SC-100 Practice Test 11 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an ARM template for an Azure storage account. Which security best practice is implemented?

Accepted Answer

Deny all network traffic by default. The ARM template snippet shows the 'defaultAction' property set to 'Deny' under 'networkAcls', which explicitly denies all network traffic by default. This is a security best practice because it implements a zero-trust network model, ensuring that only explicitly allowed traffic (via IP rules or virtual network rules) can access the storage account. Option C correctly identifies this as the default deny behavior.

Answer

Enforce HTTPS traffic only

Answer

Restrict network access by IP address

Answer

Enable soft delete for blobs

Question 2

A financial services organization is designing a zero-trust architecture for its Azure environment. They need to ensure that all administrative access to critical systems uses just-in-time (JIT) access and that privileged role assignments are time-bound. Which combination of Microsoft security best practices should they implement?

Accepted Answer

Azure AD Privileged Identity Management (PIM) and Azure Bastion. Azure AD Privileged Identity Management (PIM) provides just-in-time (JIT) activation and time-bound role assignments for privileged roles, directly meeting the requirement for time-bound administrative access. Azure Bastion enables secure, audited RDP/SSH access to Azure VMs without exposing public IP addresses, ensuring that administrative sessions are isolated and monitored. Together, they enforce zero-trust principles by granting ephemeral, scoped access to critical systems.

Answer

Azure AD Conditional Access and Azure AD Identity Protection

Answer

Azure Policy and Azure Blueprints

Answer

Azure Sentinel and Azure Workbook

Question 3

A company is adopting Microsoft Purview for data security. They need to prevent users from sharing sensitive data like credit card numbers via email. Which feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers, through email and other channels. By configuring a DLP policy with a rule that scans for credit card number patterns (using predefined or custom sensitive info types), the system can block, quarantine, or notify users when such data is sent via Exchange Online. This directly addresses the requirement to prevent sharing sensitive data via email.

Answer

Audit log search

Answer

Insider Risk Management policy

Answer

Sensitivity labels

Question 4

You are designing a compliance solution for your organization that must enforce retention policies for documents stored in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it is specifically designed to enforce retention policies for documents in SharePoint Online. It allows you to apply retention labels and policies that automatically retain or delete content based on compliance requirements, without user intervention.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Insider Risk Management

Question 5

Which THREE components are required to implement a secure hybrid network with Azure using a site-to-site VPN?

Accepted Answer

Public IP address for the VPN device. To implement a secure hybrid network with Azure using a site-to-site VPN, three components are required: a virtual network gateway (which provides the VPN termination), a local network gateway (which represents the on-premises network), and a public IP address (which is assigned to the virtual network gateway to enable communication over the internet). The VPN gateway (option C) is not a separate component; it is a type of virtual network gateway. An ExpressRoute circuit (option B) is for dedicated private connections, not VPN.

Answer

ExpressRoute circuit

Answer

VPN gateway (route-based)

Question 6

Refer to the exhibit. A security architect reviews the Azure AD Conditional Access policy JSON. The policy is intended to require MFA for all users accessing Azure management (Microsoft Azure Management app ID 797f4846-ba77-4853-9e6f-4433c3e1d1c5), except for the BreakGlassAdmin account and from trusted locations. However, some users report being prompted for MFA even when connecting from the corporate office (which is marked as a trusted location). What is the most likely cause?

Accepted Answer

The corporate office location is not correctly defined as a trusted location in Azure AD. The policy is designed to require MFA for all users accessing Azure management, except for the BreakGlassAdmin account and from trusted locations. If the corporate office location is not correctly defined as a trusted location in Azure AD, the Conditional Access policy will not recognize it as an exception, and users connecting from that location will still be prompted for MFA. This mismatch between the intended trusted location definition and the actual location configuration is the most likely cause of the unexpected MFA prompts.

Answer

The grant controls operator is set to 'OR' instead of 'AND'

Answer

The policy is in 'Report-only' mode

Answer

The policy applies to all cloud apps, not just Azure management

Question 7

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. What is the effect of this policy?

Accepted Answer

Blocks sign-ins from users with high user risk. The policy JSON specifies `"userRiskLevels": ["high"]` under the conditions block, which means it targets only users whose user risk level is assessed as high by Microsoft Entra ID Protection. The grant control is set to `"builtInControls": ["block"]`, so the policy blocks sign-ins for those high-risk users. Option B is correct because the policy explicitly blocks sign-ins from users with high user risk, not sign-in risk or all users.

Answer

Blocks sign-ins from locations with high sign-in risk

Answer

Blocks all sign-ins from any user

Answer

Requires multifactor authentication for high-risk users

Question 8

You are designing an incident response plan for a company using Microsoft Defender XDR. The team needs to automatically notify the SOC via email when an incident of high severity is created. What should you use?

Accepted Answer

Configure an automation rule with an action to send an email notification.. Automation rules in Microsoft Defender XDR are specifically designed to trigger automated actions—including sending email notifications—when an incident is created or updated. Unlike playbooks, automation rules can directly send email without requiring a Logic Apps connector, and they operate natively within the Defender portal's incident lifecycle.

Answer

Modify the analytics rule to send an email when an alert fires.

Answer

Create a playbook that sends an email when an incident is created.

Answer

Use advanced hunting to query high severity incidents and send email.

Question 9

Your organization is a multi-national corporation that uses Microsoft 365 E5 and Azure. You need to design a security operations center (SOC) to detect and respond to threats across identities, endpoints, and cloud apps. The SOC team will use a single pane of glass for incident management. Requirements: (1) Centralize alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps, (2) Automate incident response playbooks, (3) Use advanced hunting across all data sources, (4) Integrate with external threat intelligence feeds, (5) Provide role-based access control for SOC analysts. Which Microsoft solution should you implement?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is a cloud-native SIEM/SOAR that ingests alerts from all Microsoft Defender products, supports automation playbooks, advanced hunting via KQL, threat intelligence connectors, and RBAC. Option A is wrong because the Microsoft 365 Defender portal provides visibility across Defender products but lacks the full SIEM/SOAR capabilities needed for automation, advanced hunting, and external threat intelligence integration. Option C is wrong because Microsoft Purview Compliance Manager is a data governance and compliance solution, not a security operations platform. Option D is wrong because Microsoft Defender for Cloud is a cloud workload protection platform (CWPP) that does not serve as a unified SIEM across identities, endpoints, and apps.

Answer

Microsoft 365 Defender portal

Answer

Microsoft Purview Compliance Manager

Answer

Microsoft Defender for Cloud

Question 10

Adventure Works is a startup that uses Microsoft 365 Business Premium. They have 20 employees and no cloud expertise. The CEO has been hearing about ransomware attacks on small businesses. They want to implement basic protection against ransomware using built-in Microsoft 365 features. They also want to ensure they can recover from an attack quickly. What should you recommend?

Accepted Answer

Enable Microsoft Defender for Office 365 to block malicious attachments and links. Configure Microsoft Defender for Business to enable controlled folder access and ransomware protection. Educate users on phishing. Use OneDrive Files Restore to recover from ransomware.. It leverages built-in Microsoft 365 Business Premium features to provide immediate ransomware protection without requiring cloud expertise. Microsoft Defender for Office 365 blocks malicious attachments and links at the email gateway, while Defender for Business provides endpoint protection with controlled folder access. OneDrive Files Restore enables self-service recovery of files from ransomware within the last 30 days, aligning with the startup's need for quick recovery without additional infrastructure.

Answer

Purchase Azure Backup for all user devices. Configure backup policies to run daily. Use Microsoft Intune to enforce encryption. Implement Conditional Access to require MFA.

Answer

Use Microsoft Sentinel as a SIEM to detect ransomware patterns. Deploy Azure ATP for identity protection. Use Azure Policy to enforce backup.

Answer

Implement Azure Site Recovery for on-premises servers. Use Microsoft Defender for Cloud for threat detection. Deploy a third-party antivirus.

Question 11

Your company uses Microsoft Purview to protect sensitive data. You need to automatically apply a retention label to documents containing credit card numbers detected in SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy for retention labels targeting sensitive info types.. Auto-labeling policies in Microsoft Purview can automatically apply retention labels to documents based on sensitive info types, such as credit card numbers. This allows you to enforce retention rules without manual intervention, directly targeting the detected sensitive data in SharePoint Online.

Answer

Configure a Data Loss Prevention (DLP) policy to apply the label.

Answer

Create a sensitivity label with auto-labeling for SharePoint.

Answer

Use a trainable classifier to detect credit card numbers and apply the label.

Question 12

Your organization is designing a hybrid identity infrastructure with Microsoft Entra ID. You need to ensure that users can access on-premises applications using passwordless authentication and that the solution minimizes latency for authentication requests. What should you implement?

Accepted Answer

Use Microsoft Entra application proxy to publish the on-premises applications and enable passwordless authentication.. Microsoft Entra application proxy provides secure remote access to on-premises web applications by publishing them through the Microsoft Entra ID service. It allows users to authenticate using passwordless methods (e.g., Windows Hello, FIDO2, Microsoft Authenticator) and minimizes latency by proxying requests through Microsoft's infrastructure without requiring a VPN. Option A is incorrect because Microsoft Entra Domain Services is for domain-joined VMs, not for publishing applications. Option C is incorrect because Web Application Proxy is a legacy on-premises component that does not integrate with passwordless authentication and lacks the software-defined perimeter capabilities of Entra application proxy. Option D is incorrect because VPNs introduce latency and do not inherently support passwordless authentication.

Answer

Join the on-premises servers to Microsoft Entra Domain Services and use passwordless authentication.

Answer

Install Web Application Proxy (WAP) on-premises and integrate with Microsoft Entra ID for passwordless.

Answer

Deploy a VPN and use Microsoft Entra ID with passwordless sign-in.

Question 13

You are a security architect for a global financial services company. The company is adopting Microsoft Sentinel as its primary SIEM and Microsoft Defender XDR for endpoint, email, and identity protection. The company has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. The SOC team needs to be able to investigate incidents that involve lateral movement between on-premises and cloud resources. Additionally, the company must comply with GDPR, requiring that personal data be protected and that data residency requirements are met: all security logs for EU users must remain within the EU. The company already has a Microsoft Sentinel workspace in the West Europe region. You need to design a solution that meets these requirements while minimizing administrative overhead. What should you do?

Accepted Answer

Use the existing West Europe Sentinel workspace and ensure that all EU user logs are sent to that workspace via diagnostic settings.. A single Microsoft Sentinel workspace in West Europe can collect logs from multiple regions via diagnostic settings, satisfying GDPR data residency by keeping EU logs within the EU. This minimizes administrative overhead. Option A is incorrect because Azure Arc does not address data residency and adds unnecessary complexity. Option C is incorrect because creating a separate workspace increases overhead without benefit, as the existing workspace meets requirements. Option D is incorrect because per-region workspaces greatly increase administrative overhead.

Answer

Deploy Azure Arc on on-premises servers and use Azure Policy to enforce log collection to the West Europe workspace.

Answer

Create a new Sentinel workspace in the EU region for EU logs and a separate workspace for non-EU logs.

Answer

Deploy a separate Sentinel workspace in each region where you have users.

Question 14

A company is designing a data classification strategy using Microsoft Purview. They need to automatically classify and protect sensitive data stored in Azure Blob Storage. Which TWO capabilities should they use? (Choose TWO.)

Accepted Answer

Sensitivity labels. The correct options are A and D. Sensitivity labels (A) can be applied to automatically classify and protect sensitive data, including in Azure Blob Storage. Microsoft Purview Data Map (D) provides auto-discovery and classification of data assets. Option B (DLP policies) is primarily for endpoint and Microsoft 365 workloads, not for Azure Blob. Option C (Information Barriers) is for restricting communication, not data classification. Option E (Azure Policy) is for governance, not data classification or protection.

Answer

Data Loss Prevention (DLP) policies

Answer

Information Barriers

Answer

Azure Policy

Question 15

A company is implementing Microsoft Priva to manage subject rights requests. Users submit requests to access their personal data stored in Exchange Online, SharePoint, and Teams. The privacy team needs to automate the retrieval of data from these sources. Which Priva capability should they use?

Accepted Answer

Subject Rights Requests. Priva Subject Rights Requests includes built-in data retrieval from Microsoft 365 sources to fulfill subject rights requests. Option C is incorrect because Data Inventory scans and maps personal data but does not retrieve data for requests. Option B is incorrect because Consent Management handles consent records, not data retrieval. Option D is incorrect because Data Breach Notifications are for incident response, not subject rights requests.

Answer

Consent Management

Answer

Data Inventory

Answer

Data Breach Notifications