SC-100 Practice Test 1 — 10 Questions

Question 1

Refer to the exhibit. You are reviewing a Conditional Access policy in Azure AD. The policy requires MFA and a compliant device for all users and all cloud apps. Some users report that they are able to access apps without being prompted for MFA even though their devices are compliant. What is the most likely reason?

Accepted Answer

The policy is set to 'Report-only' mode. Option B is correct because a Conditional Access policy set to 'Report-only' mode evaluates the policy and logs results but does not enforce any controls, such as requiring MFA or a compliant device. Users can access apps without MFA prompts because the policy is not actively blocking or challenging them, even if their devices are compliant. This mode is used for testing before enabling enforcement.

Answer

The policy does not include all cloud apps

Answer

The policy excludes specific locations

Answer

The policy does not include session controls to enforce MFA re-prompt

Question 2

A company, Fabrikam, has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. They have implemented a Zero Trust strategy that includes requiring multi-factor authentication (MFA) for all users accessing cloud applications. They use Conditional Access policies to enforce MFA. Recently, they noticed that users who authenticate from the on-premises network are not being prompted for MFA when accessing cloud apps, even though the Conditional Access policy is configured to require MFA for all users. The network location is not excluded in the policy. The Conditional Access policy is enabled and in 'Enforce' mode. The users' devices are not domain-joined. What is the most likely reason for this behavior?

Accepted Answer

Users are using legacy authentication protocols that do not support MFA. The most likely reason is that users are using legacy authentication protocols (e.g., POP3, IMAP, SMTP, or older Office clients) that do not support modern authentication and thus cannot enforce MFA via Conditional Access. Even though the policy requires MFA, legacy protocols bypass the Conditional Access engine entirely, allowing authentication without MFA prompts.

Answer

Azure AD Connect is not configured for Pass-through Authentication

Answer

The Conditional Access policy does not include session controls

Answer

The Conditional Access policy is not targeting the correct user group

Question 3

A company is deploying Microsoft Defender for Cloud to secure their hybrid cloud environment. They need to ensure that regulatory compliance with PCI DSS is continuously monitored and reported. Which solution should they use to automatically assess and report compliance posture?

Accepted Answer

Regulatory compliance dashboard in Microsoft Defender for Cloud. The Regulatory compliance dashboard in Microsoft Defender for Cloud is the correct solution because it provides built-in, automated assessment of compliance against regulatory standards like PCI DSS. It continuously monitors your hybrid cloud environment against the PCI DSS controls, generates a compliance score, and produces detailed reports without requiring custom policy definitions. This dashboard integrates with Azure Policy to map controls to assessments, but the dashboard itself is the dedicated tool for viewing and reporting compliance posture.

Answer

Azure Policy

Answer

Microsoft Purview Information Protection

Answer

Microsoft Entra ID Governance

Question 4

A company is planning their Zero Trust data protection strategy. They want to classify and protect sensitive data stored in SharePoint Online. Which Microsoft tool should they use?

Accepted Answer

Microsoft Purview Information Protection. Microsoft Purview Information Protection (formerly Microsoft Information Protection) is the correct tool because it provides integrated classification, labeling, and protection for sensitive data across Microsoft 365 services, including SharePoint Online. It uses sensitivity labels that can automatically apply encryption, rights management, and visual markings (headers/footers) to documents based on policy conditions, directly supporting the Zero Trust principle of 'assume breach' by protecting data at rest and in transit.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud Apps

Answer

Azure Policy

Question 5

An organization is implementing a Zero Trust identity strategy. They have a mix of on-premises Active Directory and Azure AD. They want to enforce conditional access policies that require device compliance for accessing sensitive apps. However, some users report that their devices are not being evaluated for compliance even though they are enrolled in Microsoft Intune. What should the organization check first?

Accepted Answer

Verify that devices are registered in Azure AD. Device compliance evaluation in a hybrid identity environment requires that devices are registered in Azure AD (Azure AD Registration) so that Azure AD can associate the device identity with Intune compliance data. Even if a device is enrolled in Intune, without Azure AD registration, Conditional Access policies cannot evaluate its compliance status because the device identity is not recognized by Azure AD during authentication.

Answer

Ensure Intune compliance policies are assigned to the correct user groups

Answer

Confirm that devices are Azure AD Joined

Answer

Check if users have enabled multi-factor authentication

Question 6

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Accepted Answer

Microsoft Intune for device management and compliance policies. A is correct because Microsoft Intune provides device management and compliance policies that define the security posture required for managed devices, such as requiring encryption, a minimum OS version, or a specific patch level. These compliance policies are evaluated by Azure AD during authentication, ensuring only devices that meet the organization's security standards can access corporate resources.

Answer

Azure AD Application Proxy

Answer

Azure AD B2B collaboration

Question 7

A company is implementing a Zero Trust network strategy using Azure Virtual Network Manager (AVNM). They need to ensure that all traffic between virtual networks is encrypted and inspected by a firewall. Which configuration should they use?

Accepted Answer

Use a hub-and-spoke topology with a firewall appliance in the hub. In a Zero Trust network strategy, all traffic must be encrypted and inspected regardless of source. A hub-and-spoke topology with a firewall appliance in the hub forces all inter-VNet traffic through the firewall, enabling deep packet inspection and encryption enforcement. Azure Virtual Network Manager (AVNM) can deploy this topology and route traffic via the hub, ensuring no direct VNet-to-VNet communication bypasses inspection.

Answer

Enable VNet peering between all VNets and use network security groups

Answer

Use a mesh topology with direct connectivity between VNets

Answer

Configure service endpoints for each VNet

Question 8

A company is designing a Zero Trust security posture for their Azure environment. They need to assess and improve their security posture. Which TWO actions should they take? (Choose two.)

Accepted Answer

Use Azure Policy to enforce security configurations. Azure Policy enforces organizational standards and assesses compliance at scale, which is a core Zero Trust principle of continuous verification and policy-driven access control. By applying policies that enforce security configurations (e.g., requiring HTTPS, restricting public network access), the company can proactively prevent misconfigurations and maintain a consistent security baseline across their Azure environment.

Answer

Enable Azure Update Management for all VMs

Answer

Deploy Microsoft Entra Permissions Management

Answer

Use Microsoft Security Copilot to generate security policies

Question 9

A large enterprise is implementing Microsoft Defender for Cloud to improve their security posture. Which TWO actions should they take to prioritize and remediate security recommendations effectively? (Choose two.)

Accepted Answer

Enable automatic remediation for high-priority recommendations. Option B is correct because Microsoft Defender for Cloud allows you to enable automatic remediation for high-priority recommendations, which automatically applies the necessary configuration changes (e.g., enabling encryption or installing endpoint protection) when a recommendation is triggered. This reduces manual effort and ensures critical security gaps are closed quickly. Option C is correct because the Secure Score aggregates all recommendations into a numerical score, and focusing on recommendations that provide the highest score improvement directly correlates to the most significant risk reduction, aligning with Microsoft's guidance for prioritization.

Answer

Assign each recommendation to a specific team member manually

Answer

Ignore recommendations with low severity to save time

Answer

Disable recommendations that generate security alerts

Question 10

An organization is planning to use Microsoft Defender for Cloud's regulatory compliance dashboard to track adherence to PCI DSS. The security team wants to ensure that all Azure resources are covered by the compliance assessment. What is the first step?

Accepted Answer

Enable Microsoft Defender for Cloud on all subscriptions and ensure resources are covered.. Option D is correct because to assess compliance, the resources must first be onboarded to Defender for Cloud (enabling enhanced security features). Option A is incorrect because the built-in initiative does not apply automatically without enabling Defender for Cloud coverage. Option B is incorrect because while you can assign a custom initiative, the first step is still to ensure resources are covered. Option C is incorrect because the compliance dashboard shows results only after assessment.

Answer

Configure the compliance dashboard to show PCI DSS controls.

Answer

Create a custom regulatory compliance standard for PCI DSS.

Answer

Enable the built-in PCI DSS policy initiative in Azure Policy.

SC-100 Practice Test 1 — 10 Questions

Exhibit

SC-100 Practice Test 1 — 10 Questions

Exhibit