviews, not cloud compliance.

Question 4easymultiple choice

A company is planning their Zero Trust data protection strategy. They want to classify and protect sensitive data stored in SharePoint Online. Which Microsoft tool should they use?

Trap 1: Microsoft Intune

Intune manages devices and mobile application management, not data classification.

Trap 2: Microsoft Defender for Cloud Apps

Defender for Cloud Apps provides cloud app security but does not perform data classification.

Trap 3: Azure Policy

Azure Policy enforces compliance rules on Azure resources, not data classification.

A
Microsoft Intune
Why wrong: Intune manages devices and mobile application management, not data classification.
B
Microsoft Defender for Cloud Apps
Why wrong: Defender for Cloud Apps provides cloud app security but does not perform data classification.
C
Microsoft Purview Information Protection
Purview Information Protection provides data classification and labeling.
D
Azure Policy
Why wrong: Azure Policy enforces compliance rules on Azure resources, not data classification.

Question 5hardmultiple choice

An organization is implementing a Zero Trust identity strategy. They have a mix of on-premises Active Directory and Azure AD. They want to enforce conditional access policies that require device compliance for accessing sensitive apps. However, some users report that their devices are not being evaluated for compliance even though they are enrolled in Microsoft Intune. What should the organization check first?

Trap 1: Ensure Intune compliance policies are assigned to the correct user…

Compliance policies are needed but the device must be registered first.

Trap 2: Confirm that devices are Azure AD Joined

Azure AD Registered devices can also be evaluated for compliance; Azure AD Join is not mandatory.

Trap 3: Check if users have enabled multi-factor authentication

MFA is a separate control and does not affect device compliance evaluation.

A
Ensure Intune compliance policies are assigned to the correct user groups
Why wrong: Compliance policies are needed but the device must be registered first.
B
Confirm that devices are Azure AD Joined
Why wrong: Azure AD Registered devices can also be evaluated for compliance; Azure AD Join is not mandatory.
C
Check if users have enabled multi-factor authentication
Why wrong: MFA is a separate control and does not affect device compliance evaluation.
D
Verify that devices are registered in Azure AD
Device registration in Azure AD is required for conditional access to evaluate device compliance.

Question 6mediummulti select

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Trap 1: Azure AD Application Proxy

Application Proxy is for publishing on-premises apps, not device compliance.

Trap 2: Azure AD B2B collaboration

B2B is for external user identities, not device management.

A
Microsoft Intune for device management and compliance policies
Intune manages device compliance and enforces policies.
B
Azure AD device registration
Device registration in Azure AD is needed for device identity.
C
Azure AD Conditional Access policies
Conditional Access can require compliant devices for access.
D
Azure AD Application Proxy
Why wrong: Application Proxy is for publishing on-premises apps, not device compliance.
E
Azure AD B2B collaboration
Why wrong: B2B is for external user identities, not device management.