SC-100 Exam Questions and Answers

Configure an automation rule to run a playbook automatically

Automation rules in Microsoft Sentinel are event-driven orchestration mechanisms that evaluate newly created or updated incidents against configured conditions—such as severity or name—and then execute one or more linked playbooks automatically. Playbooks are Azure Logic Apps that can perform remediation steps like isolation, data collection, or notification, ensuring consistent, immediate response without human involvement. This is the only approach listed that satisfies 'automatically' while honoring incident context, since automation rules trigger exactly when incidents are created or changed.

Create a DLP policy that detects and blocks credit card numbers in Exchange Online

A DLP policy scoped to Exchange Online inspects email traffic and applies sensitive information type matching for credit card numbers, blocking sharing at the transport layer. This directly satisfies the stem's requirement to prevent email exfiltration, since Exchange Online is the workload governing mail flow within Microsoft Purview.

Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark

Connecting AWS and GCP accounts to Defender for Cloud surfaces those resources in Azure Resource Graph, where Azure Policy can apply the Microsoft Cloud Security Benchmark (MCSB), a unified initiative built on CIS/NIST plus Microsoft controls. This gives continuous compliance assessment and enforcement, like DeployIfNotExists remediation, across all clouds. As a result, every subscription or cloud account is measured against the same baseline, regardless of native cloud tooling—this is the only option that both centralizes and enforces a single baseline.

Create a Conditional Access policy that requires compliant device

Conditional Access policies are the access-control layer that evaluates the device's compliance state at sign-in. When combined with an Intune compliance policy, the 'Require device to be marked as compliant' grant control forces Microsoft Entra ID to check the device's compliance status and block access if the device is non-compliant. This is the correct approach because it directly enforces the access requirement for corporate resources, unlike enrollment or configuration policies that only manage settings or enrollment.

Microsoft Authenticator app with passwordless sign-in

Microsoft Authenticator app with passwordless sign-in is the correct choice because it leverages the user's smartphone as a possession factor, using a cryptographic challenge-response protocol. When the user enters their username, the Authenticator app displays a number or a number match prompt; the user's approval signs the request with a private key stored in the device's secure enclave, eliminating the password entirely. This method is phishing-resistant, supports conditional access policies, and works seamlessly on iOS and Android, making it ideal for smartphone-centric users.

Ingress security-critical logs to the Analytics logs tier with 365-day retention, and other logs to the Auxiliary logs tier with shorter retention

This hybrid approach directly addresses the one-year retention requirement while optimizing cost. Security-critical logs reside in the Analytics tier, which supports full KQL, advanced hunting, detections, and 365-day retention, ensuring no loss of investigative power. The Auxiliary logs tier, introduced for verbose telemetry, offers lower ingestion cost and basic query functionality for non-critical data, letting you retain comprehensive logs without overpaying. This separation balances compliance, performance, and budget far better than a one-size-fits-all strategy.

Microsoft Entra ID Conditional Access

Microsoft Entra ID Conditional Access is the policy enforcement engine that operationalizes zero trust by evaluating real-time signals such as user identity, device health, location, and risk level at the moment of authentication. It dynamically allows or blocks access, or requires additional controls like MFA or session policies, integrated directly with identity authentication. This makes it the central decision point for enforcing conditional access policies, rather than a supporting or monitoring tool.

The policy condition requires a managed disk, but the VMs might have unmanaged disks.

The policy definition's 'if' clause matches only VMs that have a managed disk (e.g., by checking that the 'managedDisk' property is present). VMs that still use unmanaged disks do not satisfy this condition, so the 'auditIfNotExists' effect is never evaluated for them. Consequently, the policy silently ignores the very machines that likely need the missing-extension audit, making the compliance report incomplete rather than identifying all noncompliant VMs.

Scheduled query rule

Scheduled query rules in Microsoft Sentinel are the appropriate choice because they run on a defined cadence (e.g., every 5 minutes or hourly) and execute a KQL query against ingested data. You can set a schedule that matches the desired time window, and the rule will trigger an incident if the query returns results. This allows you to easily implement a condition like 'alert when events occur during a specific time range' by embedding that time filter in the query and scheduling the rule to run accordingly.

Diagnostic settings on the Azure Activity Log

Diagnostic settings on the Azure Activity Log are the correct mechanism because the Activity Log itself records every control-plane operation—such as resource creation, deletion, and configuration changes—for your Azure resources. By configuring a diagnostic setting on this log, you can stream those management events directly into a Log Analytics workspace, enabling centralized querying, alerting, and long-term retention for security auditing. This is the built-in, supported way to capture and route resource-level change activity to your security monitoring pipeline.

Enable MFA on accounts with owner permissions

MFA on account owner permissions directly satisfies PCI DSS 8.3.1, which mandates multi-factor authentication for all administrative access to cardholder data environments. In Azure, the Owner role grants full control over all resource and security configurations, making it a primary target for credential compromise. Enabling MFA via Conditional Access or Microsoft Entra ID security defaults is an immediate, auditable control that closes a current high-risk exposure and is a prerequisite for passing any PCI DSS assessment.

Compliance policies

Compliance policies in Intune define the specific conditions a device must meet to be considered compliant, such as required OS versions, password requirements, encryption status, and threats detected by Mobile Threat Defense. Each device periodically uploads its health and configuration to the Intune service, which computes a compliant/non-compliant state. This state can then be consumed by Microsoft Entra Conditional Access to allow or block access to emails, apps, and data based on real-time compliance. When a policy is combined with a Conditional Access policy requiring device compliance, non-compliant devices are blocked from accessing protected resources—making this the correct answer.

Store the secret in Azure Key Vault and use a Key Vault reference in App Service.

Correct. Azure Key Vault provides secure, centralized storage for secrets with encryption and access auditing. App Service can reference Key Vault secrets via Key Vault references, using a managed identity to authenticate without exposing the secret.

Microsoft Purview Data Map

Microsoft Purview Data Map is the correct choice because it performs automated metadata scanning and classification of assets across data sources, including Azure Blob Storage. It uses built-in system classification rules and custom classification rules to inspect actual data content (e.g., regex, keywords) and applies classifications like "Person's Name" or "Credit Card Number" to the schema and data. These classifications are then used in the Data Catalog, enabling sensitivity reporting and integration with information protection for labeling. It does not enforce access control or policy, but it is specifically designed for data discovery and classification at scale.

Configure a sensitivity label with encryption and watermark settings.

Sensitivity labels are the only Microsoft Purview option that can simultaneously apply encryption with Azure Rights Management and configure content marking, including visual watermarks, headers, and footers. When a label with these settings is applied to a document or email, the watermark is automatically rendered behind the content or in the header, and encryption protects the file at rest and in transit. This provides a unified, policy-driven way to add watermarks without separate tooling or manual intervention.

Azure Monitor Agent

Azure Monitor Agent (AMA) is the correct modern agent for Microsoft Sentinel because it unifies data collection across the entire Azure Monitor platform. It uses data collection rules (DCRs) to define exactly which data sources to collect, enabling granular filtering, multi-homing to multiple workspaces, and support for both Windows and Linux without the overhead of separate agents. AMA is the only forward-looking agent that Microsoft is actively investing in, with rich features like network isolation, Azure Arc support, and the ability to handle all log types Sentinel consumes.

Assign Azure RBAC roles such as Storage Blob Data Contributor to security principals.

Azure RBAC role assignments are the recommended, identity-based authorization method for controlling access to Azure Data Lake Storage Gen2. Roles like Storage Blob Data Contributor grant a security principal (user, group, service principal, or managed identity) permissions at the storage account, container, or directory/file scope using Azure's centralized control plane. When a principal makes a request, Azure evaluates RBAC assignments, integrating with Microsoft Entra ID, to determine coarse-grained access such as read, write, delete, and list, making this the go-to choice for broad or automated access control.

Set POSIX-like access control lists (ACLs) on directories and files.

Azure Data Lake Storage Gen2 supports hierarchical ACLs that mirror POSIX permissions, allowing you to define read, write, and execute permissions for the owning user, owning group, named users, named groups, and others on each directory and file. ACLs operate at the data plane and are evaluated after RBAC, providing fine-grained, per-file/per-directory control required in a hierarchical namespace. This mechanism is essential when you need to distinguish access between different users within the same container, with effective permissions computed recursively through the directory tree.

A managed identity must be associated with the policy assignment and have permissions to modify TDE.

The Modify effect in Azure Policy requires a managed identity to be attached to the policy assignment and that identity must be granted RBAC permissions, such as SQL Security Manager, on the target SQL servers or databases to change Transparent Data Encryption settings. Without a properly configured identity, the policy assignment fails during evaluation/remediation and cannot apply the desired TDE state. This is a mandatory prerequisite, making the option the correct answer.

Windows Security Events via AMA

Windows Security Events via AMA is the correct choice because the Azure Monitor Agent can collect Windows Security log entries from on-premises and Azure Arc-enabled Windows servers. These events include critical authentication-related event IDs like 4624 (successful logon), 4625 (failed logon), and 4768 (Kerberos ticket request), which are essential for detecting lateral movement. The data can be streamed directly to Microsoft Sentinel, allowing analysts to build detections for suspicious logon patterns and pass-the-hash attacks across hybrid identities.

Connect AWS and GCP accounts using the cloud connectors in Defender for Cloud

The Defender for Cloud multi-cloud connectors establish the onboarding bridge between Azure and AWS or GCP, synchronizing security configurations, threat indicators, and resource inventory into the unified Azure dashboard. This connector-level integration, which leverages read-only credentials from the foreign cloud, is the mandatory first step because all subsequent security policies, recommendations, and Defender plan coverage depend on the cloud accounts being visible to Azure. Without this connector, Defender for Cloud has no access to the AWS or GCP workloads.

Ensure that 'Auditing' is set to 'On' for SQL Database

Enabling SQL Database auditing satisfies the secure-configuration requirement by recording all database events to a storage, Log Analytics or Event Hub destination, giving the detective evidence trail that Azure Policy's Auditing effect enforces at scale across every server and database in scope.

Ensure that 'Firewall and virtual network settings' for SQL Database are configured

Configuring firewall and virtual network settings satisfies the network-isolation constraint by denying public Azure service access and permitting only approved IP ranges, private endpoints or subnet delegations, so Azure Policy blocks any SQL server left reachable from the open internet.

Azure Defender for Kubernetes (cluster hardening)

Azure Defender for Kubernetes, now part of Microsoft Defender for Containers, provides continuous security assessment of your cluster's configuration, including checks against CIS Kubernetes Benchmarks, overly permissive RBAC roles, and insecure pod settings. It automatically generates prioritized hardening recommendations that analysts can implement to reduce attack surface. This directly helps secure AKS clusters and is the correct answer for cluster hardening.

Vulnerability assessment for container images

Vulnerability assessment for container images, built into Defender for Containers, scans images in Azure Container Registry (and other supported registries) for known vulnerabilities in OS packages and application dependencies. It uses Qualys or Microsoft Defender Vulnerability Management engines, performing both pull-based and push-based scans. By identifying and remediating image weaknesses before deployment, it strengthens the entire AKS supply chain.

Runtime threat detection for AKS clusters

Runtime threat detection for AKS clusters, also part of Defender for Containers, continuously monitors cluster audit logs, node events, and host-level signals to identify suspicious activity such as privilege escalation, malicious containers, or crypto-mining. When a threat is detected, security alerts with recommendations are raised in Defender for Cloud, enabling immediate incident response without manual log analysis. This provides real-time protection during cluster operation, making it a correct feature.

Enable Azure Defender plans for all supported resource types

Enabling Azure Defender plans for all supported resource types activates integrated threat protection, including endpoint detection, vulnerability scanning, and security alerts across workloads. This directly strengthens security posture by providing continuous monitoring and automated responses to attacks, while also feeding findings into Secure Score to guide further improvements. It is a foundational action that covers multiple aspects of security simultaneously.

Implement the top security recommendations from the Secure Score

Implementing the top Secure Score recommendations is a direct, prioritized approach to improving security posture by addressing the most impactful gaps, such as enabling MFA or remediating critical vulnerabilities. Secure Score quantifies your security controls and suggests the highest-value actions first, giving you clear, risk-based remediation steps. Acting on these recommendations reduces your attack surface and measurably increases the score.

Denies creation of network security rules that allow traffic to ports other than 22 and 3389

This is correct because the policy definition uses the 'deny' effect on Microsoft.Network/networkSecurityGroups/securityRules whose destinationPortRange or destinationPortRanges include values not in ['22', '3389']. When a user or service attempts to create or update an NSG rule that permits traffic to any port other than 22 or 3389, the Resource Manager deployment is rejected before the rule is applied, making it impossible to add such a rule to an NSG. The policy does not, however, automatically delete existing noncompliant rules; it applies at deployment time, so already-existing rules that violate the condition remain until manually changed or removed.