SC-100 Practice Test 17 — 15 Questions

Question 1

Order the steps to troubleshoot an Azure VPN gateway connection failure.

Accepted Answer

First, verify the Azure VPN gateway configuration and status in the Azure portal. Next, check the on-premises VPN device configuration and connectivity. Then, verify the shared key and IPsec/IKE parameters match. Finally, if issues persist, initiate a reset of the Azure VPN gateway.. Troubleshooting starts with Azure side, then on-premises, and may require reset.

Answer

First, reset the Azure VPN gateway. Next, verify the on-premises VPN device configuration. Then, check the Azure VPN gateway status. Finally, regenerate the shared key.

Answer

First, check the on-premises VPN device. Next, verify the Azure VPN gateway. Then, reset the on-premises device. Finally, update the shared key.

Answer

First, change the shared key. Next, reset the Azure VPN gateway. Then, check the on-premises device. Finally, verify the Azure gateway.

Question 2

A company deploys Microsoft Defender for Cloud Apps. They need to detect anomalous behavior in user activities across multiple cloud apps. Which feature should they enable?

Accepted Answer

Anomaly detection policies. Anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify unusual patterns in user activities across connected cloud apps, such as impossible travel, mass file downloads, or ransomware-like behavior. These policies leverage machine learning and behavioral analytics to establish a baseline of normal user behavior and trigger alerts when deviations occur, making them the correct choice for detecting anomalous behavior.

Answer

Session policies

Answer

Data loss prevention policies

Answer

App governance

Question 3

Fabrikam is a healthcare organization that uses Microsoft 365 E5 and Azure. They have a hybrid identity environment with Active Directory on-premises synced to Microsoft Entra ID. The security team wants to implement a Zero Trust strategy following the 'verify explicitly' principle. They need to ensure that all access to Microsoft 365 services and Azure applications is conditionally enforced based on real-time risk signals. Additionally, they want to block legacy authentication protocols that do not support modern authentication. The solution must integrate with Microsoft Defender XDR and Microsoft Sentinel for threat intelligence. Which combination of technologies should you recommend?

Accepted Answer

Use Microsoft Entra Conditional Access policies with session controls from Microsoft Defender for Cloud Apps. Enable Microsoft Entra ID Protection to feed risk signals into Conditional Access. Block legacy authentication via a Conditional Access policy targeting 'Exchange Active Sync' and 'Other clients'. Integrate Microsoft Sentinel to ingest alerts from Defender XDR.. It directly implements the 'verify explicitly' principle by using Microsoft Entra ID Protection to feed real-time risk signals into Conditional Access policies, which then enforce session controls via Microsoft Defender for Cloud Apps. It blocks legacy authentication through a targeted Conditional Access policy (not just disabling protocols in Exchange Online or at the firewall), and integrates Microsoft Sentinel to ingest alerts from Defender XDR for centralized threat intelligence. This combination ensures all access to Microsoft 365 and Azure applications is conditionally enforced based on dynamic risk, while also addressing the requirement to block legacy protocols that lack modern authentication support.

Answer

Implement Azure AD Identity Governance with access reviews. Use Conditional Access to require hybrid Azure AD joined devices. Block legacy authentication by disabling protocols in Exchange Online. Use Azure Sentinel without Defender XDR.

Answer

Use Azure AD B2B for external users only. Configure Conditional Access with MFA for all users. Use Azure AD Identity Protection for risk. Block legacy authentication at the firewall level.

Answer

Deploy Microsoft Intune for mobile device management and require compliant devices. Use Conditional Access to block legacy protocols. Rely on Azure ATP (now Microsoft Defender for Identity) for risk signals.

Question 4

A company is designing an application architecture using Azure Kubernetes Service (AKS) and Azure Cosmos DB. The application requires that secrets (database connection strings) be injected into pods securely without storing them in the container image. The solution must minimize management overhead. What is the recommended approach?

Accepted Answer

Use Azure Key Vault Provider for Secrets Store CSI Driver to mount secrets as volumes in pods.. The Azure Key Vault Provider for Secrets Store CSI Driver integrates directly with AKS to securely inject secrets from Azure Key Vault into pods as mounted volumes or environment variables, without storing them in container images or Kubernetes objects. This approach minimizes management overhead by leveraging Azure-managed Key Vault for secret lifecycle management and avoids the operational burden of manually managing Kubernetes Secrets.

Answer

Store secrets in a Kubernetes ConfigMap and reference them in the deployment YAML.

Answer

Define secrets in a Kubernetes Secret object and reference them in the pod spec.

Answer

Hardcode the connection string in an environment variable in the deployment manifest.

Question 5

Refer to the exhibit. An Azure policy is defined as shown. Which resources will be audited?

Accepted Answer

Virtual machines with Standard_LRS managed disks. The Azure policy definition in the exhibit uses the 'audit' effect to evaluate a condition that checks whether the virtual machine's managed disk storage account type is 'Standard_LRS'. When the condition is true (i.e., the VM has a Standard_LRS managed disk), the policy triggers an audit event. Therefore, the policy audits all virtual machines with Standard_LRS managed disks, making option C correct. Options A, B, and D are incorrect because the policy does not audit all non-compliant resources, unmanaged disks, or VMs with Premium_LRS disks of size 1024 GB.

Answer

All Azure resources that are not compliant

Answer

All virtual machines with unmanaged disks

Answer

Virtual machines with Premium_LRS managed disks and disk size 1024 GB

Question 6

Your organization has Microsoft Sentinel. You need to create an analytics rule that detects when a user account is created outside of business hours (9 AM to 5 PM, Monday-Friday). Which KQL query should you use as the rule query?

Accepted Answer

... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) !between (9 .. 17). `dayofweek()` returns 1 for Sunday, 2 for Monday, ..., 7 for Saturday. To represent Monday (2) through Friday (6), the range must be `between (2 .. 6)`. The `!between (9 .. 17)` correctly excludes the 9 AM to 5 PM business hours, so the rule triggers only when a user account is created outside those hours on a weekday.

Answer

... | where dayofweek(TimeGenerated) between (1 .. 5) and datetime_part("hour", TimeGenerated) !between (9 .. 17)

Answer

... | where dayofweek(TimeGenerated) between (2 .. 6) and datetime_part("hour", TimeGenerated) between (9 .. 17)

Answer

... | where dayofweek(TimeGenerated) !between (2 .. 6) or datetime_part("hour", TimeGenerated) between (9 .. 17)

Question 7

Your organization is migrating on-premises applications to Azure and needs to secure secrets (database connection strings, API keys) used by these applications. You are required to rotate secrets automatically without downtime. Which Azure service should you use?

Accepted Answer

Azure Key Vault with managed identity and certificate auto-rotation. Azure Key Vault with managed identity and certificate auto-rotation is correct because it provides a centralized, secure store for secrets like database connection strings and API keys, supports automatic rotation of certificates and secrets via Event Grid notifications or lifecycle policies, and integrates with Azure resources using managed identities to enable zero-downtime rotation without exposing credentials in code or configuration.

Answer

Microsoft Purview Information Protection

Answer

Azure App Configuration with feature flags

Answer

Azure AD Application Proxy

Question 8

Your organization uses Microsoft Defender for Cloud Apps. You need to detect and block data exfiltration from sanctioned cloud apps to personal devices. What should you configure?

Accepted Answer

Create a session policy with app governance to block download.. A session policy with app governance in Microsoft Defender for Cloud Apps allows you to monitor and control user activities in real time. By configuring a session policy to block downloads, you can prevent data exfiltration from sanctioned cloud apps to personal devices, as the policy inspects HTTP/HTTPS traffic and enforces access controls based on user context and device compliance.

Answer

Create an OAuth app policy to revoke permissions.

Answer

Create an app discovery policy to identify unsanctioned apps.

Answer

Create a file policy to detect sensitive data in sanctioned apps.

Question 9

A global retail company, Northwind Traders, is adopting a cloud-first strategy using Azure and Microsoft 365. They have a large number of temporary seasonal workers who need access to specific applications and data for limited periods. The security team wants to minimize the risk of standing privileges and ensure that access is granted only when needed and for a limited duration. They also need to audit all privileged access actions. The environment includes Microsoft Entra ID, Azure resources, and Microsoft 365 services. You need to design a privileged access strategy that follows the principle of least privilege and aligns with Microsoft's best practices for privileged identity management. What should you recommend?

Accepted Answer

Use Microsoft Entra Privileged Identity Management (PIM) to grant just-in-time access to Azure AD roles and Azure resources. Configure approval workflows for high-privilege roles. Set maximum activation durations. For non-Azure resources, use Privileged Access Groups (PAG) to manage access. Enable audit logging to a Log Analytics workspace for monitoring.. It leverages Microsoft Entra Privileged Identity Management (PIM) to enforce just-in-time (JIT) access for Azure AD roles and Azure resources, aligning with the principle of least privilege and minimizing standing privileges. It includes approval workflows for high-privilege roles, maximum activation durations to limit exposure, and Privileged Access Groups (PAG) to manage access to non-Azure resources like Microsoft 365 workloads. Audit logging to a Log Analytics workspace provides comprehensive monitoring of all privileged actions, meeting the auditing requirement.

Answer

Create a custom role in Azure AD with limited permissions. Assign the role to a security group. Have users request access via a manual email process. The IT team approves and assigns the group membership temporarily.

Answer

Assign permanent roles to seasonal workers for the duration of their contract. Use Azure AD access reviews to periodically confirm access. Enable Azure AD audit logs. Use Conditional Access to require MFA for privileged roles.

Answer

Create separate Azure AD roles for each seasonal worker with granular permissions. Use Azure AD Identity Governance to automate access requests. Do not enable PIM to reduce complexity.

Question 10

Your organization uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

Create a Conditional Access policy that requires compliant device. A Conditional Access policy in Microsoft Entra ID (formerly Azure AD) can enforce the requirement that only devices marked as compliant by Intune can access corporate email. This policy evaluates the device compliance status at authentication time and blocks or grants access based on that signal, ensuring that only managed and compliant devices can connect to services like Exchange Online.

Answer

Set up enrollment restrictions in Intune

Answer

Create a device configuration policy that blocks non-compliant devices

Answer

Configure an app protection policy for email apps

Question 11

Your company uses Microsoft Defender for Cloud Apps (MDA). You need to create a policy that automatically suspends a user's access to a cloud app if the user is confirmed as compromised by Microsoft Entra ID Protection. Which policy type should you use?

Accepted Answer

Session policy. A session policy in Microsoft Defender for Cloud Apps can be configured to take real-time actions based on risk signals from Microsoft Entra ID Protection. When a user is confirmed as compromised, a session policy can enforce automatic suspension of access to cloud apps by blocking the session or requiring reauthentication, directly addressing the requirement.

Answer

Access policy

Answer

App permissions policy

Answer

Anomaly detection policy

Question 12

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the purpose of this query?

Accepted Answer

Identify malware alerts on unmanaged devices. The query uses the `DeviceInfo` table to filter for devices where `IsManaged` is `false`, then joins with `SecurityAlert` to find alerts where `AlertName` contains 'Malware'. This specifically identifies malware alerts generated on unmanaged devices, not all malware alerts or a general device inventory.

Answer

Correlate malware alerts with device OS version

Answer

List all malware alerts in the last 7 days

Answer

Show device inventory for unmanaged devices

Question 13

Your organization plans to use Microsoft Purview to protect sensitive data in Microsoft 365. The compliance team needs to detect when users share credit card numbers via email and automatically apply encryption. Which solution should you implement?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP). Microsoft Purview Data Loss Prevention (DLP) is the correct solution because it is specifically designed to detect sensitive data types—such as credit card numbers—in email messages and automatically apply protective actions like encryption. DLP policies can inspect email content in transit via Exchange Online, match patterns against predefined sensitive info types (e.g., credit card number regex), and trigger actions such as 'Encrypt the message' using Azure Rights Management. This directly meets the requirement to detect sharing of credit card numbers and enforce encryption automatically.

Answer

Microsoft Purview Audit

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Information Protection

Question 14

Your organization uses Microsoft Sentinel for security operations. You need to ensure that an attacker cannot disable data collection by deleting the diagnostic settings on the Sentinel workspace. What should you configure?

Accepted Answer

Apply a CanNotDelete resource lock on the Log Analytics workspace.. Applying a CanNotDelete resource lock on the Log Analytics workspace prevents any user or process, including an attacker, from deleting the workspace or its diagnostic settings. This lock overrides all role-based permissions, ensuring that even if an attacker gains high-privileged access, they cannot remove the diagnostic settings that stream telemetry to Microsoft Sentinel. Sentinel's data collection relies entirely on these diagnostic settings, so protecting them with a resource lock is the most direct and effective defense against deletion attacks.

Answer

Enable Sentinel's workspace deletion protection.

Answer

Assign the Log Analytics Contributor role only to specific users.

Answer

Create an Azure Policy to audit diagnostic settings.

Question 15

Your organization uses Microsoft Entra ID and plans to implement a Zero Trust security model. You need to ensure that all access requests to corporate applications are continuously evaluated based on user risk, device compliance, and location. Which Microsoft Entra ID feature should you configure?

Accepted Answer

Conditional Access. Conditional Access is the correct feature because it enables real-time policy evaluation of access requests based on signals such as user risk (from Identity Protection), device compliance (via Microsoft Intune), and location (IP address ranges or named locations). This aligns directly with the Zero Trust principle of 'never trust, always verify' by continuously re-evaluating each access attempt rather than relying on static permissions.

Answer

Identity Governance

Answer

Privileged Identity Management (PIM)

Answer

Identity Protection