SC-100 Practice Test 11 — 15 Questions

Question 1

A company wants to implement a Zero Trust security model. Which TWO principles are fundamental to Zero Trust? (Choose two.)

Accepted Answer

Verify explicitly.. Option A (Verify explicitly) is correct because Zero Trust requires every access request to be authenticated and authorized based on all available data points—user identity, device health, location, and resource sensitivity—rather than granting implicit trust based on network location. Option E (Assume breach) is correct because Zero Trust operates on the principle that threats may already exist inside the environment, so organizations must minimize blast radius, segment access, encrypt traffic end-to-end, and use analytics to detect and respond to anomalies. Option B (Use perimeter-based security) is incorrect because Zero Trust explicitly rejects the castle-and-moat perimeter model in favor of identity-centric controls that follow the user and device. Option C (Trust internal network) is incorrect because Zero Trust assumes no implicit trust for traffic originating from the corporate LAN or VPN. Option D (Trust but verify) is incorrect because it implies initial trust is granted before verification, which contradicts Zero Trust's requirement to verify every request explicitly and continuously.

Answer

Use perimeter-based security.

Answer

Trust internal network.

Answer

Trust but verify.

Question 2

You are a security architect for a global financial services company that uses Microsoft 365 E5 and Azure. The company has 50,000 users across 10 regions. The security team needs to detect and respond to identity-based threats in real-time, automate remediation for compromised accounts, and meet regulatory requirements for audit logging. The following requirements must be met: (1) Detect risky sign-ins and user anomalies, (2) Automatically block sign-ins when risk level is high, (3) Provide a centralized dashboard for security analysts to investigate incidents, (4) Retain logs for at least one year for compliance, (5) Minimize false positives by using machine learning. You have the following services available: Microsoft Entra ID P2, Microsoft Sentinel, Microsoft Defender for Identity, Microsoft Purview, and Microsoft Intune. Which combination of services should you use to meet all requirements?

Accepted Answer

Microsoft Entra ID Protection (P2) and Microsoft Sentinel. Microsoft Entra ID Protection (P2) provides the risk-based sign-in and user risk detections powered by machine learning, and its Conditional Access integration can automatically block sign-ins when risk is high, satisfying requirements 1, 2, and 5. Microsoft Sentinel supplies the centralized SIEM dashboard for analysts to investigate incidents and supports long-term log retention (including one-year retention via the data lake or workspace retention settings), covering requirements 3 and 4. Together, option B meets all five requirements. Option A is wrong because Intune handles device management and Defender for Cloud covers cloud workload protection, not identity risk detection or SIEM. Option C is wrong because Defender for Identity monitors on-premises Active Directory signals and Purview handles data governance/compliance, not real-time sign-in risk blocking. Option D is wrong because Purview does not perform identity risk detection or automated sign-in remediation.

Answer

Microsoft Intune and Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity and Microsoft Purview

Answer

Microsoft Purview and Microsoft Sentinel

Question 3

Your organization uses Microsoft Defender for Identity (MDI) to protect on-premises Active Directory. You need to integrate MDI with Microsoft Sentinel to centralize detection and response. What is the required configuration?

Accepted Answer

Enable the Microsoft Defender for Identity data connector in Microsoft Sentinel.. The correct option is C: enabling the Microsoft Defender for Identity data connector in Microsoft Sentinel. MDI integrates with Sentinel through a built-in data connector that streams MDI alerts and related identity events into the Sentinel workspace, allowing centralized detection and response without extra infrastructure. Option A is unnecessary because the MDI sensor is deployed on domain controllers or AD FS servers, not Azure VMs, and the sensor does not send data directly to Sentinel. Option B is incorrect because Entra ID Protection covers cloud identity risk, not on-premises AD signals from MDI. Option D is incorrect because MDI does not natively forward to Syslog for Sentinel ingestion; the supported path is the MDI data connector.

Answer

Deploy the MDI sensor on an Azure VM to send data to Sentinel.

Answer

Integrate Microsoft Entra ID Protection with Sentinel instead.

Answer

Configure MDI to forward logs to a Syslog server, then use the Syslog connector in Sentinel.

Question 4

Your organization is deploying Microsoft Copilot for Security and wants to ensure that the AI model does not expose sensitive data in its responses. You need to configure data loss prevention (DLP) policies that apply to Copilot interactions. Which Microsoft Purview capability should you use?

Accepted Answer

Data Loss Prevention policies. Microsoft Purview Data Loss Prevention (DLP) policies for Copilot are designed to prevent sensitive data from being exposed in AI interactions. These policies can scan prompts and responses for sensitive information and take actions like blocking or alerting. Communication Compliance (Option D) is intended for monitoring communications, such as emails and Teams messages, but not specifically for DLP in AI interactions. Therefore, DLP policies are the correct capability for this requirement.

Answer

eDiscovery

Answer

Information Protection and sensitivity labels

Answer

Communication Compliance

Question 5

Which THREE capabilities does Microsoft Purview provide for compliance management?

Accepted Answer

Information protection with sensitivity labels. Microsoft Purview provides compliance management capabilities including information protection with sensitivity labels, which allow organizations to classify and protect sensitive data across Microsoft 365 services, endpoints, and third-party apps. Sensitivity labels enforce encryption, visual markings, and access restrictions based on policy, directly supporting data loss prevention and governance.

Answer

Identity protection and risk detection

Answer

Endpoint detection and response

Question 6

You are designing a secure DevOps pipeline using GitHub Actions and Azure. The security team requires that all container images pushed to Azure Container Registry (ACR) are scanned for vulnerabilities before deployment. If critical vulnerabilities are found, the pipeline must fail. What should you integrate into the pipeline?

Accepted Answer

Integrate Microsoft Defender for Cloud with Azure Container Registry scanning and configure a GitHub Actions step to check scan results. Option B is correct because Microsoft Defender for Cloud's container registry scanning (Defender for Containers) integrates natively with ACR to scan images on push, and a GitHub Actions step can query the scan results via the Azure CLI/REST API and fail the pipeline when critical vulnerabilities are detected. This directly satisfies the requirement to block deployment when critical findings exist. Option A does not fit because Azure Policy enforces governance on deployed resources and cannot fail a GitHub Actions build step based on scan results. Option C is wrong because Azure Bastion is a managed jump-host service for RDP/SSH access, not an image scanner. Option D is wrong because Azure Security Center is the legacy name for Defender for Cloud and, by itself, does not provide the pipeline-failing GitHub Actions integration described in B.

Answer

Configure Azure Policy to require image scanning before deployment

Answer

Deploy Azure Bastion to scan images during build

Answer

Use Azure Security Center (legacy) to scan images on push

Question 7

Your organization uses Microsoft Defender for Cloud to secure a hybrid environment. You need to ensure that virtual machines running on-premises are assessed for security misconfigurations. What should you deploy?

Accepted Answer

Azure Arc on the on-premises servers. Azure Arc on the on-premises servers (option C) is correct because Azure Arc projects non-Azure machines into Azure as connected machine resources, which is the prerequisite for Defender for Cloud to assess on-premises VMs for security misconfigurations via the Azure Monitor Agent and its recommendations. Without Arc-enabling the servers, Defender for Cloud cannot treat them as supported compute resources for misconfiguration assessment. Option A (Log Analytics agent) only collects log/telemetry data and does not by itself enable Defender for Cloud's security posture assessment of on-premises machines. Option B (Vulnerability Assessment solution) addresses CVE scanning rather than general security misconfiguration assessment, and it also depends on the machine already being onboarded. Option D (Azure Policy guest configuration) audits settings inside Azure VMs and Arc-enabled machines but is not the deployment that enables Defender for Cloud assessment of on-premises servers.

Answer

Log Analytics agent on the on-premises servers

Answer

Microsoft Defender for Cloud's Vulnerability Assessment solution

Answer

Azure Policy guest configuration

Question 8

A company wants to implement hybrid identity with Microsoft Entra ID. Which TWO components are required for password hash synchronization? (Choose two.)

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect (option A) is required because it is the on-premises synchronization tool that connects Active Directory Domain Services to Microsoft Entra ID and performs the directory synchronization and sign-in method configuration. The password hash synchronization feature enabled in Entra Connect (option C) is also required, since password hash synchronization is a sign-in option that must be explicitly selected and configured within Entra Connect for on-premises password hashes to be synchronized to Entra ID. Microsoft Entra Domain Services (option B) is a managed domain service for legacy protocols and does not perform password hash synchronization from on-premises AD. Microsoft Entra ID Protection (option D) provides risk detection and Conditional Access signals, not directory synchronization. Microsoft Entra application proxy (option E) publishes on-premises web applications remotely and is unrelated to password hash synchronization.

Answer

Microsoft Entra Domain Services

Answer

Microsoft Entra ID Protection

Answer

Azure AD Application Proxy

Question 9

Your organization uses Microsoft Sentinel for security operations. You need to ensure that incident investigations automatically enrich alerts with relevant user and device information from Microsoft Defender XDR and Microsoft Entra ID. What should you configure?

Accepted Answer

Enable User and Entity Behavior Analytics (UEBA) and configure entity behavior settings.. The correct option is D: enabling User and Entity Behavior Analytics (UEBA) and configuring entity behavior settings. In Microsoft Sentinel, UEBA ingests and correlates user and device entity data from sources such as Microsoft Defender XDR and Microsoft Entra ID, building behavior profiles and enriching incidents with entity insights (e.g., user, host, IP) that investigators see on the incident page. Option A is wrong because Fusion detection correlates multistage attack signals into incidents but does not enrich them with user/device context. Option B is wrong because watchlists are custom reference lists used for matching in analytics rules, not automatic enrichment from Defender XDR/Entra ID. Option C is wrong because automation rules and playbooks execute response actions, not entity enrichment of incidents.

Answer

Enable Fusion detection for multistage attacks.

Answer

Create watchlists for user and device information and reference them in analytics rules.

Answer

Configure automation rules to trigger a playbook on alert creation.

Question 10

Your company has an Azure subscription that contains multiple virtual machines (VMs) running Windows Server. You need to ensure that all VMs are compliant with your organization's security baseline. The security baseline includes specific registry key settings, password policies, and service configurations. You want to continuously monitor and automatically remediate non-compliant VMs. What should you implement?

Accepted Answer

Use Azure Policy with Guest Configuration extension to audit and remediate the VM settings.. Azure Policy with the Guest Configuration extension is the correct choice because it is designed to audit and remediate OS-level settings inside Azure VMs, including registry keys, password policies, and service configurations, using built-in or custom guest configuration packages. It continuously evaluates compliance and supports remediation tasks (DeployIfNotExists) to automatically bring non-compliant VMs back into the baseline. Azure Automation State Configuration (option A) can apply DSC, but it is a legacy approach and does not provide the same policy-driven continuous compliance and automatic remediation integration as Azure Policy Guest Configuration. Azure Update Manager (option C) only handles OS and software patching, not security baseline settings, and Microsoft Defender for Cloud (option D) provides recommendations and alerts but does not automatically remediate these specific configuration items by itself.

Answer

Deploy Azure Automation State Configuration to apply Desired State Configuration (DSC) to the VMs.

Answer

Use Azure Update Manager to ensure VMs are up to date.

Answer

Enable Microsoft Defender for Cloud and review the security recommendations.

Question 11

Your organization wants to use Microsoft Defender XDR to automatically investigate and respond to alerts. You need to ensure that the solution can autonomously remediate confirmed threats on endpoints, such as quarantining files and isolating devices. What should you enable?

Accepted Answer

Microsoft Defender for Endpoint. The correct option is C, Microsoft Defender for Endpoint, because it is the Microsoft Defender XDR workload that provides endpoint detection and response (EDR) capabilities, including automated investigation and response (AIR) that can autonomously quarantine files and isolate devices. Defender for Endpoint integrates with Defender XDR to trigger automated remediation actions on confirmed threats on endpoints. The other options do not provide endpoint remediation: Defender for Identity monitors identity signals, Defender for Cloud Apps governs cloud app usage, and Defender for Office 365 protects email and collaboration workloads, so none of them can isolate devices or quarantine endpoint files.

Answer

Microsoft Defender for Identity

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Office 365

Question 12

A company uses Microsoft Sentinel for security operations. They want to collect logs from a custom application running on Azure Virtual Machines. The application writes logs to a local file. Which data connector should they use?

Accepted Answer

Custom Logs via Log Analytics agent. The correct option is D, Custom Logs via Log Analytics agent, because Microsoft Sentinel can ingest arbitrary text-based log files from Azure VMs by installing the Log Analytics agent (MMA/AMA) and defining a custom log table that points to the local file path, which is exactly the scenario of a custom application writing to a local file. Application Insights (A) is an APM service for instrumented application telemetry, not for collecting pre-existing local log files from VMs. Syslog (B) only handles syslog-format messages from Linux/network devices, and Windows Event Forwarding (C) only collects Windows Event Log data, so neither fits a custom application's local log file.

Answer

Application Insights

Answer

Syslog

Answer

Windows Event Forwarding

Question 13

A company uses Azure Cosmos DB with Microsoft Defender for Cloud to protect its NoSQL database. The security team wants to audit all data plane operations for compliance. Which diagnostic setting should they enable?

Accepted Answer

DataPlaneRequests. The correct option is D, DataPlaneRequests. This diagnostic setting in Azure Cosmos DB logs all data plane operations, including CRUD actions on documents, which is exactly what the security team needs to audit for compliance. The other options do not fit: MongoRequests only captures requests for the MongoDB API, PartitionKeyStatistics provides metrics on partition key usage, and QueryRuntimeStatistics logs query execution details rather than a full audit of data plane operations.

Answer

MongoRequests

Answer

PartitionKeyStatistics

Answer

QueryRuntimeStatistics

Question 14

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts from compromised on-premises servers to Azure VMs. Which data connector should you prioritize?

Accepted Answer

Windows Security Events via AMA. Windows Security Events via AMA is the correct choice because lateral movement from compromised on-premises servers to Azure VMs is detected through Windows security event telemetry such as logon events (4624, 4625), explicit credential use (4648), and special privilege assignment (4672), which this connector collects from both on-premises and Azure Windows machines into Microsoft Sentinel. The Azure Monitor Agent (AMA) with the Windows Security Events data connector supports the hybrid, multi-cloud scope described, making it the priority connector for this detection scenario. Syslog via AMA is not appropriate because Syslog captures Linux/network appliance messages, not the Windows authentication events needed to trace lateral movement. Office 365 Logs cover cloud productivity audit activity, and Azure Activity Log records control-plane operations on Azure resources, neither of which provides the host-level Windows logon telemetry required here.

Answer

Syslog via AMA

Answer

Office 365 Logs

Answer

Azure Activity Log

Question 15

Your company uses Microsoft Intune to manage devices. You need to design a solution that prevents users from installing unauthorized applications on corporate Windows 10 devices. Which Intune policy should you configure?

Accepted Answer

Device restriction policy (Windows 10). A Device restriction policy (Windows 10), because this policy type includes settings that control app installation behavior on Windows 10 devices, such as blocking users from installing apps from untrusted sources or restricting Microsoft Store access. In Intune, device restriction policies are specifically designed to enforce hardware, software, and app-related restrictions on managed devices, making them the appropriate choice for preventing unauthorized application installations. A compliance policy (A) only evaluates and reports device state against conditions and can trigger conditional access, but it does not directly block app installation. An app protection policy (B) applies to mobile app management (MAM) for protecting corporate data within apps, not to blocking installation of unauthorized apps on Windows 10. A configuration policy using OMA-URI (D) can set custom CSP settings, but it is not the purpose-built policy for app installation restrictions that the device restriction policy provides.

Answer

Compliance policy

Answer

App protection policy (MAM)

Answer

Configuration policy (OMA-URI)