SC-100 Practice Test 16 — 15 Questions

Question 1

Your organization uses Microsoft Purview Information Protection to classify and protect sensitive data. The compliance team wants to automatically apply a 'Highly Confidential' sensitivity label to emails that contain credit card numbers. Which solution should you configure?

Accepted Answer

Microsoft Purview auto-labeling policy. Option C is correct because Microsoft Purview auto-labeling policies can automatically apply sensitivity labels based on sensitive information types like credit card numbers. Option A is wrong because Microsoft 365 DLP policies block or warn, not apply labels. Option B is wrong because endpoint DLP protects data on devices, not email. Option D is wrong because Microsoft Defender for Office 365 protects against threats, not data classification.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Microsoft 365 Data Loss Prevention (DLP) policy

Answer

Microsoft Endpoint DLP

Question 2

Your company is designing a secure access strategy for a SaaS application that supports SAML 2.0. You need to enforce phishing-resistant authentication. Which THREE of the following methods meet the requirement?

Accepted Answer

FIDO2 security keys. FIDO2 security keys (Option B) are phishing-resistant because they use public-key cryptography and are bound to a specific web origin, preventing credential reuse on fake sites. The WebAuthn protocol ensures the private key never leaves the device, and the hardware key provides strong multi-factor authentication that cannot be intercepted or relayed.

Answer

Microsoft Authenticator push notifications

Answer

SMS one-time passcode (OTP)

Question 3

An organization wants to ensure that all Windows 10 devices are compliant with security policies before they can access corporate email. Microsoft Intune is used for device management. Which component should be used to enforce compliance and block non-compliant devices?

Accepted Answer

Microsoft Entra ID Conditional Access policy integrated with Intune compliance. Option B is correct because Microsoft Entra ID Conditional Access policies can evaluate Intune device compliance status in real time. When a device is marked non-compliant by an Intune compliance policy, the Conditional Access policy blocks access to corporate email (e.g., Exchange Online) until the device is remediated. This integration enforces a 'compliant device required' gate that cannot be achieved by Intune compliance alone, which only reports status without blocking access.

Answer

Intune device compliance policy alone

Answer

Microsoft 365 Defender portal

Answer

Microsoft Defender for Endpoint device risk score

Question 4

Your organization wants to implement a defense-in-depth strategy for Azure virtual machines. Which THREE of the following should you include?

Accepted Answer

Azure Disk Encryption for OS and data disks. Azure Disk Encryption (ADE) uses BitLocker for Windows and DM-Crypt for Linux to encrypt OS and data disks at rest, protecting against unauthorized access to the physical disk. This is a foundational layer of defense-in-depth, ensuring that if an attacker gains access to the disk, the data remains unreadable without the encryption keys stored in Azure Key Vault.

Answer

Azure Firewall to inspect all traffic to the VMs

Answer

Azure Bastion to provide secure RDP and SSH access

Question 5

Your organization uses Microsoft Sentinel to centralize security logs from multiple clouds. They need to ensure that logs from Amazon Web Services (AWS) are ingested and analyzed for threats. Which connector should you implement?

Accepted Answer

AWS S3 connector. The AWS S3 connector is the correct choice because it is the native Microsoft Sentinel data connector designed specifically to ingest AWS CloudTrail logs (and other AWS service logs) from an S3 bucket. It uses an AWS Simple Queue Service (SQS) to poll for new log files, then streams them into Sentinel for analysis, enabling threat detection across multi-cloud environments.

Answer

Microsoft Defender for Cloud

Answer

Azure Monitor Agent

Answer

Azure Event Hubs

Question 6

You are designing a security baseline for Azure resources that host a critical application. The application uses Azure SQL Database, Azure Storage, and Azure Key Vault. You need to ensure that all resources use managed identities for authentication and that no secrets are stored in code or configuration files. Which combination of controls should you include in the baseline?

Accepted Answer

Use system-assigned managed identities for all resources. Configure each resource to use the managed identity. Disable local authentication on Key Vault and Storage. Enable Azure AD-only authentication on SQL Database.. Option C is correct because it enforces the principle of using managed identities for authentication without storing any secrets. System-assigned managed identities are tied directly to each Azure resource, eliminating the need for credential management. Disabling local authentication on Key Vault and Storage, and enabling Azure AD-only authentication on SQL Database, ensures that only managed identities (or other Azure AD identities) can authenticate, meeting the requirement that no secrets are stored in code or configuration files.

Answer

Use user-assigned managed identities for all resources. Configure Key Vault access policies to allow the managed identity. Disable anonymous access to Storage.

Answer

Use system-assigned managed identities for all resources. Store connection strings in Key Vault secrets and configure SQL Database to use Azure AD authentication.

Answer

Use user-assigned managed identities for all resources. Create a service principal with a client secret for Key Vault access.

Question 7

You are designing a security solution for a multinational organization that uses Microsoft Entra ID. They have a hybrid identity environment with Active Directory on-premises. The security team requires that all administrative actions in Microsoft Entra ID are logged and monitored in real-time with alerts for critical changes. Which two data sources should you stream to Microsoft Sentinel?

Accepted Answer

Microsoft Entra ID Sign-in Logs. Microsoft Entra ID Audit Logs contain records of all administrative changes and configuration modifications within the tenant, such as user role assignments, group membership updates, and application permission grants. Streaming these logs to Microsoft Sentinel enables real-time monitoring and alerting for critical administrative actions, meeting the security team's requirement for logging and alerting on all administrative actions.

Answer

Azure Activity Log

Answer

Microsoft Entra ID Provisioning Logs

Question 8

Which THREE components should be part of a secure DevOps pipeline using Microsoft security tools? (Select exactly three correct options.)

Accepted Answer

Microsoft Purview. Microsoft Purview is correct because it provides data governance and compliance capabilities, including data classification, labeling, and data loss prevention (DLP) policies, which are essential for securing sensitive data within a DevOps pipeline. It integrates with Azure DevOps and GitHub to automatically detect and protect secrets, credentials, and other sensitive information in code repositories and CI/CD artifacts, ensuring that data security policies are enforced throughout the development lifecycle.

Answer

Azure Firewall

Answer

Azure Front Door

Question 9

Your organization uses Microsoft Sentinel as its SIEM. You need to design a solution to automatically respond to detected threats in Azure resources. The response must include isolating the affected virtual machine and creating a support ticket. Which approach should you use?

Accepted Answer

Create a Microsoft Sentinel automation rule that triggers a playbook when an incident is generated. The playbook uses Azure Logic Apps to isolate the VM and create a ticket in your IT service management tool.. Option C is correct because automation rules in Microsoft Sentinel can trigger playbooks (Logic Apps) to isolate VMs and create tickets. Option A is wrong because Azure Policy is for compliance, not incident response. Option B is wrong because Azure Automation runbooks lack the integration to create tickets directly. Option D is wrong because custom KQL queries only surface alerts, not automated response.

Answer

Create an Azure Policy initiative that automatically remediates non-compliant resources

Answer

Create a Microsoft Sentinel analytics rule that runs a KQL query and automatically sends an email to the security team

Answer

Create an Azure Automation runbook that runs on a schedule to check for threats and isolate VMs

Question 10

Wide World Importers uses Azure Active Directory (now Microsoft Entra ID) and Microsoft 365. They have a hybrid identity with password hash sync. They want to implement a passwordless authentication strategy to improve security and user experience. They have a mix of Windows 10/11 devices and mobile devices (iOS/Android). They also have some shared computers in kiosk mode. The solution must support all user scenarios and align with Microsoft's authentication best practices. What should you recommend?

Accepted Answer

Implement Windows Hello for Business for Windows 10/11 devices. Deploy Microsoft Authenticator for mobile devices for passwordless sign-in. Use FIDO2 security keys for shared computers and kiosk scenarios. Enable combined registration for self-service password reset and Microsoft Authenticator.. Option A is correct because it covers all user scenarios: Windows Hello for Business for Windows devices, Microsoft Authenticator for mobile, and FIDO2 security keys for shared computers. Option B is wrong because SMS and OATH tokens are not passwordless (SMS is not truly passwordless). Option C is wrong because it relies on Microsoft Authenticator only, missing Windows devices. Option D is wrong because it excludes mobile devices.

Answer

Use SMS-based authentication for all users. Deploy OATH tokens for shared computers. Implement Azure AD Conditional Access to require passwordless for admins only.

Answer

Implement Windows Hello for Business for all Windows devices. Use smart cards for mobile devices. Use FIDO2 keys for shared computers.

Answer

Use the Microsoft Authenticator app for all users. Configure passwordless sign-in with the app. Use QR codes for kiosk computers.

Question 11

Your organization is migrating to Microsoft 365 and wants to implement a defense-in-depth strategy for email security. Which combination of Microsoft services should you use?

Accepted Answer

Microsoft Defender for Office 365 and Exchange Online Protection. Defense-in-depth for email security requires layered protection at the transport, filtering, and post-delivery stages. Exchange Online Protection (EOP) provides baseline anti-malware, anti-spam, and transport rules, while Microsoft Defender for Office 365 adds advanced threat protection like Safe Attachments, Safe Links, and anti-phishing policies that inspect URLs and attachments in real time. Together, they cover the full email threat chain from ingress to user interaction.

Answer

Microsoft Purview Compliance Manager and Microsoft Defender for Cloud Apps

Answer

Microsoft Intune and Microsoft Entra ID

Answer

Microsoft Sentinel and Microsoft Defender for Identity

Question 12

South Ridge School District uses Microsoft 365 Education and Azure for administrative systems. They have a large number of students and staff. The district wants to implement a security solution that protects against phishing attacks, ransomware, and inappropriate content. They also need to comply with the Children's Online Privacy Protection Act (COPPA) and other educational regulations. The solution should be cost-effective and easy to manage. What should you recommend?

Accepted Answer

Use Microsoft Defender for Office 365 to protect against phishing and malware. Deploy Microsoft Intune for Education to manage student devices and enforce security policies. Enable Microsoft Purview Communication Compliance to monitor for inappropriate content. Use Microsoft Entra ID (free tier) with Security Defaults for identity protection.. Option D is correct because it provides a cost-effective, education-focused security solution that directly addresses the district's requirements. Microsoft Defender for Office 365 protects against phishing and malware in email and collaboration tools, Microsoft Intune for Education enables policy enforcement and device management for students, Microsoft Purview Communication Compliance monitors for inappropriate content to meet COPPA and other regulations, and Microsoft Entra ID (free tier) with Security Defaults provides baseline identity protection without additional licensing costs.

Answer

Use Microsoft Sentinel to analyze security logs. Deploy Microsoft Defender for Endpoint on all devices. Use Azure Policy to enforce compliance. Implement third-party web filtering.

Answer

Upgrade to Microsoft 365 E5 for all users. Implement Azure AD Identity Protection and PIM. Use Microsoft Defender for Identity. Use Microsoft Sentinel for SIEM.

Answer

Use Microsoft 365 Business Premium for staff only. Use free Microsoft 365 Education for students. Implement Conditional Access policies. Use Microsoft Cloud App Security to block risky apps.

Question 13

A multinational corporation, Contoso Ltd., is implementing Microsoft Purview to manage data governance across their Azure and Microsoft 365 environments. They need to discover sensitive data (e.g., credit card numbers, passport numbers) in Azure Blob Storage, Azure SQL Database, and SharePoint Online. The data must be classified and labeled automatically. Additionally, they want to prevent sensitive data from being shared externally via email and Teams. The solution should align with Microsoft's data security best practices. What should you recommend?

Accepted Answer

Deploy Microsoft Purview Data Map to scan Azure Blob Storage and Azure SQL Database. Create custom sensitivity labels to identify sensitive data types. Configure auto-labeling policies in Microsoft Purview to apply labels. Create Data Loss Prevention (DLP) policies in Microsoft Purview Compliance Portal to block external sharing of labeled content in email and Teams.. Option A is correct because Microsoft Purview Data Map can scan and classify data in Azure sources, and sensitivity labels can be applied automatically. DLP policies in Microsoft 365 (via Purview) can block external sharing. Option B is wrong because Azure Policy does not classify data. Option C is wrong because Azure Information Protection is deprecated. Option D is wrong because Defender for Cloud Apps is for cloud app security, not classification.

Answer

Use Azure Policy to enforce tagging on resources. Use Microsoft Defender for Cloud to identify sensitive data. Configure retention labels in Microsoft 365. Use Azure AD Conditional Access to block external sharing.

Answer

Use Microsoft Defender for Cloud Apps to discover sensitive data in cloud apps. Use Microsoft Purview Information Protection to label. Use Azure AD Identity Governance to manage access.

Answer

Use Azure Information Protection (AIP) to classify documents. Use Azure SQL Data Discovery & Classification for databases. Configure manual labeling rules. Use Microsoft 365 DLP policies.

Question 14

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) resources are assessed against the same security baseline. What should you do?

Accepted Answer

Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark. Microsoft Defender for Cloud can assess resources from Azure, AWS, and GCP using security policies. By default, Azure Policy is used for Azure resources. To assess AWS and GCP, you need to connect those cloud accounts to Defender for Cloud and then use Azure Policy to enforce standards like Microsoft Cloud Security Benchmark. Option A is wrong because the CSPM plan assesses posture but does not use a single baseline across clouds. Option C is wrong because regulatory compliance standards apply to specific regulations, not custom baselines. Option D is wrong because AWS Config and GCP Security Command Center are separate tools, not integrated into a single baseline.

Answer

Configure AWS Config and GCP Security Command Center to export findings to Microsoft Sentinel

Answer

Use regulatory compliance standards for each cloud separately

Answer

Enable the Cloud Security Posture Management (CSPM) plan and configure AWS and GCP connectors

Question 15

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires compliant device. Option A is correct because a Conditional Access policy in Microsoft Entra ID (formerly Azure AD) can enforce the requirement that only devices marked as compliant by Intune can access corporate email. This policy evaluates the device compliance status at authentication time and blocks or grants access based on that signal, ensuring that only managed and compliant devices can connect to services like Exchange Online.

Answer

Set up enrollment restrictions in Intune

Answer

Create a device configuration policy that blocks non-compliant devices

Answer

Configure an app protection policy for email apps