SC-100 Practice Test 15 — 15 Questions

Question 1

A company is migrating its on-premises Active Directory to Microsoft Entra ID. They need to ensure that all user authentication for cloud apps uses passwordless methods. Which security best practice should they implement?

Accepted Answer

Implement Microsoft Entra ID passwordless authentication. Option B is correct because implementing Microsoft Entra ID passwordless authentication (e.g., FIDO2 keys, Windows Hello for Business) aligns with the Zero Trust principle of eliminating passwords. Option A is wrong because MFA alone still relies on a password. Option C is wrong because conditional access policies can enforce passwordless but are not the best practice itself. Option D is wrong because privileged identity management addresses just-in-time access, not passwordless.

Answer

Configure conditional access policies to block legacy authentication

Answer

Enable Microsoft Entra ID Privileged Identity Management (PIM)

Answer

Require multifactor authentication (MFA) for all users

Question 2

Your organization uses Microsoft Sentinel for SIEM. You need to ensure that security incidents are automatically responded to without human intervention for known false positives. What should you implement?

Accepted Answer

An automation rule with incident closure action. Option D is correct because automation rules in Microsoft Sentinel can be configured to automatically close incidents when specific conditions are met, such as when an incident is identified as a known false positive. This eliminates the need for human intervention by triggering an incident closure action based on predefined criteria, directly addressing the requirement for automated response to false positives.

Answer

An analytics rule with alert suppression

Answer

A playbook that runs on incident creation

Answer

An entity behavior analytics rule

Question 3

A company uses Microsoft Defender for Cloud to manage security across hybrid workloads. They need to ensure that all Azure VMs have guest-level threat detection enabled. Which security policy should they assign?

Accepted Answer

Microsoft cloud security benchmark. The Azure Security Benchmark includes built-in policies for guest configuration. Option A is wrong because it's a general benchmark. Option B is wrong because it's not a policy initiative. Option D is wrong because it's a different product.

Answer

Azure Security Benchmark

Answer

Microsoft Defender for Cloud Apps

Answer

NIST SP 800-53

Question 4

Your company is implementing Microsoft Purview Information Protection to protect sensitive data. The compliance team requires that when a user applies a 'Highly Confidential' sensitivity label to a document, the document is automatically encrypted and watermarked. Which configuration should you use?

Accepted Answer

Configure the sensitivity label to apply encryption and dynamic watermarking. Publish the label to users.. Option A is correct because encryption and dynamic watermarking are built-in label settings. Option B is wrong because auto-labeling policies apply labels based on conditions, not user action. Option C is wrong because access policies control access but do not add watermarks. Option D is wrong because DLP policies apply actions like block, not encryption or watermarking.

Answer

Create a DLP policy that encrypts and watermarks the document when it is shared externally

Answer

Create an auto-labeling policy that detects sensitive content and applies the label automatically

Answer

Create a Conditional Access policy that requires the label to be applied to all documents

Question 5

Your organization is deploying a new application on Azure that will process personal data for European Union residents. The compliance team requires that the application encrypts all data at rest and in transit, that access to the data is logged and auditable, and that the data is not stored outside the EU. You need to design a solution that meets these requirements while following security best practices. The solution must also minimize operational overhead. You have decided to use Azure SQL Database, Azure Storage, and Azure Key Vault. Which design should you recommend?

Accepted Answer

Use Azure SQL Database with Transparent Data Encryption (TDE) using service-managed keys. Enforce TLS 1.2 for connections. Use Azure Storage with encryption at rest using Microsoft-managed keys. Store keys in Azure Key Vault. Configure geo-redundant storage (GRS) in an EU region. Enable diagnostic settings to send logs to a Log Analytics workspace in the EU.. Option D is correct because it uses Transparent Data Encryption (TDE) with service-managed keys for Azure SQL Database, which encrypts data at rest with minimal operational overhead, and enforces TLS 1.2 for data in transit. Azure Storage encryption at rest with Microsoft-managed keys meets the encryption requirement without management burden. Geo-redundant storage (GRS) within an EU region ensures data residency, and diagnostic settings sending logs to a Log Analytics workspace in the EU provides auditable logging while keeping logs within the EU, all aligning with security best practices and minimizing operational overhead.

Answer

Use Azure SQL Database with Always Encrypted using Azure Key Vault. Use Azure Storage with encryption at rest. Enforce TLS 1.2. Use Azure Traffic Manager to route traffic to EU regions. Enable SQL Auditing and export logs to an on-premises SIEM.

Answer

Use Azure SQL Database with Always Encrypted using client-managed keys stored in a config file. Enforce TLS 1.2. Use Azure Storage with client-side encryption. Store keys in Azure Key Vault. Configure LRS in EU. Enable SQL Auditing.

Answer

Use Azure SQL Database with SQL Server encryption (cell-level). Use Azure Storage with encryption at rest. Store keys in application code. Use Azure Backup for long-term retention. Enable auditing on SQL Database.

Question 6

A company uses Microsoft Entra ID and wants to enable passwordless authentication for all users to reduce phishing risks. Users are already using Microsoft Authenticator for MFA. Which passwordless method should you prioritize?

Accepted Answer

Microsoft Authenticator passwordless sign-in. Option D is correct because the organization already uses Microsoft Authenticator for MFA, making the transition to passwordless sign-in via Authenticator the most seamless and cost-effective path. This method leverages the existing app registration and push notification infrastructure, allowing users to authenticate with a biometric or PIN gesture without deploying additional hardware or certificates.

Answer

Windows Hello for Business

Answer

FIDO2 security keys

Answer

Certificate-based authentication

Question 7

A company plans to implement a Zero Trust architecture using Microsoft security solutions. They want to ensure that all access to corporate resources is verified explicitly, uses least privilege, and assumes breach. Which Microsoft service should be the central policy engine for enforcing conditional access decisions?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct central policy engine because it directly enforces Zero Trust principles by evaluating signals (user, device, location, risk) in real time to grant or block access. It acts as the policy decision point (PDP) that enforces explicit verification, least privilege, and assumes breach by requiring continuous authentication and authorization for every access request.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 8

Which TWO Microsoft services can be used to implement a cloud security posture management (CSPM) solution? (Select exactly two correct options.)

Accepted Answer

Microsoft Defender for Cloud. Options A and C are correct. Microsoft Defender for Cloud provides CSPM across Azure, AWS, and GCP. Microsoft Entra Permissions Management is a Cloud Infrastructure Entitlement Management (CIEM) tool that helps manage permissions. Option B is wrong because Microsoft Intune is for device management. Option D is wrong because Microsoft Sentinel is a SIEM. Option E is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Purview

Answer

Microsoft Intune

Answer

Microsoft Sentinel

Question 9

Contoso is a financial services company migrating critical workloads to Azure. They must comply with PCI DSS and have a Security Operations Center (SOC) team that uses Microsoft Sentinel. The CISO wants to ensure that the security posture aligns with Microsoft's cybersecurity reference architecture (MCRA). You need to design a solution that includes the following requirements: 1) All Azure subscriptions must be managed under a single management group hierarchy with consistent policies. 2) The SOC must have a centralized view of security alerts across all resources, including on-premises servers and multi-cloud environments. 3) Privileged access to Azure resources must be protected using just-in-time (JIT) access and Privileged Identity Management (PIM). 4) Compliance with PCI DSS must be continuously monitored and reported. 5) The solution must minimize operational overhead. What should you include in the design?

Accepted Answer

Deploy a single management group containing all subscriptions. Enable Microsoft Defender for Cloud with the 'PCI DSS v3.2.1' regulatory compliance dashboard on the management group. Configure Azure Policy to enforce security standards. Enable PIM and configure JIT VM access. Use Microsoft Sentinel as the SIEM, connecting it to Defender for Cloud and on-premises security sources.. Option A is correct because it provides a centralized management group structure for policy enforcement, uses Microsoft Defender for Cloud for continuous compliance monitoring and multicloud visibility, and integrates PIM and JIT for privileged access. Microsoft Sentinel can ingest alerts from Defender for Cloud. Option B is less effective because it lacks centralized policy management and uses separate Defender for Cloud instances. Option C is wrong because it relies on Azure Policy alone without the compliance monitoring and threat detection capabilities of Defender for Cloud. Option D is wrong because it bypasses policy enforcement at the management group level and uses manual processes.

Answer

Create separate management groups per business unit. Enable Microsoft Defender for Cloud on each subscription individually. Use Azure Policy to assign PCI DSS policies per subscription. Configure PIM at the tenant root management group. Use a third-party SIEM to aggregate alerts.

Answer

Deploy a management group hierarchy with policies inherited. Use Microsoft Defender for Cloud's secure score to monitor compliance manually. Implement PIM without JIT. Use Microsoft Sentinel but only for cloud workloads.

Answer

Use a single management group with Azure Policy to enforce PCI DSS controls. Rely on Azure Monitor for security alerts. Do not enable Defender for Cloud to reduce costs. Use PIM for privileged roles. Connect on-premises logs to a Log Analytics workspace for the SOC.

Question 10

Your organization uses Microsoft Defender for Office 365 to protect against phishing attacks. The security team wants to implement a custom advanced phishing threshold policy that blocks suspicious emails more aggressively. Which policy type should they modify?

Accepted Answer

Anti-phishing policy. The Anti-phishing policy in Microsoft Defender for Office 365 includes the Advanced Phishing Threshold (APT) settings that allow administrators to control the aggressiveness of phishing detection. By modifying the anti-phishing policy, you can set the phishing threshold to 'Aggressive' or 'Most Aggressive,' which applies more stringent machine learning models to block suspicious emails earlier. This is the correct policy type because it directly governs the phishing threshold level, not attachment or link scanning.

Answer

ATP policy

Answer

Safe Attachments policy

Answer

Safe Links policy

Question 11

A company is designing a security operations center (SOC). They want to use Microsoft Sentinel as their SIEM. They need to ensure that all security events from on-premises servers are collected. Which data connector should they configure?

Accepted Answer

Windows Security Events via Azure Monitor Agent (AMA). Option D is correct because the Windows Security Events via Azure Monitor Agent (AMA) connector is the recommended method for collecting security events from on-premises Windows servers into Microsoft Sentinel. AMA is the current generation agent that supports data collection rules (DCRs) for granular filtering and is fully supported by Sentinel, replacing the legacy Log Analytics Agent. This ensures comprehensive collection of Windows security logs such as Event ID 4625 (failed logons) and 4688 (process creation) for SOC analysis.

Answer

Windows Firewall via Legacy Agent

Answer

Syslog via AMA

Answer

Azure Activity Log

Question 12

Which TWO Microsoft security solutions should be integrated to provide a comprehensive Zero Trust architecture that includes identity protection, endpoint detection, and response? (Select exactly two correct options.)

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (B) is correct because it provides unified endpoint detection and response (EDR) across devices, email, and identities, integrating signals from Microsoft Defender for Endpoint, Defender for Office 365, and Defender for Identity. Microsoft Entra ID (C) is correct because it delivers identity protection through Conditional Access, risk-based policies, and identity governance, forming the identity pillar of a Zero Trust architecture. Together, they cover identity protection and endpoint detection/response, two core Zero Trust components.

Answer

Microsoft 365 E5

Answer

Microsoft Sentinel

Answer

Microsoft Purview

Question 13

You are designing a security solution for a hybrid identity environment that uses Microsoft Entra ID and on-premises Active Directory. The company wants to enforce Zero Trust principles by continuously verifying user access. Which feature should you implement?

Accepted Answer

Implement Conditional Access policies that evaluate session risk in real time using continuous access evaluation. Option B is correct because session risk-based Conditional Access with continuous access evaluation (CAE) enables real-time risk assessment and enforcement. Option A is wrong because Azure AD Join is for devices, not continuous verification. Option C is wrong because Seamless SSO simplifies sign-on but does not enforce continuous verification. Option D is wrong because MFA registration does not provide continuous verification during sessions.

Answer

Implement Microsoft Entra Hybrid Join for all devices

Answer

Implement Microsoft Entra Seamless Single Sign-On

Answer

Implement Microsoft Entra ID Protection to require multi-factor authentication for all users

Question 14

Adventure Works is a startup that uses Microsoft 365 Business Premium. They have 20 employees and no cloud expertise. The CEO has been hearing about ransomware attacks on small businesses. They want to implement basic protection against ransomware using built-in Microsoft 365 features. They also want to ensure they can recover from an attack quickly. What should you recommend?

Accepted Answer

Enable Microsoft Defender for Office 365 to block malicious attachments and links. Configure Microsoft Defender for Business to enable controlled folder access and ransomware protection. Educate users on phishing. Use OneDrive Files Restore to recover from ransomware.. Option B is correct because it leverages built-in Microsoft 365 Business Premium features to provide immediate ransomware protection without requiring cloud expertise. Microsoft Defender for Office 365 blocks malicious attachments and links at the email gateway, while Defender for Business provides endpoint protection with controlled folder access. OneDrive Files Restore enables self-service recovery of files from ransomware within the last 30 days, aligning with the startup's need for quick recovery without additional infrastructure.

Answer

Purchase Azure Backup for all user devices. Configure backup policies to run daily. Use Microsoft Intune to enforce encryption. Implement Conditional Access to require MFA.

Answer

Use Microsoft Sentinel as a SIEM to detect ransomware patterns. Deploy Azure ATP for identity protection. Use Azure Policy to enforce backup.

Answer

Implement Azure Site Recovery for on-premises servers. Use Microsoft Defender for Cloud for threat detection. Deploy a third-party antivirus.

Question 15

A company uses Microsoft Intune to manage devices. They want to ensure that all devices accessing corporate email are compliant with security policies before they can connect. Which feature should they enable?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct feature because it enforces compliance-based access control at the authentication layer. By integrating with Intune compliance policies, Conditional Access can block or allow device access to corporate email (e.g., Exchange Online) based on real-time compliance status, ensuring only compliant devices can connect.

Answer

Microsoft Defender for Endpoint

Answer

Microsoft Intune App Protection Policies

Answer

Mobile Device Management (MDM) enrollment