SC-100 Practice Test 20 — 15 Questions

Question 1

Your company uses Azure Virtual Machines (VMs) running Windows Server. You need to ensure that only approved applications can run on the VMs. Which Azure security feature should you use?

Accepted Answer

Azure Policy with application control. Azure Policy with application control is correct because it lets you enforce that only approved applications run on your Windows Server VMs by using the Guest Configuration extension to audit or deploy Windows Defender Application Control (WDAC) / AppLocker policies at scale. This directly addresses the requirement to restrict execution to approved applications. Azure Firewall (A) filters network traffic, not which applications execute on the VM. Microsoft Defender for Cloud (C) provides security posture and threat protection but does not itself enforce an application allowlist. Just-in-Time VM access (D) restricts inbound management ports, not application execution.

Answer

Azure Firewall

Answer

Microsoft Defender for Cloud

Answer

Just-in-Time VM access

Question 2

Your organization is adopting Microsoft Purview to classify and protect sensitive data in Microsoft 365. You need to ensure that documents containing credit card numbers are automatically detected and encrypted when shared externally. What should you configure?

Accepted Answer

A sensitivity label configured with auto-labeling for credit card numbers and encryption for external sharing. Sensitivity labels in Microsoft Purview can be configured with auto-labeling conditions that detect sensitive data types (e.g., credit card numbers) and automatically apply encryption to documents when shared externally. This meets the requirement of automatic detection and encryption for external sharing without manual user intervention.

Answer

An Information Barrier policy between departments

Answer

A retention label that deletes documents with credit card numbers after 90 days

Answer

A Data Loss Prevention (DLP) policy that blocks sharing of credit card numbers

Question 3

A multinational corporation is designing a secure access solution for remote employees using company-managed devices. The solution must enforce device compliance before granting access to corporate resources, support single sign-on (SSO) for SaaS applications, and provide conditional access policies based on risk. Which combination of Microsoft security products should you recommend?

Accepted Answer

Microsoft Intune + Microsoft Entra ID + Microsoft Defender for Cloud Apps. Microsoft Intune provides device compliance, Microsoft Entra ID provides SSO and conditional access, and Microsoft Defender for Cloud Apps provides risk-based access control. The other combinations miss key components.

Answer

Microsoft Intune + Microsoft Defender for Endpoint + Microsoft Sentinel

Answer

Microsoft Entra ID + Microsoft Defender for Cloud Apps + Microsoft Purview

Answer

Microsoft Configuration Manager + Microsoft Entra ID + Microsoft Defender for Identity

Question 4

You are analyzing a custom detection rule in Microsoft 365 Defender. Based on the exhibit, what is a potential operational issue with this rule?

Accepted Answer

The threshold is too low, leading to alert fatigue.. Option A is correct because a custom detection rule whose threshold is set too low will trigger on very few or even a single event, generating excessive alerts that overwhelm analysts with false positives and cause alert fatigue. In Microsoft 365 Defender custom detections, the threshold (aggregation) value controls how many events must occur within the query's timeframe before an alert fires, so setting it too low directly increases alert volume. Option B is incorrect because the scenario asks about an operational issue, not a syntax error, and the exhibit implies the query runs. Option C is incorrect because severity is a triage preference, not an operational defect, and changing High to Medium would not fix alert volume. Option D is incorrect because PowerShell 7 coverage depends on the query's data source and process filters, not on the threshold, and the scenario does not indicate pwsh.exe is relevant.

Answer

The query syntax is invalid.

Answer

The severity should be Medium instead of High.

Answer

The rule does not cover PowerShell 7 (pwsh.exe).

Question 5

Refer to the exhibit. A security architect is reviewing an Azure Policy definition. What is the effect of this policy?

Accepted Answer

Denies creation or update of storage accounts that do not require HTTPS traffic. The correct answer is C: the policy denies creation or update of storage accounts that do not require HTTPS traffic. In Azure Policy, a Deny effect blocks the request at the resource provider during create or update operations when the resource does not satisfy the condition, so a storage account with supportsHttpsTrafficOnly set to false would be rejected. Option A is incorrect because Modify effects change properties via remediation and do not block the request. Option B is incorrect because Audit only records non-compliance without preventing deployment. Option D is incorrect because DeployIfNotExists remediation tasks are triggered after evaluation and do not deny the original request.

Answer

Modifies storage accounts to enable HTTPS traffic only

Answer

Audits storage accounts that do not require HTTPS traffic

Answer

Deploys a remediation task to enable HTTPS traffic only

Question 6

Your organization is implementing Microsoft Entra ID Governance. You need to design a solution that automates user access reviews for cloud applications. Which TWO capabilities should you include?

Accepted Answer

Entitlement Management with access packages. Access Reviews (D) is correct because it is the Microsoft Entra ID Governance capability specifically designed to automate periodic reviews of users' group memberships, application assignments, and role assignments, allowing reviewers to attest to continued access and automatically remove access when reviewers deny it or don't respond. Entitlement Management with access packages (B) is correct because access packages bundle resources such as cloud applications, groups, and SharePoint sites, and they support mandatory access reviews and expiration policies that automate the access lifecycle for cloud applications. Identity Protection (A) is not correct because it detects and remediates identity risk signals like risky sign-ins and compromised credentials, not access attestation workflows. Terms of Use (C) is not correct because it presents legal disclaimers that users must accept before accessing resources, which is a consent mechanism rather than an access review. Privileged Identity Management (E) is not correct because PIM governs just-in-time activation and approval of privileged directory and Azure roles, not recurring reviews of general cloud application access.

Answer

Identity Protection

Answer

Terms of Use

Answer

Privileged Identity Management (PIM)

Question 7

Your company uses Microsoft Defender for Cloud Apps to discover shadow IT. You need to ensure that data exfiltration from sanctioned cloud apps is blocked in real-time. Which control should you configure?

Accepted Answer

Conditional Access App Control. Conditional Access App Control is the correct answer because it enables real-time session monitoring and control over sanctioned cloud apps, allowing you to block data exfiltration actions such as downloads, copy/paste, and uploads via reverse proxy integration with Microsoft Entra Conditional Access. It is specifically designed for inline enforcement on user sessions, which matches the requirement to block exfiltration in real time. IP address ranges are used for defining corporate network boundaries in Cloud Discovery, not for session-level blocking. Cloud discovery only identifies shadow IT usage from logs and does not enforce real-time controls. App connectors provide API-based visibility and governance for sanctioned apps but do not block user actions in real time.

Answer

IP address ranges

Answer

Cloud discovery

Answer

App connector

Question 8

A company is moving to a zero-trust security model. Which principle is most important for securing network traffic?

Accepted Answer

Verify explicitly every access request. In a zero-trust model, the principle of 'verify explicitly' means every access request—regardless of source—must be authenticated, authorized, and encrypted before being allowed. This eliminates implicit trust based on network location, which is the core shift from traditional perimeter-based security.

Answer

Rely on perimeter firewalls to block threats

Answer

Trust all traffic within the corporate network

Answer

Allow all traffic and monitor for anomalies

Question 9

Your organization uses Microsoft Sentinel for security information and event management (SIEM). You need to design a solution to detect brute-force attacks against Azure virtual machines. The solution should use Azure Activity Logs and Windows Security Events. What should you configure in Sentinel?

Accepted Answer

Create a scheduled analytics rule. Sentinel can ingest Azure Activity Logs and Windows Events, and then use analytics rules to detect brute-force patterns. Option A is wrong because watchlists are for reference data, not detection logic. Option B is wrong because workbooks visualize data, not detect. Option D is wrong because playbooks automate responses, not detect.

Answer

Create a threat intelligence watchlist

Answer

Create a workbook

Answer

Create a playbook

Question 10

Your organization uses Microsoft Defender for Cloud to secure multi-cloud workloads. You need to ensure that Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) resources are assessed against the same security baseline. What should you do?

Accepted Answer

Connect AWS and GCP accounts to Defender for Cloud and use Azure Policy to enforce the Microsoft Cloud Security Benchmark. Microsoft Defender for Cloud's multi-cloud CSPM capabilities allow you to connect AWS and GCP accounts directly, and then apply Azure Policy to enforce the Microsoft Cloud Security Benchmark (MCSB) across all connected clouds. This ensures a unified security baseline assessment for Azure, AWS, and GCP resources, as MCSB is the default policy initiative in Defender for Cloud.

Answer

Configure AWS Config and GCP Security Command Center to export findings to Microsoft Sentinel

Answer

Use regulatory compliance standards for each cloud separately

Answer

Enable the Cloud Security Posture Management (CSPM) plan and configure AWS and GCP connectors

Question 11

You are designing a secure hybrid network for a multinational company. They require encrypted communication between on-premises data centers and Azure, with high availability and no single point of failure. Which solution should you recommend?

Accepted Answer

Deploy ExpressRoute with a site-to-site VPN as a failover.. Option A is correct because ExpressRoute provides a private, high-bandwidth dedicated connection to Azure, and pairing it with a site-to-site VPN failover ensures encrypted traffic and eliminates a single point of failure if the ExpressRoute circuit goes down. The VPN failover also satisfies the encryption requirement since ExpressRoute by itself does not encrypt data in transit. Option B provides encryption and redundancy but relies solely on internet-based VPN, which lacks the dedicated private connectivity and predictable performance of ExpressRoute. Option C is wrong because point-to-site VPN is designed for individual client devices, not data center-to-Azure connectivity. Option D is wrong because ExpressRoute without encryption does not meet the encrypted communication requirement, and relying only on Microsoft backbone security does not provide the required encryption or redundancy.

Answer

Deploy a site-to-site VPN over the internet with two active VPN devices.

Answer

Deploy Azure Virtual WAN with point-to-site VPN for each data center.

Answer

Deploy ExpressRoute without encryption and rely on Microsoft backbone security.

Question 12

A company is designing a security operations strategy using Microsoft Sentinel. They want to prioritize triage of incidents that involve critical assets. The SOC manager suggests using the entity behavior analytics feature. Which capability of entity behavior analytics helps achieve this goal?

Accepted Answer

It profiles entities and assigns an anomaly score based on deviations from baseline behaviors.. Entity behavior analytics (UEBA) in Microsoft Sentinel profiles entities such as users, hosts, or applications by establishing baseline behaviors over time. It then assigns an anomaly score to deviations from that baseline, enabling SOC analysts to prioritize incidents involving critical assets based on unusual activity rather than static rules. This directly supports the goal of triaging incidents by highlighting anomalous behavior on high-value targets.

Answer

It combines multiple alerts into a single incident using Fusion.

Answer

It uses threat intelligence to correlate with known bad actors.

Answer

It automatically groups incidents by severity and asset criticality.

Question 13

Refer to the exhibit. Your organization is required to comply with PCI DSS. You need to prioritize remediation efforts to meet PCI DSS requirements. Based on the exhibit, which recommendation should you address first?

Accepted Answer

Enable MFA on accounts with owner permissions. PCI DSS requires strong access control, including multi-factor authentication for remote access and for all accounts with administrative access. The recommendation 'MFA should be enabled on accounts with owner permissions' directly impacts PCI DSS requirements for authentication. While vulnerability assessment is important, MFA is a key control for PCI DSS. The other recommendations are less directly related to PCI DSS.

Answer

Migrate VMs from classic to ARM

Answer

Enable vulnerability assessment on SQL databases

Answer

Enable diagnostic logs in Key Vault

Question 14

Your company uses Microsoft Intune to manage devices. You need to ensure that only compliant devices can access corporate Exchange Online mailboxes. Which conditional access policy setting should you configure?

Accepted Answer

Grant: Require device to be marked as compliant.. The correct option is A, Grant: Require device to be marked as compliant, because this conditional access grant control evaluates the device's compliance state reported by Intune and only allows access to Exchange Online when the device meets the assigned compliance policy. This directly enforces the requirement that only compliant devices can reach corporate mailboxes. Option B, Require approved client app, restricts which apps can access the resource but does not verify device compliance. Option C, Require multifactor authentication, strengthens user sign-in verification but does not assess the device's compliance status. Option D, Require Intune enrollment, only ensures the device is managed by Intune, not that it satisfies the compliance policy.

Answer

Grant: Require approved client app.

Answer

Grant: Require multifactor authentication.

Answer

Grant: Require Intune enrollment.

Question 15

Your company is deploying Azure Kubernetes Service (AKS) and needs to secure container workloads. You must ensure that only approved container images from a trusted Azure Container Registry (ACR) can be deployed. What should you implement?

Accepted Answer

Apply an Azure Policy initiative to only allow images from a specific ACR.. Azure Policy for AKS can enforce admission control on the cluster so that only container images originating from an approved Azure Container Registry are admitted, which directly satisfies the requirement to restrict deployments to trusted ACR images. The built-in initiative/policy (for example, 'Kubernetes cluster containers should only use allowed images') evaluates image references against an allowlist of registry prefixes and denies non-compliant pods. Microsoft Entra ID integration (A) handles authentication and RBAC for cluster access, not image provenance. Key Vault (C) stores secrets such as registry credentials but does not restrict which images can be deployed. Network policies (D) control pod-level traffic flows and cannot enforce image registry allowlisting.

Answer

Enable Azure AD integration for AKS.

Answer

Use Azure Key Vault to store container image credentials.

Answer

Configure network policies in AKS to restrict egress traffic.