Microsoft · Free Practice Questions · Last reviewed May 2026
24real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
22% of exam · 6 sample questions below
Your organization wants to implement a zero-trust security model for on-premises and cloud resources. As part of this strategy, you need to ensure that all access requests are authenticated and authorized based on dynamic risk signals. Which Microsoft security solution should you use to enforce conditional access policies based on real-time risk?
Microsoft Entra ID Conditional Access
Microsoft Entra ID Conditional Access is the policy enforcement engine that operationalizes zero trust by evaluating real-time signals such as user identity, device health, location, and risk level at the moment of authentication. It dynamically allows or blocks access, or requires additional controls like MFA or session policies, integrated directly with identity authentication. This makes it the central decision point for enforcing conditional access policies, rather than a supporting or monitoring tool.
Microsoft Intune
Microsoft Sentinel
Microsoft Defender for Cloud
Refer to the exhibit. You are an Azure security engineer reviewing a custom Azure Policy definition. The policy is intended to audit virtual machines to ensure they have the Azure Security extension installed. However, the policy is not triggering on any resources. What is the most likely reason?
The policy condition requires a managed disk, but the VMs might have unmanaged disks.
The policy definition's 'if' clause matches only VMs that have a managed disk (e.g., by checking that the 'managedDisk' property is present). VMs that still use unmanaged disks do not satisfy this condition, so the 'auditIfNotExists' effect is never evaluated for them. Consequently, the policy silently ignores the very machines that likely need the missing-extension audit, making the compliance report incomplete rather than identifying all noncompliant VMs.
The 'existenceCondition' field path is incorrect; it should be 'Microsoft.Compute/virtualMachines/extensions/publisher'.
The policy is assigned to a management group, but the VMs are in a subscription under a different management group.
The policy effect should be 'Deny' instead of 'auditIfNotExists'.
You are designing a security solution for Azure resources. You need to ensure that any changes to network security groups (NSGs) are automatically logged and sent to a central Log Analytics workspace. Which Azure feature should you use?
Diagnostic settings on the Azure Activity Log
Diagnostic settings on the Azure Activity Log are the correct mechanism because the Activity Log itself records every control-plane operation—such as resource creation, deletion, and configuration changes—for your Azure resources. By configuring a diagnostic setting on this log, you can stream those management events directly into a Log Analytics workspace, enabling centralized querying, alerting, and long-term retention for security auditing. This is the built-in, supported way to capture and route resource-level change activity to your security monitoring pipeline.
Azure Policy
NSG flow logs
Azure Monitor alerts
Your organization uses Microsoft Intune to manage devices. You need to ensure that devices that are not compliant with your organization's security policies are blocked from accessing corporate resources. Which Intune feature should you configure?
App protection policies
Device configuration profiles
Compliance policies
Compliance policies in Intune define the specific conditions a device must meet to be considered compliant, such as required OS versions, password requirements, encryption status, and threats detected by Mobile Threat Defense. Each device periodically uploads its health and configuration to the Intune service, which computes a compliant/non-compliant state. This state can then be consumed by Azure AD Conditional Access to allow or block access to emails, apps, and data based on real-time compliance. When a policy is combined with a Conditional Access policy requiring device compliance, non-compliant devices are blocked from accessing protected resources—making this the correct answer.
Enrollment restrictions
Your security team needs to receive alerts when a user is assigned a privileged role in Microsoft Entra ID. Which service should you use to create an alert for privileged role assignments?
Microsoft Entra ID Privileged Identity Management (PIM)
PIM is the native Microsoft Entra ID identity governance engine that delivers built-in, out-of-the-box alerting for privileged role assignments and activations. It monitors for suspicious activities such as permanent privileged assignments, off-hours role activation, or activation attempts that bypass just-in-time access policies, and can trigger email notifications or integrate with SIEM tools. These alerts are natively scoped to Entra ID roles, requiring no additional log ingestion or custom rule authoring, making it the correct choice for this requirement.
Microsoft Defender for Identity
Microsoft Sentinel
Microsoft Defender for Cloud Apps
Your organization uses Microsoft Entra ID and plans to implement a Zero Trust security model. You need to ensure that all access requests to corporate applications are continuously evaluated based on user risk, device compliance, and location. Which Microsoft Entra ID feature should you configure?
Identity Governance
Privileged Identity Management (PIM)
Identity Protection
Conditional Access
Conditional Access enforces policies based on user, device, and location signals.
Want more Design solutions that align with security best practices and priorities practice?
Practice this domain28% of exam · 6 sample questions below
Your organization uses Microsoft Sentinel and wants to automatically respond to high-severity incidents. Which feature should you configure?
Configure an automation rule to run a playbook automatically
Automation rules in Microsoft Sentinel are event-driven orchestration mechanisms that evaluate newly created or updated incidents against configured conditions—such as severity or name—and then execute one or more linked playbooks automatically. Playbooks are Azure Logic Apps that can perform remediation steps like isolation, data collection, or notification, ensuring consistent, immediate response without human involvement. This is the only approach listed that satisfies 'automatically' while honoring incident context, since automation rules trigger exactly when incidents are created or changed.
Create a playbook and run it manually for each incident
Set up an analytics rule with automatic response
Use a workbook to trigger a playbook
A company plans to implement Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from sharing credit card numbers via email. What should they configure?
Create a sensitivity label and apply it to emails
Enable communication compliance policies
Create a DLP policy that detects and blocks credit card numbers in Exchange Online
DLP policies in Microsoft Purview can detect sensitive info types like credit card numbers and block sharing via email.
Configure a retention policy for email
Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) resources are assessed against the same security baseline. What should you do?
Configure AWS Config and GCP Security Command Center to export findings to Microsoft Sentinel
Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark
Connecting AWS and GCP accounts to Defender for Cloud surfaces those resources in Azure Resource Graph, where Azure Policy can apply the Microsoft Cloud Security Benchmark (MCSB), a unified initiative built on CIS/NIST plus Microsoft controls. This gives continuous compliance assessment and enforcement, like DeployIfNotExists remediation, across all clouds. As a result, every subscription or cloud account is measured against the same baseline, regardless of native cloud tooling—this is the only option that both centralizes and enforces a single baseline.
Use regulatory compliance standards for each cloud separately
Enable the Cloud Security Posture Management (CSPM) plan and configure AWS and GCP connectors
Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?
Create a Conditional Access policy that requires compliant device
Conditional Access policies are the access-control layer that evaluates the device's compliance state at sign-in. When combined with an Intune compliance policy, the 'Require device to be marked as compliant' grant control forces Azure AD to check the device's compliance status and block access if the device is non-compliant. This is the correct approach because it directly enforces the access requirement for corporate resources, unlike enrollment or configuration policies that only manage settings or enrollment.
Set up enrollment restrictions in Intune
Create a device configuration policy that blocks non-compliant devices
Configure an app protection policy for email apps
Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Users have smartphones. Which method should you recommend as the primary authentication method?
FIDO2 security keys
Microsoft Authenticator app with passwordless sign-in
Microsoft Authenticator app with passwordless sign-in is the correct choice because it leverages the user's smartphone as a possession factor, using a cryptographic challenge-response protocol. When the user enters their username, the Authenticator app displays a number or a number match prompt; the user's approval signs the request with a private key stored in the device's secure enclave, eliminating the password entirely. This method is phishing-resistant, supports conditional access policies, and works seamlessly on iOS and Android, making it ideal for smartphone-centric users.
SMS-based authentication
Windows Hello for Business
Your organization uses Microsoft Entra ID and needs to ensure that external partners can access only specific applications for 30 days. What should you configure?
Entitlement management and create an access package with an expiration of 30 days
Access packages in entitlement management allow you to grant time-limited access to applications for external users.
B2B direct connect
Self-service group management
Conditional Access policy with session control
Want more Design security operations, identity, and compliance capabilities practice?
Practice this domain28% of exam · 6 sample questions below
Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)
Ensure that 'Auditing' is set to 'On' for SQL Database
This policy enables auditing for Azure SQL Database.
Ensure that 'TDE' is enabled for SQL Server VMs
Audit SQL Server level audit setting
Ensure that 'Firewall and virtual network settings' for SQL Database are configured
This policy enforces network security rules.
Ensure secure transfer to storage accounts is enabled
Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?
NAT rule
Application rule
Correct. Application rules allow or deny outbound traffic based on FQDNs for HTTP/HTTPS, meeting the requirement.
Threat intelligence rule
Network rule
Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?
Microsoft Purview
Microsoft Intune
Correct. Microsoft Intune manages device compliance policies and integrates with Entra ID Conditional Access to enforce access based on device compliance and user risk.
Microsoft Defender for Cloud Apps
Microsoft Sentinel
Which THREE components are required to implement a Zero Trust network architecture using Microsoft Entra Internet Access (formerly Microsoft 365 Network Connectivity)?
Conditional Access policies
Conditional Access policies enforce real-time access decisions based on user, device, location, and risk signals before granting connectivity through Microsoft Entra Internet Access. This satisfies the stem’s requirement for a Zero Trust component by implementing the “explicitly verify” principle—each session is evaluated against policy rather than relying on implicit network trust.
Azure AD Application Proxy
Site-to-site VPN
Microsoft Intune device compliance policies
Ensures devices meet security requirements before access.
Microsoft Entra Internet Access (Microsoft Global Secure Access)
Provides secure internet access with traffic forwarding.
Which TWO Microsoft Purview solutions should you use to protect sensitive data in Microsoft 365? (Choose two.)
Microsoft Purview Audit.
Insider Risk Management.
Sensitivity labels and policies.
Labels classify and protect data with encryption and markings.
Microsoft Purview eDiscovery.
Data Loss Prevention (DLP) policies.
DLP prevents accidental sharing of sensitive data.
Your organization is designing a hybrid identity infrastructure with Microsoft Entra ID. You need to ensure that users can access on-premises applications using passwordless authentication and that the solution minimizes latency for authentication requests. What should you implement?
Join the on-premises servers to Microsoft Entra Domain Services and use passwordless authentication.
Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.
Correct. Microsoft Entra application proxy publishes on-premises apps and supports passwordless authentication with low latency.
Install Web Application Proxy (WAP) on-premises and integrate with Microsoft Entra ID for passwordless.
Deploy a VPN and use Microsoft Entra ID with passwordless sign-in.
Want more Design security solutions for infrastructure practice?
Practice this domain22% of exam · 6 sample questions below
Your organization is deploying a new line-of-business application on Azure App Service. The app must authenticate users from Microsoft Entra ID and also access a downstream API that requires a client secret. You need to recommend the most secure method for managing the client secret. What should you use?
Store the secret in the Azure AD app registration manifest.
Store the secret in an App Service application setting.
Store the secret in Azure Key Vault and use a Key Vault reference in App Service.
Correct. Azure Key Vault provides secure, centralized storage for secrets with encryption and access auditing. App Service can reference Key Vault secrets via Key Vault references, using a managed identity to authenticate without exposing the secret.
Store the secret in the application code as a constant.
You are designing an API management solution using Azure API Management. The security team requires that all API calls must be authenticated using OAuth 2.0 and that only specific Azure AD applications can access the APIs. Additionally, the solution must support rate limiting and IP filtering. What should you configure?
Set up client certificate authentication and map certificates to Azure AD apps
Enable API key authentication and restrict access using subscription keys
Use OAuth 2.0 with Azure AD and configure inbound policies to validate JWTs
Configure OAuth 2.0 in Azure API Management, use validate-jwt policy to restrict to specific Azure AD apps, and add rate-limit and ip-filter policies
This combination meets all requirements.
You are designing a secure access strategy for Azure App Service web applications. The requirements are: use Azure AD for authentication, restrict access to specific IP ranges, and require multi-factor authentication (MFA) for all users. Which two components should you configure? (Choose two.)
Apply a network security group (NSG) to the App Service subnet
Configure Azure App Service authentication with Microsoft Entra ID
Azure App Service authentication can be configured to use Microsoft Entra ID, which is required for user authentication.
Create a Conditional Access policy in Microsoft Entra ID that requires MFA and restricts IP ranges
Conditional Access policies in Microsoft Entra ID can enforce MFA and restrict IP ranges, meeting the requirements.
Deploy Azure Firewall to filter inbound traffic
Register the application in Microsoft Entra ID
A company uses Microsoft Defender for Cloud to secure their Azure workloads. They need to ensure that all Azure SQL databases have threat detection enabled. Which TWO actions should they take? (Choose two.)
Enable Microsoft Defender for Cloud's 'SQL servers on machines' plan
Enable Azure Defender for SQL at the subscription level
Enabling Azure Defender for SQL at the subscription level automatically enables Advanced Threat Protection for all Azure SQL databases in the subscription, ensuring threat detection across all databases.
Configure SQL Vulnerability Assessment
Enable Advanced Threat Protection on each SQL server individually
Enabling Advanced Threat Protection individually on each SQL server ensures threat detection for all databases on that server. While less efficient than subscription-level enablement, it is a valid action to achieve the goal.
Configure SQL auditing on each database
A company is designing a data classification strategy using Microsoft Purview. They need to automatically classify and protect sensitive data stored in Azure Blob Storage. Which TWO capabilities should they use? (Choose TWO.)
Sensitivity labels
Sensitivity labels are a correct part of a Microsoft Purview classification strategy because they allow you to tag files and emails with classification, and optionally apply encryption or watermarks. They can be auto-applied through content inspection of sensitive information types and can extend to other workloads, yet they mark the content rather than maintain a centralized data map. In an Azure-centric design, they complement, rather than replace, Purview Data Map's asset-level classification.
Data Loss Prevention (DLP) policies
Information Barriers
Microsoft Purview Data Map
Microsoft Purview Data Map is the central service that automatically discovers data assets across Azure, on-premises, and multi-cloud sources, scanning Blob Storage, SQL, and other repositories. It applies built-in and custom sensitive information types to register classification metadata in a unified, searchable catalog, giving the data steward a complete view of the estate. This auto-discovery and classification of assets is foundational for any data classification strategy.
Azure Policy
A financial services company uses Microsoft Sentinel for SIEM. They need to detect potential data exfiltration from their Azure SQL Database. Which THREE data sources should they connect to Sentinel to achieve this? (Choose THREE.)
Microsoft Defender for Cloud alerts
Azure AD sign-in logs
Azure Network Watcher NSG flow logs
Provide network traffic data to detect unusual data transfers.
Azure SQL Database audit logs
Contain detailed SQL queries that can indicate data access patterns.
Azure Activity Logs
Show administrative operations like export or backup that could indicate exfiltration.
Want more Design security solutions for applications and data practice?
Practice this domainThe SC-100 exam has 50 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Design solutions that align with security best practices and priorities, Design security operations, identity, and compliance capabilities, Design security solutions for infrastructure, Design security solutions for applications and data. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft SC-100 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.