SC-100 Practice Test 13 — 15 Questions

Question 1

You are designing a secure infrastructure for an Azure Kubernetes Service (AKS) cluster that will host sensitive workloads. Which TWO configurations should you implement to secure the cluster?

Accepted Answer

Enable Azure AD integration for role-based access control (RBAC).. Option A is correct because enabling Microsoft Entra ID integration for RBAC ties Kubernetes authorization to Microsoft Entra ID identities and group memberships, so cluster access is centrally governed and auditable rather than relying on static client certificates or local accounts. Option D is correct because Microsoft Entra ID pod identity (now largely superseded by Azure Workload Identity) lets pods obtain Microsoft Entra ID tokens via managed identities, eliminating the need to store credentials or secrets in containers for accessing Azure resources like Key Vault. Option B is not a security control but an observability feature, so it does not itself secure the cluster. Option C is incorrect and even risky, since the HTTP application routing add-on exposes an ingress endpoint and is intended for dev/test, not hardened production workloads. Option E is a scaling feature that improves availability and cost, not a security configuration.

Answer

Enable Azure Monitor for containers.

Answer

Enable the HTTP application routing add-on.

Answer

Enable the cluster autoscaler.

Question 2

Your organization is using Microsoft Sentinel for security operations. Which THREE data sources can be connected to Microsoft Sentinel out of the box? (Choose THREE.)

Accepted Answer

Azure Active Directory (now Microsoft Entra ID). Options A (Microsoft Entra ID/Entra ID), B (AWS CloudTrail), and D (Microsoft 365 Defender) are all supported out-of-the-box data connectors in Microsoft Sentinel. Option C (Azure DevOps) is not a built-in connector; it requires a custom API or solution. Option E (Power BI) is not a data source connector for Sentinel.

Answer

Azure DevOps

Answer

Power BI

Question 3

Which THREE components are required to implement a secure hybrid network architecture using Azure VPN Gateway? (Choose three.)

Accepted Answer

A local network gateway resource in Azure.. Option A (a local network gateway resource in Azure) is required because it defines the on-premises VPN device's public IP address and address spaces, which Azure uses as the remote endpoint for the site-to-site tunnel. Option B (a connection resource with a shared key) is required because the connection object links the virtual network gateway to the local network gateway and carries the pre-shared key (PSK) used for IKE/IPsec authentication. Option D (a virtual network gateway in Azure) is required because it is the Azure-side VPN Gateway (VpnGw SKU) that terminates the IPsec/IKE tunnel and routes traffic into the virtual network. Option C (an ExpressRoute circuit) does not belong because ExpressRoute is a private dedicated-circuit connectivity model, not a VPN Gateway component, and the scenario specifies VPN Gateway. Option E (an Azure Firewall) does not belong because it is a managed network security service for traffic filtering and is not a prerequisite for establishing a VPN Gateway site-to-site connection.

Answer

An ExpressRoute circuit.

Answer

An Azure Firewall.

Question 4

Which TWO of the following are features of Azure DDoS Protection?

Accepted Answer

Cost protection for scaled resources during an attack. Option A is correct because Azure DDoS Protection includes DDoS cost protection, which provides service credits for resource costs incurred from scale-out during a documented DDoS attack, helping avoid unexpected charges. Option E is correct because Azure DDoS Protection uses adaptive tuning and automatic mitigation, learning normal traffic patterns and applying tailored mitigation policies to protect Azure resources from volumetric, protocol, and application-layer attacks. Option B is not a feature of Azure DDoS Protection itself; WAF capabilities are provided by Azure Web Application Firewall, typically through Application Gateway or Front Door. Option C is unrelated, as site-to-site VPN connectivity is provided by Azure VPN Gateway. Option D is also unrelated, since SSL termination and offloading are handled by services such as Application Gateway or Azure Front Door, not by Azure DDoS Protection.

Answer

Web application firewall (WAF) capabilities

Answer

Site-to-site VPN connectivity

Answer

SSL termination and offloading

Question 5

Your organization is implementing Microsoft Entra ID governance. Which THREE capabilities should you include to manage the identity lifecycle and access reviews?

Accepted Answer

Microsoft Entra Access Reviews.. Microsoft Entra Access Reviews (B) is correct because it lets reviewers periodically attest to users' group memberships, application assignments, and role assignments, which is the core mechanism for recertifying access in an identity governance program. Microsoft Entra Entitlement Management (C) is correct because access packages, catalogs, and connected organizations automate the request, approval, and assignment of resource bundles, including external user lifecycle, which is central to governing access at scale. Microsoft Entra Lifecycle Workflows (D) is correct because it automates joiner, mover, and leaver tasks such as generating Temporary Access Passes, assigning licenses, and disabling accounts based on HR events, directly addressing identity lifecycle management. Microsoft Entra Identity Protection (A) is not included because it detects and remediates identity-based risks like risky sign-ins and compromised credentials rather than managing lifecycle or access reviews. Privileged Identity Management (E) is not included because it focuses on just-in-time privileged role activation and approval, which is privileged access management rather than the lifecycle and review capabilities the scenario asks for.

Answer

Microsoft Entra Identity Protection.

Answer

Privileged Identity Management (PIM).

Question 6

Refer to the exhibit. You are reviewing an ARM template that deploys a network security group (NSG) for a web application. The NSG allows inbound HTTP traffic from any source and then denies all other inbound traffic. However, after deployment, you find that HTTP traffic is being blocked. What is the most likely cause?

Accepted Answer

The DenyAll rule has a higher priority than the AllowHTTP rule, so it takes precedence.. The DenyAll rule has a higher priority (lower priority number) than the AllowHTTP rule, so it is evaluated first and blocks all traffic, including HTTP. To fix this, the AllowHTTP rule should have a higher priority (lower number) than the DenyAll rule.

Answer

The AllowHTTP rule uses sourcePortRange '*' which conflicts with the DenyAll rule.

Answer

The NSG is not associated with the subnet or network interface where the web server is deployed.

Answer

The DenyAll rule uses protocol '*' which blocks all traffic including HTTP.

Question 7

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved applications can run on corporate devices. Which Intune feature should you configure?

Accepted Answer

AppLocker. AppLocker (option D) is the correct choice because it is the Windows feature that lets administrators define and enforce rules specifying which applications users can run on managed devices, and it can be configured and deployed through Intune via an application control policy. This directly satisfies the requirement that only approved applications execute on corporate Windows 10 devices. Windows Defender Firewall (A) controls network traffic by port, protocol, and address, not which local applications are permitted to launch. BitLocker (B) provides full-disk encryption for data-at-rest protection and has no application execution control. Windows Information Protection (C) is designed to separate and protect corporate data from personal data, not to whitelist approved applications for execution.

Answer

Windows Defender Firewall

Answer

BitLocker

Answer

Windows Information Protection

Question 8

Your organization wants to implement a zero-trust security model for on-premises and cloud resources. As part of this strategy, you need to ensure that all access requests are authenticated and authorized based on dynamic risk signals. Which Microsoft security solution should you use to enforce conditional access policies based on real-time risk?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct solution because it enables you to enforce access policies based on real-time risk signals, such as user risk, sign-in risk, and device compliance. It integrates with Identity Protection to evaluate dynamic risk levels and can block or require multi-factor authentication (MFA) accordingly, directly supporting the zero-trust principle of 'never trust, always verify'.

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 9

Contoso Ltd. is a multinational organization with a hybrid environment consisting of on-premises Active Directory and Azure AD (now Microsoft Entra ID). They use Microsoft Defender for Cloud Apps, Microsoft Sentinel, and Microsoft 365 Defender. The security operations team has noticed that several high-severity alerts from Microsoft 365 Defender are not being forwarded to Microsoft Sentinel, causing delayed response. The team has confirmed that the data connector between Microsoft 365 Defender and Sentinel is enabled and appears healthy. However, only low-severity alerts appear in Sentinel. Further investigation reveals that the Microsoft 365 Defender portal has a configured rule set that suppresses high-severity alerts for certain users deemed low risk. The security operations manager wants to ensure all high-severity alerts are sent to Sentinel without changing the suppression rules in Microsoft 365 Defender, as those rules are required for operational efficiency. What should the team do to ensure high-severity alerts are ingested into Sentinel?

Accepted Answer

In the Microsoft 365 Defender data connector in Sentinel, enable the option to include suppressed alerts.. The Microsoft 365 Defender data connector in Microsoft Sentinel includes a configuration setting to 'Include suppressed alerts.' Enabling this option forces Sentinel to ingest all alerts from Microsoft 365 Defender, including those that are suppressed by rule sets in the Defender portal. This satisfies the requirement to forward high-severity alerts without modifying the suppression rules that the operations team relies on for operational efficiency.

Answer

Modify the suppression rules in Microsoft 365 Defender to not suppress high-severity alerts.

Answer

Use the Microsoft Graph Security API connector in Sentinel to ingest alerts instead.

Answer

Create a separate Logic App to fetch high-severity alerts from Microsoft 365 Defender API and send them to Sentinel.

Question 10

A company deploys Azure Bastion in a VNet. They want to allow a security engineer to connect to a Windows VM in a peered VNet using Azure Bastion. The engineer can see the VM in the portal but cannot connect. Which configuration is most likely missing?

Accepted Answer

The peered VNet does not have 'Allow Azure Bastion Communication' enabled on the peering connection.. Azure Bastion requires the 'Allow Azure Bastion Communication' setting to be enabled on the peering connection for the peered VNet. Without this, the Bastion service cannot route traffic to the target VM in the peered VNet, even though the VM is visible in the portal. This setting allows the Bastion's control plane and data plane to communicate across the peering link.

Answer

The Azure Bastion subnet size is /28.

Answer

The VM's subnet does not have an inbound NSG rule allowing RDP (3389) from the Azure Bastion subnet.

Answer

The VM does not have Azure AD authentication enabled.

Question 11

A global organization uses Microsoft Sentinel for SIEM and Microsoft Defender for Cloud for cloud security posture management. The security team notices that critical alerts from Azure Active Directory Identity Protection are not triggering automated response playbooks in Sentinel. The team needs to ensure that all high-severity Identity Protection risk detections automatically create incidents in Sentinel and trigger a playbook to block the user. What should the team configure?

Accepted Answer

Enable the Identity Protection data connector and create a Microsoft Security incident creation rule for Identity Protection.. To have Identity Protection risk detections automatically create incidents in Microsoft Sentinel and trigger a playbook, you must first enable the Identity Protection data connector (which brings the alerts into Sentinel) and then create a Microsoft Security incident creation rule specifically for Identity Protection. This rule ingests the alerts as security incidents, and you can attach an automation rule to run a playbook (e.g., to block the user) when a high-severity incident is created. Without the incident creation rule, the alerts would be ingested as raw events but not automatically turned into incidents.

Answer

Enable the Azure Active Directory Identity Protection data connector in Sentinel.

Answer

Configure diagnostic settings on Azure AD to stream logs to Sentinel and create a playbook automation rule.

Answer

Configure the Identity Protection connector with the 'Create incidents' toggle enabled.

Question 12

A SOC analyst needs to investigate a potential privilege escalation using Azure AD roles. Which Microsoft 365 Defender data source would be most useful to review?

Accepted Answer

Azure Active Directory audit logs. Microsoft Entra ID audit logs (now part of the Azure Monitor / Microsoft Entra audit logs) are the authoritative source for tracking changes to Microsoft Entra ID roles, including role assignments, activations of Privileged Identity Management (PIM) roles, and modifications to directory roles. Since the question specifically involves privilege escalation using Microsoft Entra ID roles, these logs contain the necessary details such as who assigned a role, when, and from which IP address, making them the most directly relevant data source.

Answer

Microsoft 365 Defender identity logs

Answer

Microsoft Defender for Cloud Apps logs

Answer

Microsoft 365 audit logs

Question 13

Your organization uses Microsoft Sentinel to aggregate logs from on-premises and cloud sources. You need to reduce the cost of data ingestion while ensuring security-critical logs are retained for at least one year. What should you do?

Accepted Answer

Ingress security-critical logs to the Analytics logs tier with 365-day retention, and other logs to the Auxiliary logs tier with shorter retention. Use the Analytics logs tier for security-critical logs because it provides full KQL query capabilities and supports setting 365-day retention to meet compliance. For other logs, use the Auxiliary logs tier (or Basic logs) to reduce ingestion costs while accepting shorter retention and limited query capabilities. This tiered approach balances cost and security requirements.

Answer

Archive all logs to Azure Storage after 90 days

Answer

Use the Basic logs tier for all logs and set retention to 365 days

Answer

Set the default retention to 30 days and export logs to Log Analytics Workspace

Question 14

Your organization has a hybrid identity environment with Microsoft Entra ID and on-premises Active Directory. You need to design a solution that ensures all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. However, some legacy apps still require basic authentication. What should you recommend?

Accepted Answer

Enable authentication policies in Microsoft Entra ID to block legacy authentication. Enabling authentication policies in Microsoft Entra ID to block legacy authentication ensures that all user authentication requests are evaluated by Conditional Access policies before granting access to cloud apps. Legacy authentication protocols (e.g., POP3, IMAP, SMTP, basic auth) bypass modern authentication and Conditional Access, so blocking them forces clients to use modern protocols (OAuth 2.0, OpenID Connect) that are subject to Conditional Access evaluation. This directly addresses the requirement while allowing legacy apps to be updated or replaced over time.

Answer

Configure Active Directory Federation Services (AD FS) as the identity provider

Answer

Deploy Microsoft Entra Application Proxy for all legacy apps

Answer

Enable pass-through authentication (PTA) to forward authentication requests

Question 15

Your organization is implementing a Zero Trust security model. Which Microsoft security solution should you use to enforce conditional access policies based on user, device, location, and real-time risk signals?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct solution because it is the native policy engine in Microsoft Entra ID that evaluates signals from user identity, device compliance, location (IP ranges or countries), and real-time risk from Microsoft Entra ID Protection to enforce access decisions. It directly implements the 'explicit verification' and 'assume breach' principles of Zero Trust by blocking or requiring step-up authentication based on these dynamic conditions.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Answer

Microsoft Purview