SC-100 Practice Test 13 — 15 Questions

Question 1

Your company, Fabrikam, is a global financial services firm that handles sensitive customer data. You are designing a security solution for a new customer-facing web application that processes credit card transactions. The application will be deployed on Azure Kubernetes Service (AKS) and will use Azure SQL Database for data storage. Compliance requirements include PCI DSS and GDPR. You need to ensure that data at rest and in transit is encrypted, and that access to the database is tightly controlled. You plan to use Azure Key Vault for managing encryption keys. Which combination of actions should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable TDE with a customer-managed key in Azure Key Vault, use Always Encrypted for sensitive columns, enforce TLS 1.2, and use Azure AD managed identities for authentication with a firewall rule to allow only the AKS cluster's outbound IP.. It provides comprehensive encryption: TDE with a customer-managed key in Azure Key Vault encrypts data at rest, Always Encrypted protects sensitive columns (e.g., credit card numbers) with column-level encryption, TLS 1.2 secures data in transit, and Azure AD managed identities with a firewall rule restricted to the AKS cluster's outbound IP ensure secure authentication and access control. This combination meets PCI DSS and GDPR requirements.

Option B is incorrect because storing the customer-managed key in the application's configuration file is insecure and violates best practices for key management; keys must be stored in a secure vault like Azure Key Vault.

Option C is incorrect because application-level encryption alone does not guarantee data-at-rest encryption within Azure SQL Database, and disabling firewall rules (using no firewall) exposes the database to unauthorized access.

Option D is incorrect because it uses a service-managed key (less control), TLS 1.0 (not PCI DSS compliant), and SQL authentication (less secure than Azure AD managed identities).

Answer

Enable TDE with a customer-managed key stored in the application's configuration file, enforce TLS 1.2, and use Azure AD authentication.

Answer

Implement application-level encryption for credit card data, enforce TLS 1.2, and use Azure AD managed identities with no database firewall rules.

Answer

Enable Transparent Data Encryption (TDE) with a service-managed key, enforce TLS 1.0, and use SQL authentication.

Question 2

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows only hybrid Azure AD joined devices to access a sensitive application. The solution must also require that the device is compliant with company policies. Which two components should you configure? (Choose TWO.)

Accepted Answer

Conditional Access policy with 'Require hybrid Azure AD joined device'. Options C and E are correct. A Conditional Access policy with the 'Require hybrid Azure AD joined device' grant control ensures that only devices joined to both on-premises AD and Azure AD can access the application. An Intune device compliance policy defines the security and configuration requirements that devices must meet to be considered compliant. Combining these two components enforces both device identity and compliance. Option A (Intune app protection policy) is incorrect because it protects app data at the app level, not device-level access. Option B (Require MFA) is not required by the scenario. Option D (Intune device enrollment) is a prerequisite for management but not an access control.

Answer

Intune app protection policy

Answer

Conditional Access policy with 'Require multifactor authentication'

Answer

Intune device enrollment

Question 3

Your organization uses Microsoft Sentinel and has deployed the Analytics rule 'TI map IP entity to AzureActivity' to detect suspicious activities based on threat intelligence. The SOC team reports that the rule has a high false positive rate because it matches benign IP addresses used by legitimate services. What design change should you recommend to reduce false positives while maintaining detection coverage?

Accepted Answer

Create a watchlist of trusted IP addresses and modify the rule to exclude those IPs.. Creating a watchlist of trusted IP addresses and modifying the TI map IP entity to AzureActivity rule to exclude those IPs directly addresses the high false positive rate caused by benign IPs. This approach preserves detection coverage for all other threat intelligence matches while filtering out known legitimate services, leveraging Sentinel's watchlist feature for dynamic exclusion without disabling the rule.

Answer

Increase the alert threshold to require multiple occurrences within a time window.

Answer

Disable the rule and rely on manual hunting queries.

Answer

Create a separate analytics rule that suppresses alerts when the source IP is in a trusted list.

Question 4

A security team is designing a Microsoft Sentinel deployment. They need to minimize costs while ensuring critical alerts are always processed. Which data retention and ingestion strategy should they use?

Accepted Answer

Use Basic Logs for high-volume low-value data and Analytics Logs for critical alerts. It aligns with cost optimization and reliability requirements by using Basic Logs for high-volume, low-value data (e.g., firewall logs) and reserving Analytics Logs for critical alerts that require full query capabilities and interactive retention. This tiered approach ensures critical alerts are always processed with full fidelity while reducing storage costs for less important data.

Answer

Use Basic Logs for all data and retain for 90 days

Answer

Use Analytics Logs for all data and retain for 30 days

Answer

Use Basic Logs for critical alerts and retain for 30 days

Question 5

Your organization uses Microsoft Entra ID and plans to implement a custom line-of-business application that accesses Microsoft Graph APIs. The application will be used by employees and external partners. You need to ensure that the application can authenticate users and obtain appropriate permissions without exposing the client secret. What should you implement?

Accepted Answer

Implement OAuth 2.0 authorization code flow with PKCE.. The application is a line-of-business app used by employees and external partners, which implies it may be a public client (e.g., mobile or desktop) that cannot securely store a client secret. OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended authentication pattern for such clients because it eliminates the need for a client secret by using a dynamically generated code verifier. This ensures the client secret is never exposed. Option B is correct. Option A (system-assigned managed identity) is only suitable for Azure-hosted services, not client applications. Option C (storing client secret in Key Vault) still requires secret retrieval at runtime, which can be insecure for public clients. Option D (implicit grant flow) is outdated and less secure than authorization code flow with PKCE.

Answer

Use a system-assigned managed identity to authenticate to Microsoft Graph.

Answer

Store the client secret in Azure Key Vault and retrieve it at runtime.

Answer

Register the application as a public client and use the implicit grant flow.

Question 6

A company wants to protect sensitive data in their Azure SQL Database from unauthorized access. Which feature should they enable?

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) performs real-time I/O encryption and decryption of the data and log files at the page level, protecting data at rest in Azure SQL Database. This directly addresses the requirement to prevent unauthorized access to the underlying storage files, as TDE ensures that data cannot be read if the physical media is compromised.

Answer

Azure Information Protection

Answer

Azure Key Vault

Answer

Azure Firewall

Question 7

Which TWO of the following are valid methods to protect privileged accounts in Microsoft Entra ID?

Accepted Answer

Configure Conditional Access policies for privileged roles. Conditional Access policies can be configured to require stronger authentication, device compliance, or location-based controls specifically for users assigned to privileged roles (e.g., Global Administrator, Privileged Role Administrator). This directly protects privileged accounts by enforcing additional security requirements before granting access to Entra ID resources.

Answer

Enable Identity Protection for all users

Answer

Enable Self-Service Password Reset (SSPR)

Answer

Use Azure AD Connect to sync privileged accounts

Question 8

Your organization uses Microsoft Sentinel as its SIEM. The security team needs to detect brute-force attacks against Azure VMs by analyzing Windows Security Event logs. Which data connector should you enable?

Accepted Answer

Windows Security Events via AMA connector. The Windows Security Events via AMA connector (D) is correct because it ingests Windows Event Logs (specifically Security logs with Event ID 4625 for failed logons) from Azure VMs into Microsoft Sentinel, enabling detection of brute-force patterns. This connector uses the Azure Monitor Agent (AMA) to collect events, which is the recommended method for modern Windows event collection in Sentinel.

Answer

Office 365 connector

Answer

Azure Activity log connector

Answer

Microsoft Defender for Cloud connector

Question 9

Refer to the exhibit. You configure this mail flow rule in Exchange Online. What happens to emails with 'FREE' in the subject?

Accepted Answer

Emails are moved to the Junk Email folder. The mail flow rule is configured to add the header 'X-CustomHeader' with the value 'Free' to emails that have 'FREE' in the subject. However, the rule also has the action 'Increase the spam confidence level (SCL) to 9', which causes Exchange Online to treat the message as high-confidence spam. When the SCL is set to 9, Exchange Online automatically moves the email to the Junk Email folder for the recipient, unless a transport rule or mailbox setting overrides this behavior. Therefore, the emails are not deleted, blocked, or simply have a header added; they are moved to the Junk Email folder due to the SCL increase.

Answer

Emails are deleted

Answer

Emails have a custom header added

Answer

Emails are blocked and not delivered

Question 10

Your organization uses Microsoft Defender XDR to detect and respond to threats. The SOC team wants to automatically isolate a device when a high-severity incident is confirmed. Which automation feature should you configure?

Accepted Answer

Automated investigation and response (AIR). Automated investigation and response (AIR) in Microsoft Defender XDR is designed to automatically respond to confirmed high-severity incidents, including isolating devices, without manual intervention. This feature leverages playbooks and machine learning to contain threats rapidly, aligning with the SOC's requirement for automatic isolation upon incident confirmation.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Manual device isolation from Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint's endpoint detection and response (EDR)

Question 11

A company is designing a data classification strategy for their Azure environment. They need to identify sensitive data stored in Azure SQL Database. Which TWO solutions should they consider?

Accepted Answer

Azure SQL Data Discovery & Classification. Azure SQL Data Discovery & Classification is correct because it is a native feature of Azure SQL Database that automatically discovers, classifies, and labels sensitive columns (e.g., credit card numbers, PII) directly within the database engine. It provides a built-in dashboard for auditing and monitoring classification status, making it the primary tool for identifying sensitive data stored in Azure SQL Database.

Answer

Azure Information Protection

Answer

Azure Purview

Answer

Azure Policy

Question 12

Your company is deploying a new line-of-business application in Azure that must comply with PCI DSS. The application uses Azure SQL Database. You need to design a solution to encrypt sensitive data at rest and in transit, and to audit access to sensitive columns. Which combination of Microsoft security capabilities should you recommend?

Accepted Answer

Transparent Data Encryption, Always Encrypted, and Azure SQL Auditing. Transparent Data Encryption (TDE) encrypts the SQL database at rest, Always Encrypted protects sensitive columns in transit and at rest by ensuring encryption keys are never exposed to the database engine, and Azure SQL Auditing logs all access to sensitive columns for compliance with PCI DSS requirements.

Answer

Dynamic Data Masking and Azure SQL Firewall rules

Answer

Azure Policy and Microsoft Defender for Cloud

Answer

Azure Storage Service Encryption and Azure Key Vault

Question 13

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) resources are assessed against the same security baseline. What should you do?

Accepted Answer

Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark. Microsoft Defender for Cloud's multi-cloud CSPM capabilities allow you to connect AWS and GCP accounts directly, and then apply Azure Policy to enforce the Microsoft Cloud Security Benchmark (MCSB) across all connected clouds. This ensures a unified security baseline assessment for Azure, AWS, and GCP resources, as MCSB is the default policy initiative in Defender for Cloud.

Answer

Configure AWS Config and GCP Security Command Center to export findings to Microsoft Sentinel

Answer

Use regulatory compliance standards for each cloud separately

Answer

Enable the Cloud Security Posture Management (CSPM) plan and configure AWS and GCP connectors

Question 14

A company is designing a security operations strategy using Microsoft Sentinel. They want to prioritize triage of incidents that involve critical assets. The SOC manager suggests using the entity behavior analytics feature. Which capability of entity behavior analytics helps achieve this goal?

Accepted Answer

It profiles entities and assigns an anomaly score based on deviations from baseline behaviors.. Entity behavior analytics (UEBA) in Microsoft Sentinel profiles entities such as users, hosts, or applications by establishing baseline behaviors over time. It then assigns an anomaly score to deviations from that baseline, enabling SOC analysts to prioritize incidents involving critical assets based on unusual activity rather than static rules. This directly supports the goal of triaging incidents by highlighting anomalous behavior on high-value targets.

Answer

It combines multiple alerts into a single incident using Fusion.

Answer

It uses threat intelligence to correlate with known bad actors.

Answer

It automatically groups incidents by severity and asset criticality.

Question 15

Your organization is implementing a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM). The compliance team requires that all privileged role activations be approved by a manager and that an audit trail is maintained for at least one year. Which configuration should you recommend?

Accepted Answer

Set PIM role settings to require approval and enable audit logging. It directly addresses both compliance requirements: requiring approval ensures a manager authorizes each activation, and enabling audit logging in PIM retains activation history for at least one year. PIM role settings allow you to configure approval workflows and automatically log all activations to the Microsoft Entra audit log, which can be exported and retained for compliance purposes.

Answer

Configure access reviews for privileged roles

Answer

Enable Conditional Access policies for privileged roles

Answer

Require Azure MFA for role activation