SC-100 Practice Test 12 — 15 Questions

Question 1

Your organization uses Microsoft Intune for mobile device management. You need to configure a compliance policy for iOS devices that requires the device to be jailbreak-detected and have a minimum OS version. Which two settings should you configure in the compliance policy? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Minimum OS version. B is correct because the compliance policy must specify a minimum OS version to ensure iOS devices meet the required security baseline, preventing outdated devices with known vulnerabilities from accessing corporate resources. D is correct because jailbreak detection is a specific compliance setting that identifies compromised devices, which are a significant security risk as they bypass iOS security controls.

Answer

Require passcode

Answer

Device encryption

Question 2

A company, Fabrikam, has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. They have implemented a Zero Trust strategy that includes requiring multi-factor authentication (MFA) for all users accessing cloud applications. They use Conditional Access policies to enforce MFA. Recently, they noticed that users who authenticate from the on-premises network are not being prompted for MFA when accessing cloud apps, even though the Conditional Access policy is configured to require MFA for all users. The network location is not excluded in the policy. The Conditional Access policy is enabled and in 'Enforce' mode. The users' devices are not domain-joined. What is the most likely reason for this behavior?

Accepted Answer

Users are using legacy authentication protocols that do not support MFA. The most likely reason is that users are using legacy authentication protocols (e.g., POP3, IMAP, SMTP, or older Office clients) that do not support modern authentication and thus cannot enforce MFA via Conditional Access. Even though the policy requires MFA, legacy protocols bypass the Conditional Access engine entirely, allowing authentication without MFA prompts.

Answer

Azure AD Connect is not configured for Pass-through Authentication

Answer

The Conditional Access policy does not include session controls

Answer

The Conditional Access policy is not targeting the correct user group

Question 3

Your company uses Microsoft Defender for Cloud Apps to protect its SaaS environment. You need to configure settings to detect and block risky user activities. Which TWO actions should you take? (Choose TWO.)

Accepted Answer

Configure anomaly detection policies.. Options C and E are correct. Configuring anomaly detection policies (Option C) helps identify unusual user behaviors that may indicate a security threat. Enabling session monitoring for critical applications (Option E) allows real-time monitoring and control of user activities, which can block risky actions as they occur. Option A is incorrect because blocking all third-party app access is overly restrictive and not a targeted measure for detecting risky user activities. Option B is incorrect because defining IP address ranges for trusted locations is for location-based policies, not for detecting risky behaviors. Option D is incorrect because app discovery policies are used to discover shadow IT, not to monitor or block risky user activities.

Answer

Block all third-party app access.

Answer

Define IP address ranges for trusted locations.

Answer

Configure app discovery policies.

Question 4

Your company has a Microsoft 365 E5 subscription and uses Microsoft Defender for Office 365. You need to protect users from phishing attacks that use malicious links in email messages. The solution should allow users to report suspicious emails to the security team for analysis. You also want to automatically block repeated phishing attempts from the same sender. What should you configure?

Accepted Answer

Configure Safe Links policies and enable the Report Message add-in for user reporting.. Safe Links protects users from clicking malicious links in real time, and the user reporting add-in allows reporting. Attack simulation training helps educate users but is not the primary protection mechanism. Option A is wrong because only the reporting add-in does not protect against links. Option C is wrong because Safe Attachments protects attachments, not links. Option D is wrong because configuring a mailbox for submissions and enabling the Report Message add-in allows reporting but does not block malicious links; Safe Links is required for URL protection.

Answer

Configure anti-spam policies and enable the Report Message add-in.

Answer

Configure Safe Attachments policies and enable the Report Message add-in.

Answer

Enable the Report Message add-in for Outlook and configure a mailbox for submissions.

Question 5

Your organization is implementing a secure DevOps pipeline for Azure. You need to ensure that secrets (e.g., API keys) are not stored in source code and that access to production resources is controlled. Which THREE practices should you implement?

Accepted Answer

Use Azure Key Vault to store secrets and retrieve them at deployment time. The correct answers are B, C, and E. Azure Key Vault is the recommended service for storing secrets securely. Using Azure DevOps variable groups linked to Key Vault allows secrets to be referenced without exposing them in pipeline code. Managed identities provide a secure way for Azure resources to authenticate to Key Vault without storing credentials. Option A is incorrect because storing secrets in Azure DevOps pipeline variables with encryption is less secure than using Key Vault, as secrets may still be exposed in logs or exportable. Option D is incorrect because storing secrets in a configuration file in a private Git repository is insecure; even if encrypted, the key management is challenging and secrets can be accidentally exposed.

Answer

Store secrets in Azure DevOps pipeline variables with encryption enabled

Answer

Store secrets in a configuration file in a private Git repository

Question 6

Wide World Importers is deploying a critical line-of-business application on Azure Kubernetes Service (AKS). The application processes financial transactions and must meet SOX compliance. You need to design a security solution that includes: encryption of secrets (e.g., database connection strings) using Azure Key Vault, automatic certificate rotation for TLS termination, network isolation of the AKS cluster, and audit logging of all access to secrets. The solution should use a managed identity for the AKS cluster to access Key Vault. Which of the following designs meets the requirements?

Accepted Answer

Enable managed identity for the AKS cluster, integrate Key Vault with AKS using the Secrets Store CSI driver, deploy the cluster as a private cluster, and enable diagnostic settings on Key Vault to send logs to a Log Analytics workspace.. It uses managed identity for secure secret access, integrates Key Vault with AKS using the Secrets Store CSI driver for automatic secret rotation and encryption, deploys the cluster as a private cluster for network isolation, and enables diagnostic settings on Key Vault for audit logging. Option B is wrong because it uses a service principal (less secure than managed identity) and stores secrets as Kubernetes secrets (not encrypted at rest by default). Option C is wrong because it stores secrets in native Kubernetes secrets instead of Key Vault, and uses a private endpoint only for the API server, not full cluster isolation. Option D is wrong because it uses a service principal and stores secrets as encrypted Kubernetes secrets with a customer-managed key, which is not as secure as Key Vault integration, and uses a public cluster.

Answer

Use a service principal for AKS to access Key Vault, store secrets as Kubernetes secrets, configure a private cluster, and enable audit logging on Key Vault.

Answer

Enable managed identity for the AKS cluster, store secrets in the cluster's native Kubernetes secrets, use a private endpoint for the AKS API server, and enable Azure Monitor for containers.

Answer

Use a service principal to access Key Vault, store secrets as encrypted Kubernetes secrets with a customer-managed key, deploy a public cluster with network policies, and enable Key Vault logging.

Question 7

A company wants to secure its Azure Kubernetes Service (AKS) cluster. They need to ensure that pods cannot communicate with each other unless explicitly allowed, and that secrets are encrypted at rest. Which TWO security controls should they implement?

Accepted Answer

Use Azure Key Vault with Secrets Store CSI driver for secret management.. Correct answers: A and C. Network policies in Kubernetes can restrict pod-to-pod communication, and Azure Key Vault with CSI driver allows secrets to be encrypted and stored externally. Option B is incorrect: Azure Policy can enforce image source restrictions, but that does not address pod communication or secret encryption. Option D is incorrect: Container insights is for monitoring, not for network restrictions or encryption. Option E is incorrect: Azure AD integration is for authentication, not for network or encryption.

Answer

Apply Azure Policy to restrict container image sources.

Answer

Enable Container insights for monitoring.

Answer

Enable Azure AD integration for the AKS cluster.

Question 8

Your organization is deploying a new line-of-business application on Azure App Service. The app must authenticate users from Microsoft Entra ID and also access a downstream API that requires a client secret. You need to recommend the most secure method for managing the client secret. What should you use?

Accepted Answer

Store the secret in Azure Key Vault and use a Key Vault reference in App Service.. Azure Key Vault provides secure storage for secrets and certificates, and App Service can reference them via managed identity or Key Vault references. Option A is wrong because the Azure AD app registration manifest is for application configuration and should not be used to store secrets; instead, use the 'Certificates & secrets' section. Option B is wrong because App Service application settings are less secure and can be accessed through the portal, lacking the fine-grained access control and auditing of Key Vault. Option D is wrong because storing the secret in code exposes it to source control and accidental disclosure.

Answer

Store the secret in the Azure AD app registration manifest.

Answer

Store the secret in an App Service application setting.

Answer

Store the secret in the application code as a constant.

Question 9

A financial services company is deploying a new application on Azure Kubernetes Service (AKS). The application must meet PCI DSS compliance requirements, which mandate encryption of data at rest and in transit, as well as network segmentation. The application will use Azure SQL Database. What is the MOST secure approach to meet these requirements?

Accepted Answer

Use Azure Policy to enforce encryption and network policies in AKS, and enable TDE and Always Encrypted for Azure SQL Database.. It leverages Azure Policy to enforce encryption and network policies at the cluster level, while Azure SQL Database's TDE and Always Encrypted provide encryption at rest and in transit. This combination meets PCI DSS requirements for data encryption and network segmentation in AKS. Option A is wrong because App Service Environment is not used for AKS; the question specifies AKS. Option B is wrong because Service Endpoints do not encrypt traffic and provide limited segmentation compared to private endpoints. Option C is wrong because Azure Firewall is a network firewall and does not enforce encryption or network policies within the AKS cluster.

Answer

Deploy the application in an Azure App Service Environment (ASE) with a private endpoint and enable SQL Server encryption.

Answer

Use Azure Service Endpoints for the AKS cluster and enable Transparent Data Encryption (TDE) on Azure SQL Database.

Answer

Deploy Azure Firewall in front of the AKS cluster and enable SSL/TLS termination at the firewall for all incoming traffic.

Question 10

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is enabled but users who are detected as high risk are still able to sign in. What is the most likely reason?

Accepted Answer

No users or groups are assigned to the policy. A Conditional Access policy must have at least one user or group assigned to it to be evaluated. If no users or groups are assigned, the policy is effectively inactive, even if enabled. In this scenario, the policy is enabled but not applied to any identities, so high-risk users are not subject to its controls.

Answer

The policy state is set to 'enabled' but not 'enforced'

Answer

The user risk level is set to 'high' but sign-in risk is 'medium'

Answer

The grant control is set to 'block' but should be 'require MFA'

Question 11

A company is designing a secure API for a customer-facing application that will handle sensitive personal data. They need to ensure that only authorized client applications can call the API and that the identity of the end-user is verified. Which of the following should they implement?

Accepted Answer

OAuth 2.0 with client credentials and OpenID Connect. OAuth 2.0 with client credentials grant authenticates the client application, while OpenID Connect extends OAuth 2.0 to verify the end-user's identity. Together, they satisfy both requirements: only authorized clients can call the API and the end-user's identity is confirmed. Option A (HTTP Basic Authentication) transmits credentials in plaintext and does not support user identity verification beyond the client. Option C (JWT bearer tokens) is a token format, not a full authentication protocol; it lacks client authentication and user verification on its own. Option D (API keys) only authenticate the client, not the user, and are typically used for simple access control.

Answer

HTTP Basic Authentication

Answer

JWT bearer tokens

Answer

API keys

Question 12

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

To identify accounts with multiple failed logon attempts from a single IP.. The query uses the `SecurityEvent` table and filters for `EventID == 4625`, which indicates a failed logon attempt. By summarizing `count()` by `IPAddress` and `Account` and filtering for `FailedAttempts > 5`, the query identifies accounts with multiple failed logon attempts from a single IP address. This is typical for detecting brute-force or password-spray attacks, making option A correct.

Answer

To list all successful logon events in the last 7 days.

Answer

To calculate the total number of failed logons per hour.

Answer

To detect account lockout events.

Question 13

Your organization uses Azure DevOps for CI/CD. You need to ensure that secrets (e.g., API keys) used in pipeline tasks are securely stored and accessed. The security requirements are: secrets must be encrypted at rest, access must be audited, and secrets must be automatically rotated. Which THREE services or features should you use? (Choose three.)

Accepted Answer

Azure Key Vault access policy to grant permissions.. Azure Key Vault (C) securely stores secrets with encryption at rest and supports auditing via access logs. Access policies (A) grant granular permissions to users or applications, enabling audited access. Key rotation policy (E) allows automatic rotation of secrets, meeting the rotation requirement. While Azure DevOps Variable Groups can store secrets, they lack built-in encryption at rest and rotation capabilities, so B is incorrect. Azure AD service principals are identities, not a secret store, so D is incorrect. Therefore, the three correct choices are A, C, and E.

Answer

Azure DevOps Variable Groups to store secrets.

Answer

Azure Active Directory service principal to access secrets.

Question 14

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that allows external partners to access a specific application using their own identity providers, while ensuring that their accounts are automatically deprovisioned when removed from their home organization. Which feature should you use?

Accepted Answer

Entitlement management with connected organizations. Entitlement management with connected organizations allows automatic provisioning and deprovisioning of external users based on their lifecycle in the partner organization. Option A is wrong because B2B direct federation only enables authentication without automatic deprovisioning. Option C is wrong because self-service sign-up does not manage deprovisioning. Option D is wrong because Identity Governance access reviews are periodic and do not automatically deprovision based on removal from the home organization.

Answer

B2B direct federation

Answer

Self-service sign-up

Answer

Identity Governance access reviews

Question 15

A company is migrating a legacy on-premises application to Azure. The application currently uses Windows Integrated Authentication (Kerberos) and requires access to a SQL Server database on the same network. In Azure, the application will run on Azure Virtual Machines and the database will be migrated to Azure SQL Managed Instance. You need to ensure the application can authenticate to the database without storing credentials. What should you implement?

Accepted Answer

Join the virtual machine to an Azure AD Domain Services domain and configure the application to use Azure AD Kerberos authentication.. Azure SQL Managed Instance supports Azure AD authentication. By joining the VM to an Azure AD Domain Services domain and using Azure AD Kerberos authentication, the application can use Windows Integrated Authentication to connect to the managed instance without storing credentials. This preserves the existing Kerberos-based authentication flow. Option C is correct. Key Vault is unnecessary because credentials are not stored. SQL authentication requires explicit credentials. Service principal authentication is not compatible with Kerberos integrated authentication.

Answer

Store the database credentials in Azure Key Vault and retrieve them at runtime.

Answer

Use SQL authentication with a contained database user.

Answer

Create a service principal in Azure AD and grant it access to the database.