SC-100 Practice Test 11 — 15 Questions

Question 1

You are designing a Zero Trust architecture for a company that uses Microsoft Entra ID and Microsoft Intune. The security team wants to enforce device compliance before granting access to cloud apps. Which policy should you implement?

Accepted Answer

Microsoft Entra Conditional Access policy requiring compliant device. Option C is correct because Microsoft Entra Conditional Access policies can require that devices are marked as compliant by Microsoft Intune before granting access to cloud apps. This directly enforces device compliance as a condition for access, which is a core Zero Trust principle of verifying every access request based on device health.

Answer

Microsoft Entra Identity Protection user risk policy

Answer

Microsoft Defender for Cloud Apps session policy

Answer

Azure AD Identity Protection sign-in risk policy

Question 2

Order the steps to implement a Microsoft Sentinel data connector for Azure Active Directory logs.

Question 3

Order the steps to respond to a Microsoft Defender for Cloud security alert.

Question 4

Order the steps to configure a Conditional Access policy requiring MFA for all users.

Question 5

Order the steps to perform a disaster recovery failover of an Azure VM to a secondary region using Azure Site Recovery.

Question 6

Match each compliance framework to its focus area.

Question 7

Match each Microsoft 365 Defender workload to its protection domain.

Question 8

Match each encryption type to its use case in Azure.

Question 9

Match each Azure policy effect to its behavior.

Question 10

Match each identity security concept to its definition.

Question 11

Match each security operations tool to its primary function.

Question 12

Match each Azure security capability to its primary purpose.

Question 13

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). The security team receives an alert for a user who has failed authentication 10 times in 5 minutes. What should you configure to reduce false positives while ensuring legitimate brute-force attacks are still detected?

Accepted Answer

Customize the anomaly threshold in UEBA. Customizing the anomaly threshold in UEBA allows you to adjust the sensitivity of the behavioral baseline, reducing false positives for users who legitimately fail authentication multiple times while still detecting true brute-force attacks. UEBA learns normal behavior patterns and flags deviations; by raising the threshold, you require a higher deviation from the baseline before an alert fires, preserving detection of actual attacks.

Answer

Disable UEBA for that user

Answer

Modify the analytics rule that triggered the alert

Answer

Create a playbook to auto-acknowledge the alert

Question 14

A company is designing a hybrid identity solution with Microsoft Entra ID. They need to ensure that users can access resources from unmanaged devices while maintaining security. The security team requires that all access from unmanaged devices must be limited to browser-only access to web apps and must block native client apps. Which conditional access grant control should you configure?

Accepted Answer

Require device to be marked as compliant. Option B is correct because the 'Require device to be marked as compliant' grant control, when combined with a device compliance policy (e.g., via Microsoft Intune), enforces that only compliant devices can access resources. However, to achieve the specific requirement of limiting access from unmanaged devices to browser-only access to web apps and blocking native client apps, you must configure a session control (not a grant control) such as 'Use app enforced restrictions' or 'Require device to be compliant' with a conditional access policy that targets unmanaged devices and uses the 'Browser' client app condition. The correct grant control for this scenario is actually 'Require device to be marked as compliant' only if the device is managed; for unmanaged devices, the appropriate approach is to use a session control like 'Use Conditional Access App Control' or 'Require device to be compliant' is not directly applicable because unmanaged devices cannot be compliant. The question's answer is flawed; the correct control is 'Require device to be marked as compliant' is not the right answer for unmanaged devices. The intended correct answer is likely 'Require device to be marked as compliant' but that only works for managed devices. The actual correct grant control for unmanaged devices is none of these; you would use a session control. Given the options, the closest is B, but it is technically incorrect for unmanaged devices.

Answer

Require multi-factor authentication

Answer

Require approved client app

Answer

Require hybrid Azure AD joined device

Question 15

Which TWO of the following are best practices for securing Microsoft 365 tenants? (Choose two.)

Accepted Answer

Enable security defaults in Microsoft Entra ID. Enabling security defaults provides a baseline of security. Using Conditional Access policies allows granular access control. These are best practices. Disabling modern authentication is counterproductive. Allowing all external sharing is risky. Using basic authentication is insecure. So the correct two are A and B.

Answer

Enable basic authentication for all apps

Answer

Disable modern authentication for legacy protocols

Answer

Allow all external sharing in SharePoint