SC-100 Practice Test 18 — 15 Questions

Question 1

Your organization uses Microsoft Sentinel to detect threats. You need to ensure that sensitive data stored in Azure SQL Database is protected from unauthorized access by Sentinel playbooks. What should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a managed identity assigned to the playbook to authenticate to Azure SQL. The correct option is D: use a managed identity assigned to the playbook to authenticate to Azure SQL. In Microsoft Sentinel, playbooks are Logic Apps, and when they need to access Azure SQL Database, the recommended approach is to assign a managed identity to the playbook and grant that identity the appropriate database permissions, so no credentials are stored and access is scoped to the playbook. This directly protects sensitive data by ensuring only the authorized playbook identity can authenticate to Azure SQL. Option A (dynamic data masking) limits data exposure in query results but does not control which principals can access the database. Option B (CMK for TDE) protects data at rest via encryption key management, not playbook authorization. Option C (SQL firewall rules for Sentinel IPs) is impractical because Sentinel playbooks run as Logic Apps without a fixed, reliable set of Sentinel IP addresses, and firewall rules alone do not authenticate the playbook.

Answer

Enable dynamic data masking on the SQL database

Answer

Use customer-managed keys (CMK) for SQL Transparent Data Encryption

Answer

Configure Azure SQL firewall rules to allow only Sentinel IP addresses

Question 2

Your company uses Microsoft Purview to classify and protect sensitive data. You need to ensure that when a user sends an email containing a credit card number, the email is automatically encrypted and a notification is sent to the user. Which Microsoft Purview feature should you configure?

Accepted Answer

Data Loss Prevention (DLP) policies. Data Loss Prevention (DLP) policies in Microsoft Purview are the correct choice because they can inspect email content for sensitive information types such as credit card numbers and trigger protective actions like encryption and user notifications. DLP rules support conditions based on sensitive info types and actions including encrypting messages and sending policy tips or notifications to the sender. Sensitivity labels apply protection based on manual or auto-labeling, but they do not natively detect credit card numbers in transit and send user notifications in the same rule-based way. Audit log policies only record activity for later review, and insider risk management policies focus on detecting risky user behavior rather than automatically encrypting an email containing a credit card number.

Answer

Sensitivity labels

Answer

Audit log policies

Answer

Insider risk management policies

Question 3

A company is deploying a new application that uses Azure Cosmos DB. The security requirements include: data encryption at rest, data encryption in transit, and the ability to audit all data access. Which THREE of the following should you implement?

Accepted Answer

Require TLS for all connections to Cosmos DB. Option B is correct because requiring TLS for all Cosmos DB connections enforces data encryption in transit, protecting data as it moves between clients and the service. Option D is correct because enabling encryption at rest with customer-managed keys ensures stored data is encrypted and gives the organization control over the key lifecycle, satisfying the encryption-at-rest requirement. Option E is correct because enabling diagnostic logging for Cosmos DB captures data-plane and control-plane operations, providing the audit trail needed to monitor and audit all data access. Option A is incorrect because replacing Cosmos DB with Azure SQL Database does not meet the stated application requirement to use Cosmos DB and does not by itself address all three security controls. Option C is incorrect because Microsoft Entra ID authentication addresses identity and access control, not encryption at rest, encryption in transit, or auditing of data access.

Answer

Use Azure SQL Database instead of Cosmos DB

Answer

Use Azure Active Directory authentication for Cosmos DB

Question 4

Your organization uses Microsoft Intune to manage devices. You need to deploy a line-of-business (LOB) app to iOS devices that is not available in the public App Store. The app is signed with an enterprise certificate. Which app deployment method should you use?

Accepted Answer

iOS line-of-business app deployment in Intune. iOS line-of-business app deployment in Intune. Intune supports deploying custom in-house iOS apps via the iOS LOB app type, which uploads the signed .ipa file and installs it on enrolled devices without requiring the public App Store, matching the scenario of an enterprise-certificate-signed LOB app. Option A (Android Enterprise managed Google Play) is for Android apps distributed through managed Google Play, not iOS. Option B (VPP token) is used for purchasing and distributing App Store apps in volume, not for custom in-house iOS apps. Option C (Microsoft Store for Business) distributes Windows apps and is unrelated to iOS deployment.

Answer

Android Enterprise managed Google Play

Answer

Volume Purchase Program (VPP) token

Answer

Microsoft Store for Business

Question 5

A company wants to monitor and respond to threats across their entire digital estate, including on-premises servers, cloud workloads, and identities. Which Microsoft solution should they use as a central security information and event management (SIEM) and extended detection and response (XDR) platform?

Accepted Answer

Microsoft Sentinel and Microsoft Defender XDR. Microsoft Sentinel and Microsoft Defender XDR, because Sentinel is Microsoft's cloud-native SIEM that ingests and correlates logs from on-premises servers, cloud workloads, and identities, while Defender XDR provides the extended detection and response layer across endpoints, identities, email, and cloud apps, together forming the central security operations platform the company needs. Microsoft Intune (A) is a mobile device and endpoint management (MDM/MAM) service, not a SIEM/XDR. Microsoft Defender for Cloud (B) is a cloud security posture management (CSPM) and workload protection service, not a central SIEM/XDR. Microsoft Purview (D) is a data governance, compliance, and information protection suite, not a threat monitoring SIEM/XDR platform.

Answer

Microsoft Intune

Answer

Microsoft Defender for Cloud

Answer

Microsoft Purview

Question 6

Your organization uses Microsoft Sentinel to detect threats. You need to ensure that sensitive data stored in Azure SQL Database is protected from unauthorized access by Sentinel playbooks. What should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a watchlist of trusted IP addresses and modify the rule to exclude those IPs.. Creating a watchlist of trusted IP addresses and modifying the TI map IP entity to AzureActivity rule to exclude those IPs directly addresses the high false positive rate caused by benign IPs. This approach preserves detection coverage for all other threat intelligence matches while filtering out known legitimate services, leveraging Sentinel's watchlist feature for dynamic exclusion without disabling the rule.

Answer

Increase the alert threshold to require multiple occurrences within a time window.

Answer

Disable the rule and rely on manual hunting queries.

Answer

Create a separate analytics rule that suppresses alerts when the source IP is in a trusted list.

Question 7

Your company uses Microsoft Purview to classify and protect sensitive data. You need to automatically detect and protect credit card numbers in documents stored in SharePoint Online. Which solution should you implement?

Accepted Answer

Create a Data Loss Prevention (DLP) policy to detect credit card numbers and block sharing.. The correct answer is C: create a Data Loss Prevention (DLP) policy to detect credit card numbers and block sharing. In Microsoft Purview, DLP policies are the built-in mechanism that inspects SharePoint Online content for sensitive information types such as credit card numbers and enforces protective actions like blocking external sharing or restricting access. This directly matches the requirement to automatically detect and protect credit card numbers in SharePoint Online documents. Option A is incorrect because Azure Information Protection is a labeling/encryption client, not a policy engine that automatically detects sensitive data in SharePoint. Option B is incomplete because a sensitivity label alone does not automatically detect credit card numbers unless combined with auto-labeling conditions, and it does not block sharing. Option D is incorrect because Defender for Cloud Apps focuses on cloud app discovery, session controls, and anomaly detection rather than enforcing DLP rules on SharePoint content.

Answer

Configure Azure Information Protection to automatically apply protection.

Answer

Apply a sensitivity label that encrypts documents with credit card numbers.

Answer

Use Microsoft Defender for Cloud Apps to scan documents for credit card numbers.

Question 8

A security team is designing a Microsoft Sentinel deployment. They need to minimize costs while ensuring critical alerts are always processed. Which data retention and ingestion strategy should they use?

Accepted Answer

Use Basic Logs for high-volume low-value data and Analytics Logs for critical alerts. It aligns with cost optimization and reliability requirements by using Basic Logs for high-volume, low-value data (e.g., firewall logs) and reserving Analytics Logs for critical alerts that require full query capabilities and interactive retention. This tiered approach ensures critical alerts are always processed with full fidelity while reducing storage costs for less important data.

Answer

Use Basic Logs for all data and retain for 90 days

Answer

Use Analytics Logs for all data and retain for 30 days

Answer

Use Basic Logs for critical alerts and retain for 30 days

Question 9

Your organization uses Microsoft Entra ID and plans to implement a custom line-of-business application that accesses Microsoft Graph APIs. The application will be used by employees and external partners. You need to ensure that the application can authenticate users and obtain appropriate permissions without exposing the client secret. What should you implement?

Accepted Answer

Implement OAuth 2.0 authorization code flow with PKCE.. The application is a line-of-business app used by employees and external partners, which implies it may be a public client (e.g., mobile or desktop) that cannot securely store a client secret. OAuth 2.0 authorization code flow with PKCE (Proof Key for Code Exchange) is the recommended authentication pattern for such clients because it eliminates the need for a client secret by using a dynamically generated code verifier. This ensures the client secret is never exposed. Option B is correct. Option A (system-assigned managed identity) is only suitable for Azure-hosted services, not client applications. Option C (storing client secret in Key Vault) still requires secret retrieval at runtime, which can be insecure for public clients. Option D (implicit grant flow) is outdated and less secure than authorization code flow with PKCE.

Answer

Use a system-assigned managed identity to authenticate to Microsoft Graph.

Answer

Store the client secret in Azure Key Vault and retrieve it at runtime.

Answer

Register the application as a public client and use the implicit grant flow.

Question 10

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). They need to secure communication between services using mutual TLS (mTLS). Which solution should they implement?

Accepted Answer

Istio service mesh. Istio service mesh is the correct solution because it provides a dedicated infrastructure layer for managing service-to-service communication, including automatic mutual TLS (mTLS) between microservices. Istio injects Envoy sidecar proxies into each pod, which handle encryption, authentication, and authorization without requiring application code changes. This enables zero-trust network security within the AKS cluster.

Answer

Azure Application Gateway

Answer

Azure Firewall

Answer

Azure API Management

Question 11

A company wants to protect sensitive data in their Azure SQL Database from unauthorized access. Which feature should they enable?

Accepted Answer

Transparent Data Encryption (TDE). Transparent Data Encryption (TDE) performs real-time I/O encryption and decryption of the data and log files at the page level, protecting data at rest in Azure SQL Database. This directly addresses the requirement to prevent unauthorized access to the underlying storage files, as TDE ensures that data cannot be read if the physical media is compromised.

Answer

Azure Information Protection

Answer

Azure Key Vault

Answer

Azure Firewall

Question 12

Your organization uses Azure SQL Database and needs to protect sensitive data from being exported by unauthorized users. You must implement a solution that prevents users from copying data to clipboard or taking screenshots of query results, while allowing legitimate business operations. What should you implement?

Accepted Answer

Configure a session policy in Microsoft Defender for Cloud Apps to block clipboard and screenshot actions.. The correct option is D: configuring a session policy in Microsoft Defender for Cloud Apps to block clipboard and screenshot actions. Defender for Cloud Apps Conditional Access App Control uses a session policy to proxy the session and apply controls such as blocking copy/paste to the clipboard and preventing screenshots, which directly addresses the requirement while still permitting legitimate query operations. Option A is incorrect because Azure Information Protection labels classify and protect data at rest or in documents, not interactive query result sessions. Option B is incorrect because Dynamic Data Masking only obscures column values in query output and does not prevent copying or screenshotting. Option C is incorrect because Auditing and threat detection only log and alert on suspicious activity; they do not block clipboard or screenshot actions.

Answer

Apply Azure Information Protection labels to the database.

Answer

Use Dynamic Data Masking to obscure sensitive columns.

Answer

Enable Azure SQL Database Auditing and threat detection.

Question 13

Refer to the exhibit. You are reviewing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

To identify accounts with multiple failed logon attempts from a single IP.. The query uses the `SecurityEvent` table and filters for `EventID == 4625`, which indicates a failed logon attempt. By summarizing `count()` by `IPAddress` and `Account` and filtering for `FailedAttempts > 5`, the query identifies accounts with multiple failed logon attempts from a single IP address. This is typical for detecting brute-force or password-spray attacks, making option A correct.

Answer

To list all successful logon events in the last 7 days.

Answer

To calculate the total number of failed logons per hour.

Answer

To detect account lockout events.

Question 14

Your organization uses Microsoft Entra ID and needs to ensure that external partners can access only specific applications for 30 days. What should you configure?

Accepted Answer

Entitlement management and create an access package with an expiration of 30 days. Entitlement management in Microsoft Entra ID allows you to create access packages that govern external partner access to specific applications. By configuring an access package with a 30-day expiration, you enforce time-limited access, ensuring partners can only access the designated applications for the required duration. This directly meets the requirement of restricting access to specific apps with a defined expiry.

Answer

B2B direct connect

Answer

Self-service group management

Answer

Conditional Access policy with session control

Question 15

Your company uses Microsoft Defender for Cloud Apps to protect its SaaS environment. You need to configure settings to detect and block risky user activities. Which TWO actions should you take? (Choose TWO.)

Accepted Answer

Configure anomaly detection policies.. Option C is correct because anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to detect unusual user behavior—such as impossible travel, atypical download volumes, or suspicious admin activity—and can be tuned to alert on or automatically remediate risky activities in your SaaS environment. Option E is correct because enabling session monitoring (via Conditional Access App Control) for critical applications lets Defender for Cloud Apps inspect and control user sessions in real time, allowing it to block risky actions like downloads, uploads, or copy/paste based on session policies. Option A is not appropriate because blocking all third-party app access is an overly broad, disruptive measure rather than a targeted risky-activity detection and blocking configuration. Option B does not belong because defining IP address ranges for trusted locations only informs risk evaluation and conditional access decisions; by itself it neither detects nor blocks risky user activities. Option D is incorrect because app discovery policies focus on identifying shadow IT and unsanctioned cloud apps from traffic logs, not on detecting and blocking risky user activities within sanctioned SaaS apps.

Answer

Block all third-party app access.

Answer

Define IP address ranges for trusted locations.

Answer

Configure app discovery policies.