SC-100 Practice Test 17 — 15 Questions

Question 1

A company is adopting Microsoft Purview for data security. They need to prevent users from sharing sensitive data like credit card numbers via email. Which feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) policy. Data Loss Prevention (DLP) policies in Microsoft Purview are specifically designed to detect and prevent the accidental or intentional sharing of sensitive information, such as credit card numbers, through email and other channels. By configuring a DLP policy with a rule that scans for credit card number patterns (using predefined or custom sensitive info types), the system can block, quarantine, or notify users when such data is sent via Exchange Online. This directly addresses the requirement to prevent sharing sensitive data via email.

Answer

Audit log search

Answer

Insider Risk Management policy

Answer

Sensitivity labels

Question 2

You are designing a compliance solution for your organization that must enforce retention policies for documents stored in SharePoint Online. Which Microsoft Purview solution should you use?

Accepted Answer

Microsoft Purview Data Lifecycle Management. Microsoft Purview Data Lifecycle Management (formerly Microsoft 365 Retention) is the correct solution because it is specifically designed to enforce retention policies for documents in SharePoint Online. It allows you to apply retention labels and policies that automatically retain or delete content based on compliance requirements, without user intervention.

Answer

Microsoft Purview eDiscovery

Answer

Microsoft Purview Communication Compliance

Answer

Microsoft Purview Insider Risk Management

Question 3

Which THREE components are required to implement a secure hybrid network with Azure using a site-to-site VPN?

Accepted Answer

Public IP address for the VPN device. To implement a secure hybrid network with Azure using a site-to-site VPN, three components are required: a virtual network gateway (which provides the VPN termination), a local network gateway (which represents the on-premises network), and a public IP address (which is assigned to the virtual network gateway to enable communication over the internet). The VPN gateway (option C) is not a separate component; it is a type of virtual network gateway. An ExpressRoute circuit (option B) is for dedicated private connections, not VPN.

Answer

ExpressRoute circuit

Answer

VPN gateway (route-based)

Question 4

Refer to the exhibit. A security architect reviews the Azure AD Conditional Access policy JSON. The policy is intended to require MFA for all users accessing Azure management (Microsoft Azure Management app ID 797f4846-ba77-4853-9e6f-4433c3e1d1c5), except for the BreakGlassAdmin account and from trusted locations. However, some users report being prompted for MFA even when connecting from the corporate office (which is marked as a trusted location). What is the most likely cause?

Accepted Answer

The corporate office location is not correctly defined as a trusted location in Azure AD. The policy is designed to require MFA for all users accessing Azure management, except for the BreakGlassAdmin account and from trusted locations. If the corporate office location is not correctly defined as a trusted location in Microsoft Entra ID, the Conditional Access policy will not recognize it as an exception, and users connecting from that location will still be prompted for MFA. This mismatch between the intended trusted location definition and the actual location configuration is the most likely cause of the unexpected MFA prompts.

Answer

The grant controls operator is set to 'OR' instead of 'AND'

Answer

The policy is in 'Report-only' mode

Answer

The policy applies to all cloud apps, not just Azure management

Question 5

Refer to the exhibit. You are reviewing a Conditional Access policy JSON. What is the effect of this policy?

Accepted Answer

Blocks sign-ins from users with high user risk. The policy JSON specifies `"userRiskLevels": ["high"]` under the conditions block, which means it targets only users whose user risk level is assessed as high by Microsoft Entra ID Protection. The grant control is set to `"builtInControls": ["block"]`, so the policy blocks sign-ins for those high-risk users. Option B is correct because the policy explicitly blocks sign-ins from users with high user risk, not sign-in risk or all users.

Answer

Blocks sign-ins from locations with high sign-in risk

Answer

Blocks all sign-ins from any user

Answer

Requires multifactor authentication for high-risk users

Question 6

You are designing a secure access strategy for a manufacturing plant using Azure IoT Hub and Azure Defender for IoT. The plant has unpatched legacy PLCs that cannot be updated. What is the best approach to prevent these devices from being compromised and used as an entry point into the corporate network?

Accepted Answer

Implement network micro-segmentation using Azure Firewall and NSGs to isolate the PLCs from the corporate network.. The correct option is B: implementing network micro-segmentation with Azure Firewall and NSGs to isolate the PLCs from the corporate network. Since the legacy PLCs cannot be patched, the most effective mitigation is to limit their attack surface and blast radius by placing them in a segmented network zone with strict allow-list rules, so a compromised PLC cannot pivot laterally into corporate systems. Azure Firewall provides centralized Layer 3–7 filtering and NSGs enforce subnet/NIC-level traffic control, which directly addresses the unpatched-device risk. Option A is wrong because a VPN gateway only provides encrypted connectivity, not isolation or traffic restriction. Option C is wrong because the Defender for IoT micro-agent requires installation and support on the device, which unpatched legacy PLCs typically cannot accommodate. Option D is wrong because TLS 1.2 only protects data in transit and does not prevent compromise or lateral movement from an unpatched PLC.

Answer

Use Azure VPN Gateway to connect PLCs to the virtual network.

Answer

Install the Microsoft Defender for IoT micro-agent on each PLC.

Answer

Enforce TLS 1.2 for all PLC communications.

Question 7

You are designing an incident response plan for a company using Microsoft Defender XDR. The team needs to automatically notify the SOC via email when an incident of high severity is created. What should you use?

Accepted Answer

Configure an automation rule with an action to send an email notification.. Automation rules in Microsoft Defender XDR are specifically designed to trigger automated actions—including sending email notifications—when an incident is created or updated. Unlike playbooks, automation rules can directly send email without requiring a Logic Apps connector, and they operate natively within the Defender portal's incident lifecycle.

Answer

Modify the analytics rule to send an email when an alert fires.

Answer

Create a playbook that sends an email when an incident is created.

Answer

Use advanced hunting to query high severity incidents and send email.

Question 8

Adventure Works is a startup that uses Microsoft 365 Business Premium. They have 20 employees and no cloud expertise. The CEO has been hearing about ransomware attacks on small businesses. They want to implement basic protection against ransomware using built-in Microsoft 365 features. They also want to ensure they can recover from an attack quickly. What should you recommend?

Accepted Answer

Enable Microsoft Defender for Office 365 to block malicious attachments and links. Configure Microsoft Defender for Business to enable controlled folder access and ransomware protection. Educate users on phishing. Use OneDrive Files Restore to recover from ransomware.. It leverages built-in Microsoft 365 Business Premium features to provide immediate ransomware protection without requiring cloud expertise. Microsoft Defender for Office 365 blocks malicious attachments and links at the email gateway, while Defender for Business provides endpoint protection with controlled folder access. OneDrive Files Restore enables self-service recovery of files from ransomware within the last 30 days, aligning with the startup's need for quick recovery without additional infrastructure.

Answer

Purchase Azure Backup for all user devices. Configure backup policies to run daily. Use Microsoft Intune to enforce encryption. Implement Conditional Access to require MFA.

Answer

Use Microsoft Sentinel as a SIEM to detect ransomware patterns. Deploy Azure ATP for identity protection. Use Azure Policy to enforce backup.

Answer

Implement Azure Site Recovery for on-premises servers. Use Microsoft Defender for Cloud for threat detection. Deploy a third-party antivirus.

Question 9

Your company uses Microsoft Purview to protect sensitive data. You need to automatically apply a retention label to documents containing credit card numbers detected in SharePoint Online. What should you configure?

Accepted Answer

Create an auto-labeling policy for retention labels targeting sensitive info types.. Auto-labeling policies in Microsoft Purview can automatically apply retention labels to documents based on sensitive info types, such as credit card numbers. This allows you to enforce retention rules without manual intervention, directly targeting the detected sensitive data in SharePoint Online.

Answer

Configure a Data Loss Prevention (DLP) policy to apply the label.

Answer

Create a sensitivity label with auto-labeling for SharePoint.

Answer

Use a trainable classifier to detect credit card numbers and apply the label.

Question 10

You are designing a security solution for an Azure Kubernetes Service (AKS) cluster that runs containerized workloads. The cluster must be integrated with Microsoft Defender for Cloud for threat detection, and you need to ensure that container images are scanned for vulnerabilities before deployment. What should you configure?

Accepted Answer

Enable Azure Defender for Containers in Microsoft Defender for Cloud and integrate with Azure Container Registry for image scanning.. The correct option is C: enabling Azure Defender for Containers in Microsoft Defender for Cloud and integrating it with Azure Container Registry provides native vulnerability scanning of container images and threat detection for AKS workloads. Defender for Containers specifically includes image scanning in ACR (on push and periodic rescanning) and surfaces findings in Defender for Cloud, which matches the requirement to scan images before deployment. Option A is wrong because Microsoft Defender for Cloud Apps is a CASB for SaaS discovery and governance, not container image scanning. Option B is wrong because Azure Policy for Kubernetes enforces configuration and admission controls but does not itself perform vulnerability scanning of images. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR platform for log collection and analytics, not an image vulnerability scanner.

Answer

Enable Microsoft Defender for Cloud Apps to discover and assess container vulnerabilities.

Answer

Deploy Azure Policy for Kubernetes with built-in policies to enforce image scanning.

Answer

Configure Microsoft Sentinel to collect container logs and detect vulnerabilities.

Question 11

Your organization uses Microsoft Intune for mobile device management. You need to configure a compliance policy for iOS devices that requires the device to be jailbreak-detected and have a minimum OS version. Which two settings should you configure in the compliance policy? (Choose two.)

Accepted Answer

Minimum OS version. B is correct because the compliance policy must specify a minimum OS version to ensure iOS devices meet the required security baseline, preventing outdated devices with known vulnerabilities from accessing corporate resources. D is correct because jailbreak detection is a specific compliance setting that identifies compromised devices, which are a significant security risk as they bypass iOS security controls.

Answer

Require passcode

Answer

Device encryption

Question 12

A company, Fabrikam, has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD using Azure AD Connect. They have implemented a Zero Trust strategy that includes requiring multi-factor authentication (MFA) for all users accessing cloud applications. They use Conditional Access policies to enforce MFA. Recently, they noticed that users who authenticate from the on-premises network are not being prompted for MFA when accessing cloud apps, even though the Conditional Access policy is configured to require MFA for all users. The network location is not excluded in the policy. The Conditional Access policy is enabled and in 'Enforce' mode. The users' devices are not domain-joined. What is the most likely reason for this behavior?

Accepted Answer

Users are using legacy authentication protocols that do not support MFA. The most likely reason is that users are using legacy authentication protocols (e.g., POP3, IMAP, SMTP, or older Office clients) that do not support modern authentication and thus cannot enforce MFA via Conditional Access. Even though the policy requires MFA, legacy protocols bypass the Conditional Access engine entirely, allowing authentication without MFA prompts.

Answer

Azure AD Connect is not configured for Pass-through Authentication

Answer

The Conditional Access policy does not include session controls

Answer

The Conditional Access policy is not targeting the correct user group

Question 13

Your organization is deploying a new application on Azure Kubernetes Service (AKS). You need to ensure that only authorized containers can run in the cluster and that any unauthorized containers are automatically blocked. What should you configure?

Accepted Answer

Apply an Azure Policy that restricts container images to only those from approved registries.. The correct option is B: applying an Azure Policy that restricts container images to only those from approved registries. Azure Policy for AKS uses the Gatekeeper admission controller to evaluate requests against policy definitions at admission time, so any pod or deployment referencing a non-approved image is automatically denied and blocked from running in the cluster. This directly enforces the requirement that only authorized containers can run. Option A does not fit because network policies only control pod-to-pod traffic, not which images are allowed to run. Option C does not fit because Microsoft Entra ID integration handles authentication of users to the cluster, not image authorization. Option D does not fit because Azure RBAC controls who can perform deployment actions, but it does not validate or block unauthorized container images.

Answer

Implement network policies to restrict communication between pods.

Answer

Enable Azure AD integration for the AKS cluster.

Answer

Configure Azure RBAC roles to limit who can deploy containers.

Question 14

Your company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. You need to prevent users from sharing credit card numbers via email in Outlook on the web. The policy should notify users when they try to send such data and allow them to override with a business justification. What should you configure?

Accepted Answer

Create a DLP policy with the action 'Block with override' and enable 'Business justification'. The correct option is B: create a DLP policy with the action 'Block with override' and enable 'Business justification'. This is the only configuration that both prevents users from sending credit card numbers in Outlook on the web and lets them override the block by supplying a business justification, which is exactly what the scenario requires. Option A ('Audit only') merely logs activity without stopping the email, so it does not prevent sharing. Option C (encrypting emails) addresses confidentiality but does not block or notify the sender with an override path. Option D ('Block') stops the email but provides no override mechanism, so users cannot proceed with a justification.

Answer

Create a DLP policy with the action 'Audit only' for credit card numbers

Answer

Create a DLP policy that encrypts emails containing credit card numbers

Answer

Create a DLP policy with the action 'Block' for credit card numbers

Question 15

Your company is developing a Microsoft Teams app that accesses user profiles. You need to ensure the app only accesses minimal required data. What should you implement?

Accepted Answer

Delegated permissions with User.Read. The correct option is C: Delegated permissions with User.Read. Delegated permissions let the app act on behalf of the signed-in user, and User.Read is the least-privileged Microsoft Graph scope that allows reading the signed-in user's own profile, satisfying the requirement for minimal data access. Option A is unnecessary because admin consent for all scopes grants far broader access than needed. Option B is wrong because application permissions run without a signed-in user and typically require broader tenant-wide access. Option D is excessive since User.Read.All allows reading all users' full profiles, not just the current user's minimal data.

Answer

Admin consent for all scopes

Answer

Application permissions for Microsoft Graph

Answer

Delegated permissions with User.Read.All