SC-100 Practice Test 14 — 15 Questions

Question 1

Your organization, Contoso Ltd., is migrating its on-premises workloads to Azure. The environment includes 200 virtual machines (VMs) running Windows Server and 50 VMs running Linux. You are responsible for designing the security infrastructure. The company has the following requirements: 1) All VMs must be protected against malware. 2) Security updates must be applied automatically to Windows VMs within 24 hours of release. 3) Linux VMs must receive critical security patches within 48 hours. 4) A central dashboard must provide visibility into the security posture of all VMs. 5) All VMs must be onboarded to Microsoft Defender for Cloud to enable advanced threat protection. 6) The solution must minimize administrative overhead. You have implemented the following: - All VMs are enrolled in Microsoft Defender for Cloud with the enhanced security features enabled. - Azure Update Manager is configured to schedule updates. - Microsoft Defender for Endpoint is installed on all Windows VMs. However, after a month, the security team reports that: - 50 Windows VMs did not receive security updates within 24 hours. - 10 Linux VMs have not received any patches. - The central dashboard shows that 30 VMs are not reporting their security status. - A malware outbreak occurred on 5 Windows VMs that were not protected by Defender for Endpoint. You need to identify the most likely root cause and recommend a corrective action.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the network security groups (NSGs) and firewall rules to ensure outbound connectivity to the required Microsoft endpoints for Microsoft Defender for Endpoint and Windows Update.. The symptoms—VMs missing updates, not reporting status, and lacking Defender for Endpoint protection—point to a connectivity failure. Microsoft Defender for Endpoint and Windows Update require outbound connectivity to specific Microsoft endpoints (e.g., *.endpoint.microsoft.com, *.update.microsoft.com). Without this, VMs cannot receive updates, report security posture, or download Defender definitions, directly explaining all reported issues.

Answer

Onboard the VMs to Azure Arc and enable the Azure Update Manager on all VMs via Arc.

Answer

Implement Azure Policy to enforce that all VMs have the 'Deploy default Microsoft IaaS anti-malware extension for Windows' policy assigned and create a remediation task.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for update deployments.

Question 2

Your organization uses Microsoft Intune to manage devices and wants to ensure that only compliant devices can access corporate email. Which conditional access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) can access corporate email. This setting checks the device's compliance status reported by Intune to Azure AD during authentication, blocking non-compliant devices before they reach Exchange Online.

Answer

Require approved client app

Answer

Require Multi-Factor Authentication

Answer

Require domain join

Question 3

A company uses Microsoft 365 Defender to protect their endpoints, email, and identities. They want to create a custom detection for a specific behavior that is not covered by built-in detections. Which tool should they use?

Accepted Answer

Custom detection rules in Microsoft 365 Defender. Microsoft 365 Defender provides a 'Custom detection' feature under the 'Advanced hunting' section that allows security teams to create custom detection rules based on Kusto Query Language (KQL) queries. This is the correct tool because the question specifies creating a detection for behavior not covered by built-in detections within the Microsoft 365 Defender ecosystem, and custom detection rules are designed exactly for that purpose—they run on a schedule and generate alerts when the custom query matches.

Answer

Microsoft Sentinel analytics rules

Answer

Azure AD Identity Protection user risk policies

Answer

Microsoft Defender for Cloud Apps policies

Question 4

Your organization uses Microsoft Purview to classify sensitive data. You need to automatically apply a sensitivity label to documents that contain personally identifiable information (PII). Which TWO components should you configure?

Accepted Answer

Auto-labeling policy. Auto-labeling policy (A) is correct because it automatically applies sensitivity labels to documents based on conditions such as the presence of sensitive data types (e.g., PII). Sensitivity label (D) is correct because it defines the classification and protection settings (e.g., encryption, markings) that are applied to the content. Together, they enable automatic classification of PII documents without manual user intervention.

Answer

Retention label

Answer

Data Loss Prevention (DLP) policy

Answer

Trainable classifier

Question 5

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to ensure that critical recommendations are automatically remediated. They create a workflow automation that triggers a Logic App for specific recommendations. However, the Logic App fails to run. What is the most likely cause?

Accepted Answer

The managed identity of the Logic App lacks permissions on the target resources.. The most likely cause is that the Logic App's managed identity lacks the necessary permissions on the target Azure resources. Workflow automations in Defender for Cloud use a Logic App that executes remediation actions; if the Logic App's identity (either system-assigned or user-assigned) does not have the required RBAC role (e.g., Contributor or a custom role with specific actions) on the resource scope, the remediation run will fail with an authorization error. This is a common misconfiguration because the automation trigger itself succeeds, but the downstream action fails due to insufficient permissions.

Answer

The subscription is not onboarded to Defender for Cloud.

Answer

Defender for Cloud is disabled for the resource group.

Answer

The recommendation is disabled in the security policy.

Question 6

You are the lead security architect for a multinational corporation that recently completed a merger. The new entity, Contoso Ltd., has a complex Azure environment with over 200 subscriptions spread across multiple management groups. The company's security team has identified several critical issues: (1) many subscriptions have Azure Security Center's Secure Score below 30%, (2) there are numerous unmanaged VMs with public IP addresses, (3) there is no centralized logging for security events, and (4) identity management is fragmented with multiple Azure AD tenants. The CEO mandates a 'zero-trust' security posture within 12 months. You have a limited budget and must prioritize the most impactful actions. Which course of action should you take first?

Accepted Answer

Consolidate all Azure AD tenants into a single tenant and establish a common identity baseline. Identity is the foundational control plane for zero-trust architecture. Without a unified identity baseline across a single Azure AD tenant, you cannot enforce consistent conditional access policies, least-privilege access, or authentication strength—making all other security controls ineffective. Consolidating tenants first directly addresses the fragmented identity management issue and enables centralized policy enforcement, which is the highest-impact, lowest-cost action to improve the security posture within 12 months.

Answer

Implement Azure Sentinel to centralize logs and create automated response playbooks

Answer

Deploy Azure Firewall and enforce forced tunneling for all VNets

Answer

Deploy Azure Policy to deny creation of VMs with public IPs and enforce NSGs

Question 7

Your organization uses Microsoft Sentinel for SIEM. You need to ensure that security incidents are automatically responded to without human intervention for known false positives. What should you implement?

Accepted Answer

An automation rule with incident closure action. Automation rules in Microsoft Sentinel can be configured to automatically close incidents when specific conditions are met, such as when an incident is identified as a known false positive. This eliminates the need for human intervention by triggering an incident closure action based on predefined criteria, directly addressing the requirement for automated response to false positives.

Answer

An analytics rule with alert suppression

Answer

A playbook that runs on incident creation

Answer

An entity behavior analytics rule

Question 8

You are designing a secure DevOps pipeline in GitHub that deploys to Azure Kubernetes Service (AKS). The security team requires that no secrets are stored in the pipeline variables and that all container images are scanned for vulnerabilities before deployment. Which approach aligns with security best practices?

Accepted Answer

Use GitHub Actions with OpenID Connect to authenticate to Azure without storing any secrets. Integrate Microsoft Defender for Containers to scan images in Azure Container Registry.. It uses OpenID Connect (OIDC) to authenticate GitHub Actions to Azure without storing any long-lived secrets, which aligns with the requirement that no secrets be stored in pipeline variables. Additionally, integrating Microsoft Defender for Containers provides vulnerability scanning for container images in Azure Container Registry (ACR), meeting the image scanning requirement before deployment to AKS.

Answer

Use Azure DevOps with a service principal that has a client secret stored in Azure Key Vault. Use Trivy to scan images.

Answer

Use GitHub Actions with a managed identity for the GitHub runner. Disable image scanning to speed up deployments.

Answer

Use GitHub Actions with environment secrets for Azure service principal credentials. Use Docker Hub's vulnerability scanning.

Question 9

Your company is deploying Microsoft Sentinel in a government agency that requires strict data residency. You need to ensure that all Sentinel data is stored within the United States. Which THREE actions must you take to meet this requirement?

Accepted Answer

Disable cross-region replication in the Log Analytics workspace settings.. To ensure data residency within the United States, you must create the Log Analytics workspace in a US Azure region (Option B) and disable cross-region replication (Option A). Additionally, you should use Azure Policy to audit workspace region for compliance (Option E) to continuously monitor and enforce data residency requirements. Customer-managed keys (Option D) provide encryption control but are not strictly required for data residency. Data export to a different region (Option C) would violate residency.

Answer

Configure data export to a storage account in a different region for redundancy.

Answer

Enable customer-managed keys (CMK) using Azure Key Vault in the same region.

Question 10

Your organization uses Microsoft Sentinel. You need to design a solution to detect and automatically respond to a potential brute-force attack against an on-premises application that is published via Azure AD Application Proxy. The solution should block the attacker's IP address in Azure AD Conditional Access for one hour after detecting more than 10 failed login attempts within 5 minutes. What should you implement?

Accepted Answer

Create a Microsoft Sentinel analytics rule that triggers on a KQL query detecting the failed logins, then use a playbook to add the IP to a Conditional Access block list via the Azure AD API.. You can create a Microsoft Sentinel analytics rule with a KQL query that detects more than 10 failed login attempts within 5 minutes. When the rule triggers, it runs a playbook that uses the Azure AD API to add the attacker's IP to a Conditional Access block list, blocking further access for one hour. Option A is incorrect because Microsoft Purview DLP policies are for data protection, not authentication blocking. Option C is incorrect because a WAF rate limit blocks at the network layer but does not integrate with Azure AD Conditional Access, and it cannot read authentication logs from Azure AD App Proxy. Option D is incorrect because Microsoft Entra ID Protection sign-in risk policies are user-based and cannot block specific IPs or apply custom logic like a 1-hour block.

Answer

Create a Microsoft Purview Data Loss Prevention policy to block the IP address based on the login pattern.

Answer

Deploy a web application firewall (WAF) in front of the application and configure rate limiting to block the IP.

Answer

Configure a Microsoft Entra ID Protection sign-in risk policy to automatically block the user's sign-in after detecting anomalous activity.

Question 11

Which TWO Microsoft Purview solutions should you use to protect sensitive data in Microsoft 365? (Choose two.)

Accepted Answer

Sensitivity labels and policies.. The correct answers are Sensitivity labels and policies (C) and Data Loss Prevention (DLP) policies (E). Sensitivity labels allow classification and protection of sensitive data at rest and in transit, while DLP policies help prevent unauthorized sharing of sensitive data. Option A (Audit) is incorrect because it only provides logging and monitoring, not direct data protection. Option B (Insider Risk Management) is incorrect as it focuses on detecting risky user behavior but does not directly protect data. Option D (eDiscovery) is designed for legal discovery and does not protect data.

Answer

Microsoft Purview Audit.

Answer

Insider Risk Management.

Answer

Microsoft Purview eDiscovery.

Question 12

Your organization has a Microsoft 365 E5 subscription and wants to detect insider data exfiltration attempts. You need to design a solution that can identify users copying sensitive data to personal cloud storage services. Which Microsoft Purview capability should you use?

Accepted Answer

Insider Risk Management. Insider Risk Management in Microsoft Purview is specifically designed to detect insider data exfiltration scenarios, including copying data to personal cloud storage. Option A is wrong because Data Loss Prevention (DLP) policies are preventive controls that block or warn about sharing sensitive data but do not detect exfiltration attempts based on user activities. Option B is wrong because eDiscovery (Premium) is used for legal discovery and investigations, not for real-time detection of insider risks. Option C is wrong because Communication Compliance focuses on identifying inappropriate communications (e.g., harassment, sharing sensitive info via email or Teams), not on monitoring data exfiltration to personal cloud services.

Answer

Data Loss Prevention (DLP) policies

Answer

eDiscovery (Premium)

Answer

Communication Compliance

Question 13

Your organization uses Microsoft Defender for Cloud to secure multi-cloud resources. You need to ensure that security recommendations are automatically remediated for non-compliant resources without manual intervention. What should you configure?

Accepted Answer

Use Quick Fix remediation for security recommendations and enable automation. Quick Fix remediation allows you to automatically apply a predefined remediation step for a security recommendation, and when combined with automation (such as a logic app or Azure Automation runbook triggered by Defender for Cloud), non-compliant resources can be auto-remediated without manual intervention. Option A is incorrect because Azure Policy initiatives with remediation tasks require manual trigger or a separate automation setup to run automatically; they do not directly auto-remediate within Defender for Cloud recommendations. Option B is incorrect because setting a Secure Score target and alerting on changes only monitors the secure score, it does not perform any remediation. Option D is incorrect because automatic provisioning of Log Analytics agent is about collecting data, not remediation.

Answer

Azure Policy initiatives with remediation tasks

Answer

Set a Secure Score target and alert on changes

Answer

Enable automatic provisioning of Log Analytics agent

Question 14

A company is using Azure Active Directory (Azure AD) for identity management. They want to implement a policy that requires all users to use multi-factor authentication (MFA) when accessing Office 365 from outside the corporate network. Which conditional access policy setting should they configure?

Accepted Answer

Assignments > Conditions > Locations. The Locations condition in Azure AD Conditional Access allows administrators to define named locations (such as corporate IP ranges) and then require MFA when access originates from any location that is not trusted. By configuring a policy that targets 'All users' and 'All cloud apps' (or specifically Office 365), and setting the Locations condition to 'Any location' with the exclusion of the corporate network, the policy enforces MFA for all external access attempts. This directly meets the requirement to require MFA when accessing Office 365 from outside the corporate network.

Answer

Assignments > Conditions > Client apps

Answer

Assignments > Conditions > Device platforms

Answer

Assignments > Conditions > Sign-in risk

Question 15

Which THREE components are required to implement a Zero Trust network architecture using Microsoft Entra Internet Access (formerly Microsoft 365 Network Connectivity)?

Accepted Answer

Conditional Access policies. Options A, D, and E are correct. Conditional Access policies enforce access controls based on user, device, and location signals. Microsoft Intune device compliance policies ensure devices meet security requirements before access. Microsoft Entra Internet Access (formerly Microsoft Global Secure Access) is the core Zero Trust network gateway, providing secure internet and SaaS access. Option B (Azure AD Application Proxy, now Entra Application Proxy) is incorrect because it is designed for publishing legacy on-premises apps, not as a core component of Zero Trust network architecture. Option C (Site-to-site VPN) is incorrect as it represents traditional perimeter-based network access, which Zero Trust aims to replace.

Answer

Azure AD Application Proxy

Answer

Site-to-site VPN