SC-100 Practice Test 10 — 10 Questions

Question 1

Your organization is implementing a zero-trust security model and needs to ensure that all access to cloud resources is verified in real-time. You plan to use Microsoft Entra ID Conditional Access. Which policy component enforces real-time verification of user identity and device compliance before granting access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Conditional Access policy with conditions and grant controls. Conditional Access policies with conditions and grant controls enforce real-time verification by evaluating signals such as user identity, device compliance (via Microsoft Intune), and location before allowing access to cloud resources. The grant controls block or require multi-factor authentication (MFA) or device compliance, ensuring zero-trust principles of explicit verification and least privilege.

Answer

Enable Microsoft Secure Score

Answer

Use Azure AD Application Proxy

Answer

Assign users and groups to the policy

Question 2

Your organization uses Microsoft Intune for mobile device management. You need to ensure that only devices compliant with security policies can access corporate email. What should you implement?

Accepted Answer

Conditional Access policy requiring compliant device. A is correct because a Conditional Access policy in Microsoft Entra ID can evaluate device compliance status reported by Intune before granting access to corporate email. By configuring a policy that requires a device to be marked as compliant, only devices that meet your security policies (e.g., encryption, OS version, threat level) will be allowed to authenticate and access email. This directly enforces the requirement that only compliant devices can access corporate email.

Answer

Microsoft Purview Data Lifecycle Management

Answer

Microsoft Defender for Endpoint integration

Answer

Microsoft Intune App Protection Policies

Question 3

A company is deploying Azure SQL Database with Azure Active Directory authentication for their application. They want to ensure that only specific Azure AD users can access the database, and that these users are authenticated at the database level. What should they do?

Accepted Answer

Create contained database users mapped to Azure AD identities. Contained database users in Azure SQL Database are authenticated directly at the database level using Azure AD identities, without requiring a server-level login. This allows you to grant access to specific Azure AD users or groups while enforcing authentication within the database itself, aligning with the requirement for database-level authentication.

Answer

Create a server-level login for each user

Answer

Assign the Azure AD admin to the SQL server

Answer

Configure firewall rules to allow specific IPs

Question 4

Your organization wants to implement a security baseline for Azure resources using built-in policies. Which Azure service should you use to assign policies that enforce compliance with security best practices?

Accepted Answer

Azure Policy. Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules and effects on your Azure resources. These policies can be used to implement a security baseline by ensuring resources comply with built-in security best practices, such as requiring encryption or restricting resource types. Azure Policy evaluates resources against assigned policies and can automatically remediate non-compliant resources.

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud

Answer

Azure Role-Based Access Control (RBAC)

Question 5

A company uses Microsoft Intune to manage devices. They want to ensure that only devices that have passed health attestation can access corporate email. Which method should they use?

Accepted Answer

Create a device compliance policy for health attestation and use Conditional Access to require compliant devices. It combines a device compliance policy that evaluates health attestation (e.g., BitLocker status, Secure Boot, code integrity) with a Conditional Access policy that grants access to corporate email only when the device is marked as compliant. This is the standard Microsoft approach for enforcing health attestation before granting access to cloud resources like Exchange Online.

Answer

Use Microsoft Defender for Endpoint to block devices that fail health attestation

Answer

Create an app protection policy to require device health attestation

Answer

Create a device configuration policy to enforce health attestation

Question 6

Contoso is a large enterprise with a complex Azure environment. They have multiple management groups, subscriptions, and a hub-spoke network topology. The security team wants to implement a consistent security baseline across all subscriptions using Azure Policy. They need to ensure that: 1) All resources must be deployed in approved regions only. 2) Network security groups must have specific rules to block high-risk ports. 3) All storage accounts must enforce HTTPS traffic. 4) The policies must be applied at the management group level to ensure inheritance. 5) Non-compliant resources must be automatically remediated where possible. What should you do?

Accepted Answer

Create custom Azure Policy definitions for the required configurations (allowed locations, NSG rule blocking ports, storage HTTPS). Assign the policies at the root management group. Enable 'deployIfNotExists' effect for automatic remediation of non-compliant resources. Use Azure Policy remediation tasks to fix existing non-compliant resources.. It uses Azure Policy at the root management group to enforce inheritance across all subscriptions, with custom policy definitions for allowed locations, NSG rules blocking high-risk ports, and storage HTTPS. The 'deployIfNotExists' effect enables automatic remediation of non-compliant resources, and remediation tasks fix existing non-compliant resources, meeting all requirements without manual intervention.

Answer

Use Azure Policy Guest Configuration to enforce region and NSG rules. Assign policies at each subscription. Use Azure Automation runbooks for remediation.

Answer

Use Azure Blueprints to define the environment. Include Azure Policy assignments in the blueprint. Assign blueprint to each management group. Remediate manually.

Answer

Create a custom script using Azure PowerShell to check compliance daily. Use Azure Logic Apps to send alerts for non-compliance. Have IT staff manually fix issues.

Question 7

A company uses Azure SQL Database and needs to implement column-level encryption for a column containing social security numbers (SSNs). The encryption must use a customer-managed key stored in Azure Key Vault. The application queries this column using parameterized queries. Which technology should be used?

Accepted Answer

Always Encrypted with secure enclaves. Always Encrypted with secure enclaves is the correct choice because it enables client-side encryption of specific columns (like SSNs) using a customer-managed key stored in Azure Key Vault, while still allowing rich computations (e.g., equality, pattern matching) on the encrypted data within a secure enclave. This meets the requirement for column-level encryption with customer-managed keys and supports parameterized queries without exposing plaintext to the database engine.

Answer

Dynamic Data Masking (DDM)

Answer

Row-Level Security (RLS)

Answer

Transparent Data Encryption (TDE) with customer-managed keys

Question 8

A company is deploying Microsoft Defender for Cloud to protect a multi-cloud environment that includes Azure and AWS. The security team wants to prioritize the highest-risk recommendations. Which feature should they use to identify and focus on the most critical security issues?

Accepted Answer

Use Secure Score and its recommendations. Secure Score in Microsoft Defender for Cloud aggregates all security recommendations and assigns a score based on their relative risk and impact. By focusing on recommendations that most improve the Secure Score, the security team can systematically prioritize the highest-risk issues across both Azure and AWS resources. This directly aligns with the goal of identifying and focusing on the most critical security issues.

Answer

Regulatory Compliance dashboard

Answer

Enable Defender for Cloud's enhanced security features

Answer

Review attack path analysis

Question 9

A company is migrating its on-premises Active Directory to Microsoft Entra ID. They need to ensure that all user authentication for cloud apps uses passwordless methods. Which security best practice should they implement?

Accepted Answer

Implement Microsoft Entra ID passwordless authentication. The company's requirement is specifically to ensure all user authentication for cloud apps uses passwordless methods. Microsoft Entra ID passwordless authentication (e.g., Windows Hello for Business, FIDO2 security keys, or Microsoft Authenticator) directly eliminates passwords from the authentication flow, aligning with the stated goal. Other options, while enhancing security, do not enforce passwordless authentication.

Answer

Configure conditional access policies to block legacy authentication

Answer

Enable Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Require multifactor authentication (MFA) for all users

Question 10

Your security team needs to receive alerts when a user is assigned a privileged role in Microsoft Entra ID. Which service should you use to create an alert for privileged role assignments?

Accepted Answer

Microsoft Entra ID Privileged Identity Management (PIM). Microsoft Entra ID Privileged Identity Management (PIM) is the correct service because it provides built-in alerting capabilities specifically for privileged role assignments in Microsoft Entra ID. PIM can generate alerts when a user is assigned a privileged role, such as Global Administrator, without requiring additional configuration or external data sources. This aligns directly with the requirement to receive alerts for privileged role assignments within the identity platform.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud Apps