Microsoft · Free Practice Questions · Last reviewed May 2026
24real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
22% of exam · 6 sample questions below
Your organization is using Microsoft Defender for Cloud to assess the security posture of Azure resources. You need to ensure that the highest severity recommendations are addressed first. Which dashboard or feature in Defender for Cloud should you use to view the most critical security issues?
Azure Security Center dashboard
Inventory
Secure Score
Secure Score shows recommendations grouped by severity and impact, helping prioritize critical issues.
Security alerts
Refer to the exhibit. Your organization is required to comply with PCI DSS. You need to prioritize remediation efforts to meet PCI DSS requirements. Based on the exhibit, which recommendation should you address first?
Enable MFA on accounts with owner permissions
PCI DSS requirement 8.3.1 requires multi-factor authentication for all administrative access.
Migrate VMs from classic to ARM
Enable vulnerability assessment on SQL databases
Enable diagnostic logs in Key Vault
Which TWO actions should you take to implement a defense-in-depth strategy for an Azure application? (Choose two.)
Enable encryption at rest for all storage accounts
Enable Azure DDoS Protection on the virtual network
DDoS Protection mitigates large-scale attacks, adding a network layer.
Enable Azure Firewall on all subnets
Use managed identities for Azure resources
Enable network security groups (NSGs) on all subnets
NSGs provide network-level access control, a key layer in defense-in-depth.
Which THREE Microsoft security solutions can be used to detect and respond to threats across hybrid cloud environments? (Choose three.)
Microsoft Defender for Cloud
Provides threat detection for workloads across clouds and on-premises.
Microsoft Sentinel
SIEM that collects security data from hybrid environments.
Microsoft Defender for Office 365
Microsoft Intune
Microsoft Defender for Identity
Detects threats in on-premises Active Directory.
Which TWO of the following are best practices for securing Microsoft 365 tenants? (Choose two.)
Enable security defaults in Microsoft Entra ID
Security defaults enforce common security policies like MFA.
Use Conditional Access policies to enforce MFA
Conditional Access provides granular access control.
Enable basic authentication for all apps
Disable modern authentication for legacy protocols
Allow all external sharing in SharePoint
Which THREE components are part of the Microsoft Zero Trust architecture? (Choose three.)
Networks
Network segmentation and micro-perimeters are part of zero trust.
Devices
Device health and compliance are critical.
Data
Applications
Identities
Identities are a key pillar; verify explicitly.
Want more Design solutions that align with security best practices and priorities practice?
Practice this domain28% of exam · 6 sample questions below
A company plans to implement Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from sharing credit card numbers via email. What should they configure?
Create a sensitivity label and apply it to emails
Enable communication compliance policies
Create a DLP policy that detects and blocks credit card numbers in Exchange Online
DLP policies in Microsoft Purview can detect sensitive info types like credit card numbers and block sharing via email.
Configure a retention policy for email
Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?
Create a Conditional Access policy that requires compliant device
Conditional Access can require device compliance as a condition for accessing corporate resources.
Set up enrollment restrictions in Intune
Create a device configuration policy that blocks non-compliant devices
Configure an app protection policy for email apps
Your organization uses Microsoft Entra ID and needs to ensure that external partners can access only specific applications for 30 days. What should you configure?
Entitlement management and create an access package with an expiration of 30 days
Access packages in entitlement management allow you to grant time-limited access to applications for external users.
B2B direct connect
Self-service group management
Conditional Access policy with session control
Your organization uses Microsoft Purview to classify sensitive data. You need to automatically apply a sensitivity label to documents that contain personally identifiable information (PII). Which TWO components should you configure?
Auto-labeling policy
An auto-labeling policy in Microsoft Purview applies sensitivity labels automatically based on conditions such as the presence of sensitive information types, including PII. This satisfies the stem’s requirement for automatic application without user intervention, using machine learning or exact data match classifiers to detect PII patterns within documents.
Retention label
Data Loss Prevention (DLP) policy
Sensitivity label
Sensitivity labels define the classification and protection to be applied.
Trainable classifier
Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a unified security operations platform. Which THREE capabilities should you enable?
Azure Policy for security controls
Microsoft Purview Information Protection
Microsoft Defender XDR incident integration with Sentinel
Integrating Defender XDR incidents into Sentinel provides a unified view.
Microsoft Sentinel SIEM
Sentinel provides log ingestion and analysis for security operations.
Microsoft Sentinel UEBA (User and Entity Behavior Analytics)
UEBA in Sentinel detects anomalous behavior for insider threat detection.
Your organization uses Microsoft Entra ID and needs to implement a Zero Trust identity strategy. Which THREE principles should you apply?
Use least privilege access
Least privilege limits access to only what is needed.
Verify explicitly
Zero Trust requires verifying every access request.
Trust implicitly
Use a single authentication method
Assume breach
Assume breach design limits blast radius and verifies all transactions.
Want more Design security operations, identity, and compliance capabilities practice?
Practice this domain28% of exam · 6 sample questions below
Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts from compromised on-premises servers to Azure VMs. Which data connector should you prioritize?
Syslog via AMA
Office 365 Logs
Windows Security Events via AMA
Captures security events like logons, which are critical for lateral movement detection.
Azure Activity Log
A company plans to use Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. What is the first step to enable multi-cloud visibility?
Enable all Defender plans for subscription
Connect AWS and GCP accounts using the cloud connectors in Defender for Cloud
Correct. Connecting AWS and GCP accounts via cloud connectors is the necessary first step to bring those resources into Defender for Cloud.
Create custom compliance policies
Deploy Azure Arc agents on all cloud VMs
You are designing a secure DevOps pipeline using GitHub Advanced Security and Microsoft Defender for Cloud. The development team uses a mix of Python and JavaScript. Which tool should you integrate to detect secrets (e.g., API keys) committed to the repository?
GitHub secret scanning
GitHub secret scanning automatically detects secrets in repositories.
CodeQL code scanning
Dependabot alerts
Defender for Cloud DevOps security posture management
Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)
Ensure that 'Auditing' is set to 'On' for SQL Database
This policy enables auditing for Azure SQL Database.
Ensure that 'TDE' is enabled for SQL Server VMs
Audit SQL Server level audit setting
Ensure that 'Firewall and virtual network settings' for SQL Database are configured
This policy enforces network security rules.
Ensure secure transfer to storage accounts is enabled
Which THREE features of Microsoft Defender for Cloud help secure Azure Kubernetes Service (AKS) clusters? (Select three.)
Advanced threat protection for Azure Cosmos DB
Azure Defender for Kubernetes (cluster hardening)
Provides threat detection and hardening recommendations for AKS.
Vulnerability assessment for container images
Defender for Cloud scans container images for vulnerabilities.
DDoS Protection Standard
Runtime threat detection for AKS clusters
Detects suspicious activities at runtime in AKS.
Which TWO actions should you take to improve the security posture of an Azure subscription using Microsoft Defender for Cloud? (Select two.)
Assign Azure Policy to enforce resource compliance
Enable Azure Defender plans for all supported resource types
Enabling plans provides advanced threat protection.
Implement the top security recommendations from the Secure Score
Improving Secure Score directly enhances security posture.
Create custom security policies
Deploy vulnerability assessment solution to all VMs
Want more Design security solutions for infrastructure practice?
Practice this domain22% of exam · 6 sample questions below
Your company uses Microsoft Defender for Cloud to protect Azure resources. A critical application uses an Azure SQL Database. You need to ensure that all queries to the database are encrypted in transit and that the encryption protocol is the most secure version available. Which configuration should you enforce?
Set the minimal TLS version to 1.2 in the server's firewall rules.
This enforces that only clients using TLS 1.2 or higher can connect.
Configure the database to reject unencrypted connections.
Set the connection policy to Proxy and force TCP.
Enable 'Force SSL' on the database.
Your organization stores sensitive customer data in Azure Blob Storage. You need to implement data classification and labeling using Microsoft Purview. Which resource should you use to automatically scan and classify the data?
Azure Policy
Microsoft Purview Data Map
Data Map scans assets and applies classification rules automatically.
Microsoft Purview Information Protection
Microsoft Purview Data Loss Prevention
A company uses Microsoft Entra ID to authenticate users for a web application. They want to enable self-service password reset (SSPR) for users. What is the minimum licensing requirement?
Microsoft 365 E3
Microsoft Entra ID P2
Microsoft Entra ID Free
Microsoft Entra ID P1
Microsoft Entra ID P1 is the minimum license that includes SSPR.
Your organization uses Microsoft Defender for Cloud to protect Azure SQL databases. You notice that a particular database is flagged with a high-severity recommendation to enable 'Advanced Data Security'. What does enabling Advanced Data Security provide?
It restricts access to the database to specific IP addresses.
It encrypts the database at rest using TDE.
It provides vulnerability assessments and threat detection.
ADS includes these security capabilities.
It enables automatic backup encryption.
Your company is designing a solution to store sensitive documents in Azure Files. The files must be encrypted at rest and in transit. Which two configurations are required? (Each correct answer presents part of the solution.)
Enable Azure Disk Encryption on the VMs that mount the share.
Configure the storage account to use HTTPS only.
Enable Azure Storage Service Encryption (SSE) for the storage account.
SSE encrypts data at rest automatically.
Configure the Azure file share to require SMB 3.0 with encryption.
SMB 3.0 with encryption provides encryption in transit.
Use Azure File Sync to sync files to on-premises servers.
Your organization uses Microsoft Purview Information Protection to label and protect sensitive emails and documents. You need to ensure that when a user applies a 'Highly Confidential' label, the content is automatically encrypted and a watermark is added. Which configuration should you use?
Use Azure Information Protection scanner to apply labels automatically.
Create a DLP policy that blocks sharing of highly confidential content.
Configure a sensitivity label with encryption and watermark settings.
Sensitivity labels can include protection actions like encryption and watermarks.
Enable Microsoft 365 Message Encryption for all emails.
Want more Design security solutions for applications and data practice?
Practice this domainThe SC-100 exam has 50 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Design solutions that align with security best practices and priorities, Design security operations, identity, and compliance capabilities, Design security solutions for infrastructure, Design security solutions for applications and data. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft SC-100 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.