SC-100 Practice Test 10 — 10 Questions

Question 1

Refer to the exhibit. You are reviewing an Azure Policy definition that will be assigned to a subscription containing production virtual machines. The policy is intended to enforce security best practices for disk encryption. What is the effect of this policy?

Accepted Answer

The policy denies deployment of virtual machines using Standard_LRS or StandardSSD_LRS managed disks.. The policy uses the 'deny' effect with a condition that checks if the 'Microsoft.Compute/disks/sku.name' property is not equal to 'Premium_LRS'. This means any virtual machine deployment that uses Standard_LRS or StandardSSD_LRS managed disks will be denied, enforcing the use of Premium_LRS disks for production VMs to meet security best practices for disk encryption.

Answer

The policy modifies existing virtual machines to change their disk type to Premium_LRS.

Answer

The policy allows deployment of virtual machines only if they use Standard_LRS or StandardSSD_LRS disks.

Answer

The policy audits virtual machines to ensure they have Azure Disk Encryption enabled.

Question 2

A financial services organization is designing a zero-trust architecture for its Azure environment. They need to ensure that all administrative access to critical systems uses just-in-time (JIT) access and that privileged role assignments are time-bound. Which combination of Microsoft security best practices should they implement?

Accepted Answer

Azure AD Privileged Identity Management (PIM) and Azure Bastion. Azure AD Privileged Identity Management (PIM) provides just-in-time (JIT) activation and time-bound role assignments for privileged roles, directly meeting the requirement for time-bound administrative access. Azure Bastion enables secure, audited RDP/SSH access to Azure VMs without exposing public IP addresses, ensuring that administrative sessions are isolated and monitored. Together, they enforce zero-trust principles by granting ephemeral, scoped access to critical systems.

Answer

Azure AD Conditional Access and Azure AD Identity Protection

Answer

Azure Policy and Azure Blueprints

Answer

Azure Sentinel and Azure Workbook

Question 3

A company uses Azure SQL Database and needs to implement column-level encryption for a column containing social security numbers (SSNs). The encryption must use a customer-managed key stored in Azure Key Vault. The application queries this column using parameterized queries. Which technology should be used?

Accepted Answer

Always Encrypted with secure enclaves. Always Encrypted with secure enclaves is the correct choice because it enables client-side encryption of specific columns (like SSNs) using a customer-managed key stored in Azure Key Vault, while still allowing rich computations (e.g., equality, pattern matching) on the encrypted data within a secure enclave. This meets the requirement for column-level encryption with customer-managed keys and supports parameterized queries without exposing plaintext to the database engine.

Answer

Dynamic Data Masking (DDM)

Answer

Row-Level Security (RLS)

Answer

Transparent Data Encryption (TDE) with customer-managed keys

Question 4

A company uses Azure DevOps for CI/CD. The security team wants to ensure that secrets like API keys and connection strings are never stored in code repositories. Which best practice should they recommend?

Accepted Answer

Use Azure Key Vault references in Azure DevOps variable groups. Option B is correct because Azure Key Vault references in Azure DevOps variable groups allow secrets to be securely linked to pipelines without ever storing them in code repositories. At pipeline runtime, the agent retrieves the secret value directly from Azure Key Vault using a managed identity or service principal, ensuring secrets are never exposed in YAML files, logs, or build artifacts.

Answer

Use environment variables in the pipeline YAML

Answer

Encrypt secrets using Git-secret and commit to repo

Answer

Store secrets in Azure App Configuration with encryption

Question 5

Refer to the exhibit. A security architect reviews the Azure AD Conditional Access policy JSON. The policy is intended to require MFA for all users accessing Azure management (Microsoft Azure Management app ID 797f4846-ba77-4853-9e6f-4433c3e1d1c5), except for the BreakGlassAdmin account and from trusted locations. However, some users report being prompted for MFA even when connecting from the corporate office (which is marked as a trusted location). What is the most likely cause?

Accepted Answer

The corporate office location is not correctly defined as a trusted location in Azure AD. Option A is correct because the policy is designed to require MFA for all users accessing Azure management, except for the BreakGlassAdmin account and from trusted locations. If the corporate office location is not correctly defined as a trusted location in Azure AD, the Conditional Access policy will not recognize it as an exception, and users connecting from that location will still be prompted for MFA. This mismatch between the intended trusted location definition and the actual location configuration is the most likely cause of the unexpected MFA prompts.

Answer

The grant controls operator is set to 'OR' instead of 'AND'

Answer

The policy is in 'Report-only' mode

Answer

The policy applies to all cloud apps, not just Azure management

Question 6

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to design a solution that aligns with the Zero Trust principle of 'verify explicitly'. Which approach should you recommend for user authentication?

Accepted Answer

Deploy passwordless authentication using FIDO2 security keys for all users. D is correct because FIDO2 security keys provide phishing-resistant, passwordless authentication that aligns with the Zero Trust 'verify explicitly' principle by requiring a hardware-bound cryptographic proof of identity at every sign-in. This eliminates reliance on shared secrets (passwords) and ensures that authentication is explicitly verified through a physical device, meeting the strictest security requirements for user authentication.

Answer

Deploy passwordless authentication using Microsoft Authenticator with phone sign-in for all users

Answer

Enable users to sign in with Windows Hello for Business and allow password recovery via self-service

Answer

Implement password hash synchronization and enforce MFA only for privileged users

Question 7

Which TWO should you implement to protect privileged accounts in Microsoft Entra ID?

Accepted Answer

Conditional Access policies requiring MFA for privileged roles. Option B is correct because Conditional Access policies can enforce multifactor authentication (MFA) specifically for users assigned to privileged roles in Microsoft Entra ID. This directly protects those accounts by requiring a second authentication factor, reducing the risk of credential theft or reuse. It is a core identity security control recommended by Microsoft for privileged access.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Cloud security score

Answer

Microsoft Defender Vulnerability Management

Question 8

A company is designing a Zero Trust security strategy. They want to ensure that all access requests are authenticated, authorized, and encrypted before granting access. Which Microsoft security solution should they use as the central policy engine?

Accepted Answer

Microsoft Entra ID. Microsoft Entra ID (formerly Azure AD) is the correct central policy engine because it provides identity-based conditional access policies that authenticate, authorize, and enforce encryption (e.g., via device compliance or app protection policies) before granting access. It acts as the policy decision point (PDP) in a Zero Trust architecture, evaluating signals like user risk, device state, and location to allow or deny access.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 9

Which TWO of the following are valid methods to protect privileged accounts in Microsoft Entra ID?

Accepted Answer

Configure Conditional Access policies for privileged roles. Conditional Access policies can be configured to require stronger authentication, device compliance, or location-based controls specifically for users assigned to privileged roles (e.g., Global Administrator, Privileged Role Administrator). This directly protects privileged accounts by enforcing additional security requirements before granting access to Entra ID resources.

Answer

Enable Identity Protection for all users

Answer

Enable Self-Service Password Reset (SSPR)

Answer

Use Azure AD Connect to sync privileged accounts

Question 10

A multinational corporation is designing a data classification strategy for Microsoft 365. They have the following requirements: (1) Documents containing financial data must be labeled as 'Confidential' automatically. (2) Labels must be applied based on content patterns, such as credit card numbers. (3) The solution must work across Exchange Online, SharePoint Online, and OneDrive for Business. Which two components are essential?

Accepted Answer

Sensitivity labels in Microsoft Purview Information Protection. Sensitivity labels in Microsoft Purview Information Protection are the core technology for classifying and protecting data based on content patterns. They support automatic labeling via auto-labeling policies that scan for sensitive data types (e.g., credit card numbers) and can apply labels across Exchange Online, SharePoint Online, and OneDrive for Business. This directly meets all three requirements: automatic labeling, pattern-based detection, and cross-workload coverage.

Answer

Azure Information Protection (AIP) unified labeling client

Answer

Data Loss Prevention (DLP) policies in Microsoft 365 Security & Compliance Center

Answer

Retention policies in Microsoft 365 Compliance Center

SC-100 Practice Test 10 — 10 Questions

Exhibit

SC-100 Practice Test 10 — 10 Questions

Exhibit