SC-100 Practice Test 16 — 15 Questions

Question 1

You are the security architect for a multinational corporation that uses Azure Active Directory (Azure AD) and Microsoft 365. The company has recently experienced a security incident where a compromised user account was used to access sensitive data from a legacy application that does not support modern authentication. To mitigate this risk, you have been asked to recommend a set of security best practices and priorities. The environment includes 50,000 users, 200 applications (many legacy), and a hybrid identity setup with Active Directory Domain Services (AD DS) synchronized to Azure AD via Azure AD Connect. The security team wants to reduce the attack surface, enforce least privilege, and improve identity protection. Current issues include: (1) many users have standing admin privileges on workstations, (2) legacy apps use shared service accounts with weak passwords, (3) Conditional Access policies are not applied consistently, and (4) there is no process for reviewing privileged role assignments. Which course of action should you recommend as the highest priority?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement Azure AD Privileged Identity Management (PIM) for just-in-time access and role approval workflows. Implementing Azure AD Privileged Identity Management (PIM) directly addresses the highest-priority risk: the lack of oversight and control over privileged role assignments. With 50,000 users and many standing admin privileges on workstations, PIM enables just-in-time (JIT) activation, approval workflows, and time-bound roles, which drastically reduces the attack surface by eliminating permanent privileged access. This is the most critical first step because unmanaged privileged accounts are the primary vector for lateral movement and data exfiltration, as demonstrated in the incident.

Answer

Migrate legacy applications to support modern authentication and use Azure AD Application Proxy

Answer

Deploy Azure AD Password Protection and enforce banned password lists

Answer

Implement Conditional Access policies to block legacy authentication and require MFA for all users

Question 2

Your organization uses Microsoft Entra ID and needs to ensure that external partners can access only specific applications for 30 days. What should you configure?

Accepted Answer

Entitlement management and create an access package with an expiration of 30 days. Entitlement management in Microsoft Entra ID allows you to create access packages that govern external partner access to specific applications. By configuring an access package with a 30-day expiration, you enforce time-limited access, ensuring partners can only access the designated applications for the required duration. This directly meets the requirement of restricting access to specific apps with a defined expiry.

Answer

B2B direct connect

Answer

Self-service group management

Answer

Conditional Access policy with session control

Question 3

Refer to the exhibit. You are reviewing a Microsoft Defender for Cloud automation resource. You want the automation to trigger a playbook in Microsoft Sentinel when a high-severity security assessment is found. Based on the exhibit, what is the missing configuration?

Accepted Answer

The action type should be 'LogicApp' instead of 'EventHub'. Microsoft Defender for Cloud automation can trigger a playbook in Microsoft Sentinel only by using a LogicApp action. The exhibit shows an EventHub action type, which is used for streaming events to an event hub, not for invoking a playbook. To trigger a Sentinel playbook from a Defender for Cloud assessment, the action type must be set to 'LogicApp' and configured with the playbook's trigger URL.

Answer

The severity filter should be 'Low' to capture all assessments

Answer

The eventSource should be 'Alerts' instead of 'Assessments'

Answer

The API version should be '2020-01-01'

Question 4

Your organization uses Microsoft Entra ID and wants to implement a passwordless authentication strategy. Users have smartphones. Which method should you recommend as the primary authentication method?

Accepted Answer

Microsoft Authenticator app with passwordless sign-in. The Microsoft Authenticator app with passwordless sign-in is the correct primary method because it leverages the user's smartphone to provide a seamless, phishing-resistant authentication experience using public/private key cryptography (FIDO2/WebAuthn). This method aligns with the organization's goal of eliminating passwords while utilizing existing smartphone hardware, and it supports a simple user experience by requiring only a biometric or PIN verification on the phone.

Answer

FIDO2 security keys

Answer

SMS-based authentication

Answer

Windows Hello for Business

Question 5

Wide World Importers uses Azure Active Directory (now Microsoft Entra ID) and Microsoft 365. They have a hybrid identity with password hash sync. They want to implement a passwordless authentication strategy to improve security and user experience. They have a mix of Windows 10/11 devices and mobile devices (iOS/Android). They also have some shared computers in kiosk mode. The solution must support all user scenarios and align with Microsoft's authentication best practices. What should you recommend?

Accepted Answer

Implement Windows Hello for Business for Windows 10/11 devices. Deploy Microsoft Authenticator for mobile devices for passwordless sign-in. Use FIDO2 security keys for shared computers and kiosk scenarios. Enable combined registration for self-service password reset and Microsoft Authenticator.. It aligns with Microsoft's passwordless authentication best practices by using Windows Hello for Business for Windows 10/11 devices (which supports biometric and PIN-based sign-in), Microsoft Authenticator for mobile devices (enabling phone-sign-in passwordless authentication), and FIDO2 security keys for shared computers and kiosk scenarios (which provide hardware-backed, phishing-resistant credentials). Combined registration streamlines the user enrollment process for both SSPR and Microsoft Authenticator, ensuring a seamless deployment across all device types.

Answer

Use SMS-based authentication for all users. Deploy OATH tokens for shared computers. Implement Azure AD Conditional Access to require passwordless for admins only.

Answer

Implement Windows Hello for Business for all Windows devices. Use smart cards for mobile devices. Use FIDO2 keys for shared computers.

Answer

Use the Microsoft Authenticator app for all users. Configure passwordless sign-in with the app. Use QR codes for kiosk computers.

Question 6

Your organization needs to comply with regulatory requirements for data retention and deletion. Which TWO Microsoft Purview features should you use?

Accepted Answer

Retention policies. Retention policies (A) are the correct choice because they allow you to define automated rules for retaining or deleting data at the container level (e.g., entire SharePoint sites, Exchange mailboxes, or OneDrive accounts) to meet regulatory requirements. Retention labels (D) are also correct because they provide granular, item-level control (e.g., specific documents or emails) for retention and deletion, and can be applied manually or automatically via trainable classifiers or sensitive information types. Together, they form the core of Microsoft Purview's data lifecycle management, ensuring compliance with data retention and deletion mandates.

Answer

Data Loss Prevention (DLP) policies

Answer

Audit logs

Answer

eDiscovery

Question 7

Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster?

Accepted Answer

Enable Azure AD integration for Kubernetes RBAC.. Integrating Azure AD with AKS enables Kubernetes RBAC to use Azure AD identities for authentication and authorization. This allows you to grant granular permissions to users, groups, or service principals based on their Azure AD roles, eliminating the need for static Kubernetes secrets and providing centralized identity management.

Answer

Disable HTTP application routing.

Answer

Enable Azure Firewall to restrict outbound traffic.

Answer

Use a service principal for AKS cluster authentication and store the secret in a Kubernetes secret.

Question 8

A company wants to use Microsoft Defender XDR to correlate alerts across endpoints, email, and identities. Which component enables this correlation?

Accepted Answer

Microsoft Defender XDR. Microsoft Defender XDR (the new name for Microsoft 365 Defender) is the unified pre- and post-breach enterprise defense suite that natively correlates signals from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, and Microsoft Defender for Cloud Apps. Its correlation engine uses machine learning and the Microsoft Intelligent Security Graph to fuse alerts across these domains into a single incident, enabling security teams to see the full attack chain from email to endpoint to identity.

Answer

Microsoft 365 Defender

Answer

Microsoft Sentinel

Answer

Microsoft Defender for Cloud

Question 9

A company is deploying Microsoft Defender for Cloud to secure their hybrid cloud environment. They need to ensure that regulatory compliance with PCI DSS is continuously monitored and reported. Which solution should they use to automatically assess and report compliance posture?

Accepted Answer

Regulatory compliance dashboard in Microsoft Defender for Cloud. The Regulatory compliance dashboard in Microsoft Defender for Cloud is the correct solution because it provides built-in, automated assessment of compliance against regulatory standards like PCI DSS. It continuously monitors your hybrid cloud environment against the PCI DSS controls, generates a compliance score, and produces detailed reports without requiring custom policy definitions. This dashboard integrates with Azure Policy to map controls to assessments, but the dashboard itself is the dedicated tool for viewing and reporting compliance posture.

Answer

Azure Policy

Answer

Microsoft Purview Information Protection

Answer

Microsoft Entra ID Governance

Question 10

Your organization is designing a security solution for a new web application that will be deployed on Azure App Service. The application will access an Azure SQL Database and an Azure Storage account. The security requirements include: (1) use managed identities for authentication, (2) encrypt data at rest and in transit, (3) restrict network access to the database and storage account to only the App Service, and (4) use Azure Key Vault for secrets management. Which TWO of the following should you implement?

Accepted Answer

Configure private endpoints for the SQL Database and Storage account.. (Configure private endpoints) ensures that network traffic to the SQL Database and Storage account is isolated to the virtual network, meeting the requirement to restrict network access to only the App Service. Option C (system-assigned managed identity) enables the App Service to authenticate to Azure SQL Database and Storage without storing credentials, aligning with the managed identity and Key Vault requirements. Option A is incorrect because using a connection string with a storage account access key introduces a secret and bypasses managed identity. Option D is incorrect because SAS tokens are also secrets and less secure than managed identities. Option E is incorrect because service endpoints do not provide the same level of private network isolation as private endpoints and rely on public endpoints with network rules.

Answer

Configure the App Service to use a connection string with a storage account access key.

Answer

Use shared access signatures (SAS) for the App Service to access the Storage account.

Answer

Configure service endpoints for the SQL Database and Storage account.

Question 11

Your organization uses Microsoft Sentinel and has enabled User and Entity Behavior Analytics (UEBA). The security team receives an alert for a user who has failed authentication 10 times in 5 minutes. What should you configure to reduce false positives while ensuring legitimate brute-force attacks are still detected?

Accepted Answer

Customize the anomaly threshold in UEBA. Customizing the anomaly threshold in UEBA allows you to adjust the sensitivity of the behavioral baseline, reducing false positives for users who legitimately fail authentication multiple times while still detecting true brute-force attacks. UEBA learns normal behavior patterns and flags deviations; by raising the threshold, you require a higher deviation from the baseline before an alert fires, preserving detection of actual attacks.

Answer

Disable UEBA for that user

Answer

Modify the analytics rule that triggered the alert

Answer

Create a playbook to auto-acknowledge the alert

Question 12

A company is using Microsoft Intune to manage devices. They need to ensure that only devices with a specific operating system version can access corporate resources. Which Intune policy should they use?

Accepted Answer

Compliance policy. Compliance policies in Microsoft Intune define the rules that devices must meet to be considered compliant, such as requiring a specific operating system version. When a device is marked non-compliant, Conditional Access policies can block access to corporate resources. This directly enforces the requirement that only devices with the correct OS version can access company data.

Answer

App protection policy

Answer

Enrollment restriction

Answer

Device configuration policy

Question 13

A company uses Azure Policy to enforce that all storage accounts must have HTTPS traffic only. They assign a built-in policy to audit this setting. A developer creates a new storage account with HTTP enabled, and the policy reports it as non-compliant. What should the company do to automatically remediate this violation?

Accepted Answer

Create a new policy assignment with a 'deployIfNotExists' effect that enables HTTPS-only.. The 'deployIfNotExists' effect in Azure Policy can automatically remediate non-compliant resources by deploying a configuration (such as enabling HTTPS-only) when the policy detects a violation. This effect runs a remediation task that modifies the resource to meet the policy requirement, eliminating the need for manual intervention. In this scenario, it would automatically enable HTTPS traffic on the storage account, bringing it into compliance.

Answer

Enable Azure Security Center's just-in-time access for storage accounts.

Answer

Change the policy effect to 'Deny' to prevent creation of non-compliant storage accounts.

Answer

Ask the developer to manually enable HTTPS-only on the storage account.

Question 14

Your company uses Microsoft Defender XDR to protect endpoints. The security team wants to implement automated response actions when a malicious file is detected on a device. Which Microsoft security feature should you configure to automatically isolate the affected device from the network?

Accepted Answer

Automated investigation and response (AIR) capabilities. Automated investigation and response (AIR) in Microsoft Defender XDR is the correct feature because it includes built-in playbooks that can automatically isolate a device from the network when a malicious file is detected. AIR leverages the Microsoft 365 Defender portal's automation capabilities to run investigation steps and execute response actions, such as device isolation, without manual intervention. This directly meets the requirement for automated response upon file detection.

Answer

Microsoft Sentinel automation rules

Answer

Attack surface reduction rules

Answer

Microsoft Intune compliance policies

Question 15

You are designing a solution to protect a web application hosted on Azure App Service. The application uses Azure SQL Database and stores sensitive customer data. You need to ensure that the data is encrypted at rest and in transit, and that the application is protected from common web attacks. Which TWO of the following should you implement?

Accepted Answer

Enforce TLS for Azure SQL Database connections. Enforce TLS for Azure SQL Database connections ensures data in transit is encrypted, meeting the encryption requirement. Option D: Azure Web Application Firewall (WAF) on Azure Front Door protects against common web attacks like SQL injection and XSS. Option A is incorrect because Azure Private Link provides private connectivity but does not directly protect against web attacks or encrypt data in transit. Option C is incorrect because Network Security Groups (NSGs) filter network traffic but do not provide encryption or web application protection. Option E is incorrect because Azure DDoS Protection Standard protects against network-layer attacks, not specifically web application attacks.

Answer

Azure Private Link for App Service

Answer

Network Security Groups (NSGs) on the subnet

Answer

Azure DDoS Protection Standard