SC-100 Practice Test 19 — 15 Questions

Question 1

Your organization is implementing a secure DevOps pipeline for Azure. You need to ensure that secrets (e.g., API keys) are not stored in source code and that access to production resources is controlled. Which THREE practices should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Key Vault to store secrets and retrieve them at deployment time. Option B is correct because Azure Key Vault is the dedicated Azure service for centrally storing and managing secrets such as API keys, with encryption at rest and fine-grained access policies, so pipeline code never contains the secret values. Option C is correct because Azure DevOps variable groups can be linked to Azure Key Vault, which lets pipelines consume Key Vault secrets as variables at runtime without duplicating or hardcoding them in the pipeline definition. Option E is correct because managed identities for Azure resources give the pipeline or compute an automatically managed identity in Microsoft Entra ID, allowing it to authenticate to Key Vault without storing credentials, which directly supports controlled access to production resources. Option A is not correct because pipeline variables with encryption enabled still store the secret within Azure DevOps rather than in a dedicated vault, lacking Key Vault's centralized governance, rotation, and auditing. Option D is not correct because a configuration file in a private Git repository still places secrets in source control, which is exactly the practice the scenario requires avoiding.

Answer

Store secrets in Azure DevOps pipeline variables with encryption enabled

Answer

Store secrets in a configuration file in a private Git repository

Question 2

Your organization uses Microsoft Sentinel as its SIEM. The security team needs to detect brute-force attacks against Azure VMs by analyzing Windows Security Event logs. Which data connector should you enable?

Accepted Answer

Windows Security Events via AMA connector. The Windows Security Events via AMA connector (D) is correct because it ingests Windows Event Logs (specifically Security logs with Event ID 4625 for failed logons) from Azure VMs into Microsoft Sentinel, enabling detection of brute-force patterns. This connector uses the Azure Monitor Agent (AMA) to collect events, which is the recommended method for modern Windows event collection in Sentinel.

Answer

Office 365 connector

Answer

Azure Activity log connector

Answer

Microsoft Defender for Cloud connector

Question 3

A company is using Microsoft Intune to manage devices. They need to ensure that only devices with a specific operating system version can access corporate resources. Which Intune policy should they use?

Accepted Answer

Compliance policy. Compliance policies in Microsoft Intune define the rules that devices must meet to be considered compliant, such as requiring a specific operating system version. When a device is marked non-compliant, Conditional Access policies can block access to corporate resources. This directly enforces the requirement that only devices with the correct OS version can access company data.

Answer

App protection policy

Answer

Enrollment restriction

Answer

Device configuration policy

Question 4

Refer to the exhibit. You configure this mail flow rule in Exchange Online. What happens to emails with 'FREE' in the subject?

Accepted Answer

Emails are moved to the Junk Email folder. The mail flow rule is configured to add the header 'X-CustomHeader' with the value 'Free' to emails that have 'FREE' in the subject. However, the rule also has the action 'Increase the spam confidence level (SCL) to 9', which causes Exchange Online to treat the message as high-confidence spam. When the SCL is set to 9, Exchange Online automatically moves the email to the Junk Email folder for the recipient, unless a transport rule or mailbox setting overrides this behavior. Therefore, the emails are not deleted, blocked, or simply have a header added; they are moved to the Junk Email folder due to the SCL increase.

Answer

Emails are deleted

Answer

Emails have a custom header added

Answer

Emails are blocked and not delivered

Question 5

A company deploys Microsoft Defender for Cloud Apps. They need to detect anomalous behavior in user activities across multiple cloud apps. Which feature should they enable?

Accepted Answer

Anomaly detection policies. Anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify unusual patterns in user activities across connected cloud apps, such as impossible travel, mass file downloads, or ransomware-like behavior. These policies leverage machine learning and behavioral analytics to establish a baseline of normal user behavior and trigger alerts when deviations occur, making them the correct choice for detecting anomalous behavior.

Answer

Session policies

Answer

Data loss prevention policies

Answer

App governance

Question 6

Your company is deploying a new line-of-business application in Azure that must comply with PCI DSS. The application uses Azure SQL Database. You need to design a solution to encrypt sensitive data at rest and in transit, and to audit access to sensitive columns. Which combination of Microsoft security capabilities should you recommend?

Accepted Answer

Transparent Data Encryption, Always Encrypted, and Azure SQL Auditing. Transparent Data Encryption (TDE) encrypts the SQL database at rest, Always Encrypted protects sensitive columns in transit and at rest by ensuring encryption keys are never exposed to the database engine, and Azure SQL Auditing logs all access to sensitive columns for compliance with PCI DSS requirements.

Answer

Dynamic Data Masking and Azure SQL Firewall rules

Answer

Azure Policy and Microsoft Defender for Cloud

Answer

Azure Storage Service Encryption and Azure Key Vault

Question 7

Your company uses Microsoft Purview Data Loss Prevention (DLP). You need to ensure that credit card numbers are not shared externally via email. What should you configure?

Accepted Answer

Create a DLP policy that detects credit card numbers and blocks external sharing.. The correct option is B: create a DLP policy that detects credit card numbers and blocks external sharing. Microsoft Purview DLP is purpose-built to identify sensitive information types such as credit card numbers and enforce protective actions like blocking email to external recipients, which directly satisfies the requirement. Option A is wrong because sensitivity labels apply encryption and classification but do not themselves block external email sharing based on content detection. Option C is wrong because auto-labeling applies labels rather than enforcing DLP blocking actions. Option D is wrong because retention policies govern data lifecycle and deletion, not prevention of external sharing.

Answer

Create a sensitivity label that applies encryption to emails containing credit card numbers.

Answer

Configure auto-labeling for credit card numbers in Microsoft 365.

Answer

Create a retention policy for credit card data.

Question 8

A company plans to implement a Zero Trust security model. Which of the following is the primary principle that should guide their strategy?

Accepted Answer

Assume breach and verify explicitly. The primary principle of Zero Trust is 'never trust, always verify,' which is operationalized as 'assume breach and verify explicitly.' This means every access request—regardless of source (internal or external)—must be authenticated, authorized, and encrypted before granting access. It eliminates implicit trust based on network location and enforces least-privilege access, which is foundational to the Zero Trust architecture.

Answer

Use a strong perimeter firewall as the primary defense

Answer

Grant trusted users full access to all resources

Answer

Trust but verify all internal traffic

Question 9

Your organization is designing a solution to protect sensitive data in Microsoft 365. You need to implement Microsoft Purview Data Loss Prevention (DLP) policies. Which TWO actions can a DLP policy take when a match occurs? (Choose TWO.)

Accepted Answer

Block the sharing of sensitive information.. Option D is correct because Microsoft Purview DLP policies can block sharing of sensitive information across workloads such as Exchange Online, SharePoint, OneDrive, and Teams, preventing users from sending or sharing content that matches a DLP rule. Option E is correct because DLP policies can display policy tips to users in supported apps (for example, Outlook, Word, Excel, and Teams), notifying them that content matches a rule and offering override or report options. Option A is not a native DLP action; encryption with Azure Information Protection is typically achieved through sensitivity labels or auto-labeling policies, not directly as a DLP policy action. Option B is not a standard DLP action in Microsoft Purview; DLP can block, restrict access, or notify, but it does not quarantine files for administrator review. Option C is not a DLP policy action; automatically applying a sensitivity label is performed by auto-labeling policies in Microsoft Purview, not by DLP policies.

Answer

Encrypt the file with Azure Information Protection.

Answer

Quarantine the file for administrator review.

Answer

Automatically apply a sensitivity label.

Question 10

Your organization uses Microsoft Defender for Office 365. You need to design a solution to protect users from malicious links in email. What should you configure?

Accepted Answer

Safe Links policy. Safe Links policy (option C) is correct because it is the Defender for Office 365 feature that rewrites and time-of-click verifies URLs in email (and Teams/Office apps), blocking malicious links at delivery and after delivery. This directly addresses the requirement to protect users from malicious links in email. Anti-spam policy (A) filters spam and bulk mail but does not detonate or rewrite URLs for malicious link protection. Safe Attachments policy (B) detonates attachments in a sandbox, not links. Anti-phishing policy (D) covers impersonation and spoofing protections, not URL rewriting/blocking of malicious links.

Answer

Anti-spam policy

Answer

Safe Attachments policy

Answer

Anti-phishing policy

Question 11

Refer to the exhibit. You run the PowerShell script to protect high-confidentiality resources. After execution, you find that some resources with tag 'Confidentiality=High' are still unprotected. What is the most likely reason?

Accepted Answer

Some resources are in a different resource group than expected.. The correct answer is A: some resources are in a different resource group than expected. If the PowerShell script scopes its protection (for example, applying locks or policies) to a specific resource group, any resource tagged 'Confidentiality=High' that resides in another resource group is outside the script's scope and remains unprotected, which matches the symptom of some tagged resources still being unprotected. Option B is not the likely cause because the failure is about scope, not lock-detection logic. Option C is incorrect because tag inheritance from resource groups is not the issue here—the resources already carry the tag. Option D is irrelevant because overwriting existing locks would not leave tagged resources unprotected.

Answer

The script does not check for existing locks properly.

Answer

Tags are not inherited from resource groups.

Answer

The script overwrites existing locks.

Question 12

You are designing a security solution for Azure SQL Database. The requirements include: encrypting data at rest and in transit, and masking sensitive data from non-privileged users. Which two features should you implement? (Choose two.)

Accepted Answer

Dynamic Data Masking. Transparent Data Encryption (TDE) [CORRECT] is the right choice for encrypting data at rest, as it performs real-time encryption and decryption of the database, associated backups, and transaction log files at the page level using a symmetric key protected by a certificate stored in Azure Key Vault or the service-managed keystore. Dynamic Data Masking [CORRECT] is the right choice for masking sensitive data from non-privileged users, since it limits data exposure by obfuscating the results of queries on designated columns (for example, showing XXXX for a credit card number) without altering the underlying data, and privileged users can be excluded via UNMASK permission. Encryption in transit is handled automatically by Azure SQL Database through TLS, so no additional feature is needed for that requirement. Azure Firewall (B) is a network security service for filtering traffic to Azure resources and does not provide data-at-rest encryption or data masking. Column-level encryption (D) and Always Encrypted (E) both encrypt specific column data, but they address data-at-rest confidentiality for privileged applications rather than masking data from non-privileged users, and Always Encrypted additionally requires client-side key management, making them less appropriate for the stated masking requirement.

Answer

Azure Firewall

Answer

Column-level encryption

Answer

Always Encrypted

Question 13

Your application uses Azure Key Vault to store secrets. You need to ensure that the application rotates secrets automatically without downtime. Which feature should you enable?

Accepted Answer

Key Vault automatic rotation with Event Grid integration. Key Vault automatic rotation with Event Grid integration (option A) is correct because it lets Key Vault rotate secrets on a schedule and emit near-real-time events (e.g., Microsoft.KeyVault.SecretNewVersionCreated) that the application can subscribe to, so it can fetch the new secret version before the old one expires and avoid downtime. Manual rotation (option B) requires an operator to create new secret versions, which cannot guarantee timely, zero-downtime rotation. Soft-delete (option C) only retains deleted vaults/secrets for recovery and does not rotate anything. RBAC (option D) governs authorization to Key Vault operations but provides no rotation mechanism.

Answer

Key Vault manual rotation

Answer

Key Vault soft-delete

Answer

Key Vault RBAC

Question 14

Your organization uses Microsoft Defender for Cloud to assess the security posture of Azure resources. The security team wants to ensure that all virtual machines are covered by Defender for Cloud's vulnerability assessment capabilities. Which plan must be enabled?

Accepted Answer

Microsoft Defender for Servers Plan 2. Microsoft Defender for Servers Plan 2 is the correct choice because it is the Defender for Cloud plan that includes built-in vulnerability assessment for Azure and hybrid virtual machines, using the integrated Microsoft Defender Vulnerability Management scanner. Enabling this plan on the subscription ensures VMs receive agentless or agent-based vulnerability scanning and findings surface in Defender for Cloud's recommendations. Microsoft Defender for Storage protects storage accounts, not VMs, so it does not provide VM vulnerability assessment. Microsoft Defender for Cloud Apps is a CASB solution for SaaS application visibility and control, and Defender CSPM provides posture management and attack path analysis but not the VM vulnerability assessment capability itself.

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Cloud Apps

Answer

Defender Cloud Security Posture Management (CSPM)

Question 15

You are the security architect for a company that has a hybrid identity infrastructure with Microsoft Entra ID (formerly Azure AD) and an on-premises Active Directory Domain Services (AD DS) forest. The company is planning to migrate several line-of-business (LOB) applications to Azure Virtual Machines. The applications currently use Windows Integrated Authentication (WIA) and rely on Kerberos delegation. You need to design a solution that allows the Azure VMs to authenticate on-premises users and access on-premises resources using Kerberos constrained delegation (KCD) without exposing on-premises-domain controllers to the internet. The solution must minimize latency and administrative overhead. You have configured Azure ExpressRoute for connectivity between the on-premises network and Azure. What should you do?

Accepted Answer

Deploy domain controllers as Azure VMs in the same virtual network as the application VMs. Configure the application VMs to use these domain controllers for authentication and KCD.. Option A is correct because deploying replica domain controllers as Azure VMs in the same virtual network as the application VMs keeps Kerberos authentication and KCD traffic local to Azure, minimizing latency while avoiding any internet exposure of on-premises domain controllers; the VMs join the on-premises AD DS domain and use these in-Azure DCs for authentication and delegation. Option D would work functionally over ExpressRoute but adds WAN latency and dependency on the on-premises DCs for every Kerberos exchange, so it does not minimize latency. Option C is wrong because Microsoft Entra Domain Services (Microsoft Entra Domain Services) is a managed domain that does not support Kerberos constrained delegation to on-premises resources or joining an existing on-premises AD DS forest. Option B is wrong because Microsoft Entra application proxy publishes web apps for remote access and uses Entra ID authentication, which does not provide Kerberos KCD for LOB applications running on Azure VMs.

Answer

Implement Azure AD Application Proxy to publish the applications and use Azure AD for authentication.

Answer

Use Azure AD Domain Services to provide domain join and KCD capabilities for the Azure VMs.

Answer

Configure the application VMs to use the on-premises domain controllers over ExpressRoute for authentication and KCD.