SC-100 Practice Test 15 — 15 Questions

Question 1

Your company is migrating to Azure and needs to secure virtual networks with network segmentation. You need to design a solution that filters traffic between subnets based on application requirements. Which Azure service should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are the correct choice because they are Azure's native stateful packet-filtering service that can be associated with subnets (and NICs) to allow or deny traffic based on rules using source/destination IP, port, and protocol, which directly enables subnet-level segmentation per application requirements. Azure Firewall is a managed, centralized Layer 3-7 firewall for broader perimeter and egress control, not the primary mechanism for filtering traffic between subnets. Azure DDoS Protection mitigates volumetric and protocol-layer attacks against public endpoints and does not segment or filter inter-subnet traffic. Azure Bastion provides secure RDP/SSH access to VMs over TLS without public IPs and performs no subnet traffic filtering.

Answer

Azure DDoS Protection

Answer

Azure Firewall

Answer

Azure Bastion

Question 2

You are the security architect for a large financial services company. The company has a hybrid environment with on-premises Active Directory, Azure AD, and multiple Azure subscriptions. They use Microsoft Sentinel as their SIEM and have deployed Microsoft Defender for Cloud to assess their cloud security posture. Recently, the security team discovered that a critical Azure SQL database was exposed to the internet with a firewall rule allowing 'AllowAllWindowsAzureIps'. This misconfiguration was not flagged by Defender for Cloud because the corresponding recommendation was disabled in the security policy. The company wants to prevent such misconfigurations in the future and ensure that all critical resources are covered by security recommendations. They also need to ensure that any changes to security policies are reviewed and approved. Which of the following actions should you recommend as the most comprehensive solution?

Accepted Answer

Review and enable all relevant security recommendations in Defender for Cloud, and implement a change management process using Azure Policy and a custom workflow that requires approval before modifying security policies.. It addresses the root cause—disabled security recommendations—by enabling all relevant recommendations in Defender for Cloud, and it enforces a change management process using Azure Policy with a custom approval workflow. This ensures that any modifications to security policies are reviewed and approved, preventing future misconfigurations like the 'AllowAllWindowsAzureIps' rule from going unnoticed. The combination of policy enforcement and approval workflow provides a comprehensive, automated governance layer that covers both detection and prevention.

Answer

Deploy Azure Monitor alerts on all SQL Server firewall rule changes and instruct the security team to manually review each change.

Answer

Assign the Contributor role to the security team on the subscription so they can directly modify firewall rules if needed.

Answer

Enable the specific recommendation for SQL Server firewall rules in Defender for Cloud and set up an automation rule to send alerts when the recommendation is triggered.

Question 3

Your organization wants to implement a security information and event management (SIEM) solution that can ingest logs from multiple sources, including on-premises servers, Azure resources, and third-party SaaS applications. Which Microsoft service should you choose?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM solution specifically designed to ingest logs from diverse sources, including on-premises servers, Azure resources, and third-party SaaS applications, using built-in connectors for over 100 data sources. It provides centralized security analytics, threat detection, and incident response, making it the appropriate service for this multi-source log ingestion requirement.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor

Question 4

A security architect needs to design a solution that provides a unified view of security alerts from multiple clouds (Azure, AWS, GCP) and on-premises systems. The solution must also support automated response using playbooks. Which Microsoft service should they use?

Accepted Answer

Microsoft Sentinel. Microsoft Sentinel is the correct choice because it is a cloud-native SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) solution that ingests security alerts from multiple clouds (Azure, AWS, GCP) and on-premises systems via connectors. It supports automated response through playbooks built on Azure Logic Apps, enabling unified alert management and remediation workflows.

Answer

Microsoft Defender XDR

Answer

Microsoft Defender for Cloud

Answer

Microsoft Purview

Question 5

A company plans to implement a Zero Trust architecture using Microsoft security solutions. They want to ensure that all access to corporate resources is verified explicitly, uses least privilege, and assumes breach. Which Microsoft service should be the central policy engine for enforcing conditional access decisions?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the correct central policy engine because it directly enforces Zero Trust principles by evaluating signals (user, device, location, risk) in real time to grant or block access. It acts as the policy decision point (PDP) that enforces explicit verification, least privilege, and assumes breach by requiring continuous authentication and authorization for every access request.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 6

A company uses Microsoft Defender for Endpoint to protect endpoints. They want to configure attack surface reduction rules to block executable files from running unless they meet a specific prevalence, age, or trust level. Which ASR rule should they enable?

Accepted Answer

Block executable files from running unless they meet a prevalence, age, or trusted list criteria. The ASR rule 'Block executable files from running unless they meet a prevalence, age, or trusted list criteria' (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25) is specifically designed to block executables that do not meet Microsoft's cloud-based prevalence, age, or trustworthiness criteria. This rule uses the Microsoft Intelligent Security Graph to evaluate files against global telemetry, blocking those that are new, rare, or unsigned, which directly matches the requirement to block executables based on prevalence, age, or trust level.

Answer

Block Office communication application from creating child processes

Answer

Block credential stealing from the Windows local security authority subsystem

Answer

Block untrusted and unsigned processes that run from USB

Question 7

Your organization uses Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. You need to create a custom detection rule that triggers when a user receives a phishing email and then attempts to log in from a new location. Which approach should you use?

Accepted Answer

Use Advanced Hunting to create a custom detection rule. Advanced Hunting in Microsoft Defender XDR allows you to write Kusto Query Language (KQL) queries that correlate events across multiple data tables (e.g., EmailEvents, IdentityLogonEvents). You can then create a custom detection rule from that query, which will trigger an alert when a user receives a phishing email and subsequently logs in from a new location, enabling cross-domain correlation within Defender XDR.

Answer

Create a custom detection rule in Microsoft Defender for Endpoint

Answer

Use an automation rule in Microsoft Defender XDR

Answer

Create an analytics rule in Microsoft Sentinel

Question 8

Your organization uses Microsoft Purview and needs to prevent users from copying sensitive data to USB drives. Which solution should you implement?

Accepted Answer

Endpoint data loss prevention (DLP). Endpoint DLP is the correct solution because it extends data loss prevention policies to endpoints, enabling the detection and blocking of sensitive data being copied to removable USB drives. Unlike other controls, Endpoint DLP can monitor and restrict data exfiltration actions at the device level, such as copying files to USB media, based on the content's sensitivity classification.

Answer

Sensitivity labels with encryption

Answer

Insider Risk Management

Answer

Communication Compliance

Question 9

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to prioritize remediation of high-severity findings based on the greatest potential business impact. Which security policy or framework should you configure to align remediation with business priorities?

Accepted Answer

Enable the Regulatory Compliance dashboard. The Regulatory Compliance dashboard in Microsoft Defender for Cloud allows you to map security controls to specific regulatory standards (e.g., SOC 2, ISO 27001, PCI DSS) and track compliance posture. By selecting a framework that aligns with your organization's business obligations (e.g., a standard required by customers or regulators), you can prioritize remediation of high-severity findings based on the greatest potential business impact, such as fines or loss of certification.

Answer

Use the Azure Security Benchmark initiative

Answer

Set up workflow automation for high-severity findings

Answer

Configure the Secure Score dashboard

Question 10

Your organization uses Microsoft Defender XDR for detection and response. You need to create a custom detection rule that alerts when a user performs more than 10 failed sign-ins from different countries within 5 minutes. Which component should you use?

Accepted Answer

Custom detection rule in Microsoft 365 Defender. Custom detection rules in Microsoft 365 Defender allow you to define advanced hunting queries that trigger alerts based on specific event patterns, such as more than 10 failed sign-ins from different countries within 5 minutes. This is the correct component because it operates directly on data within the Defender XDR ecosystem (e.g., AADSignInEventsBeta) without requiring data ingestion into Sentinel.

Answer

Automation rule in Microsoft Sentinel

Answer

Analytics rule in Microsoft Sentinel

Answer

Attack simulation training

Question 11

Your organization is implementing Microsoft Entra ID Conditional Access. You need to require multi-factor authentication (MFA) for all users accessing financial applications, but only when the sign-in risk is medium or higher. What is the most efficient way to achieve this?

Accepted Answer

Create a Conditional Access policy that targets the financial applications, uses sign-in risk as a condition, and requires MFA. It uses a single Conditional Access policy to target the specific financial applications and sets the sign-in risk condition to medium or higher, which triggers MFA only when the risk threshold is met. This approach is efficient as it avoids per-user MFA configuration and leverages Microsoft Entra ID Protection's risk detection to dynamically enforce MFA based on real-time sign-in risk, aligning with the principle of adaptive access control.

Answer

Create a Microsoft Entra ID Protection user risk policy to require MFA

Answer

Enable MFA per user for all users in the financial team

Answer

Create a Conditional Access policy that targets all users, includes a named location, and requires MFA

Question 12

Your organization uses Microsoft Sentinel as a SIEM. The security team wants to use Microsoft Copilot for Security to assist in incident investigation. You need to ensure that Copilot can access Sentinel data while meeting compliance requirements. Which integration should you configure?

Accepted Answer

Enable Microsoft Copilot for Security plugin for Sentinel. The Microsoft Copilot for Security plugin for Sentinel is the correct integration because it enables Copilot to directly query and analyze Sentinel data through a native, compliant connection. This plugin uses Sentinel's API and role-based access control (RBAC) to ensure that Copilot only accesses data the user is authorized to see, meeting compliance requirements without additional data movement.

Answer

Deploy a playbook to query Sentinel data

Answer

Enable Sentinel's Threat Intelligence connectors

Answer

Use Microsoft Defender for Cloud

Question 13

A company uses Azure DevOps for CI/CD. The security team wants to ensure that secrets like API keys and connection strings are never stored in code repositories. Which best practice should they recommend?

Accepted Answer

Use Azure Key Vault references in Azure DevOps variable groups. Azure Key Vault references in Azure DevOps variable groups allow secrets to be securely linked to pipelines without ever storing them in code repositories. At pipeline runtime, the agent retrieves the secret value directly from Azure Key Vault using a managed identity or service principal, ensuring secrets are never exposed in YAML files, logs, or build artifacts.

Answer

Use environment variables in the pipeline YAML

Answer

Encrypt secrets using Git-secret and commit to repo

Answer

Store secrets in Azure App Configuration with encryption

Question 14

A company uses Microsoft Purview to manage data governance. They need to classify sensitive data automatically in Azure SQL Database. What should they configure?

Accepted Answer

Microsoft Purview Data Map scanning rules. Microsoft Purview Data Map scanning rules are the correct choice because they enable automated classification of sensitive data in Azure SQL Database by scanning the database schema and content against built-in or custom sensitive data types. This is the native mechanism within Purview to discover and label sensitive columns, such as credit card numbers or PII, directly in Azure SQL Database.

Answer

Microsoft Defender for Cloud regulatory compliance

Answer

Microsoft Sentinel data connectors

Answer

Microsoft Entra ID Protection

Question 15

A company uses Microsoft Entra ID Governance. They need to automate the process of granting access to a SaaS application based on the user's department attribute. Which feature should they use?

Accepted Answer

Entitlement management. Entitlement management in Microsoft Entra ID Governance allows you to create access packages that define collections of resources (like SaaS apps) and policies for who can request access. By configuring a dynamic membership rule based on the user's department attribute, you can automate granting access to the SaaS application without manual intervention. This directly meets the requirement to automate access based on a user attribute.

Answer

Lifecycle workflows

Answer

Access reviews

Answer

Privileged identity management