SC-100 Practice Exam 2 — 20 Questions

Question 1

A company has a hybrid identity deployment using Azure AD Connect. They want to ensure that if a user's on-premises account is disabled, the corresponding Azure AD account is also disabled within 30 minutes. Which setting should they configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the synchronization interval for directory changes. Microsoft Entra Connect's default synchronization cycle for directory changes is 30 minutes. By configuring the synchronization interval (via the Microsoft Entra Connect scheduler or PowerShell), you can ensure that disabled on-premises accounts are reflected in Microsoft Entra ID within that timeframe. This setting directly controls how frequently Microsoft Entra Connect processes and synchronizes changes from the on-premises Active Directory to Microsoft Entra ID.

Answer

Enable password hash synchronization

Answer

Install Azure AD Application Proxy

Answer

Enable password writeback

Question 2

A company is designing a Zero Trust network strategy. They want to ensure that all network traffic between on-premises and Azure is inspected and logged, regardless of source or destination. Which Azure service should they use to achieve this?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides inbound and outbound traffic inspection and logging for all traffic between on-premises networks and Azure, regardless of source or destination. It supports application and network-level filtering, threat intelligence-based filtering, and integrates with Azure Monitor for comprehensive logging, making it the correct choice for a Zero Trust network strategy that requires full traffic inspection and logging.

Answer

Azure Front Door

Answer

Azure Bastion

Answer

Azure DDoS Protection

Question 3

Your organization is using Microsoft Sentinel for security information and event management (SIEM). You need to ensure that data from Azure Activity Logs is ingested into Sentinel. What should you configure?

Accepted Answer

Connect Azure Activity Logs via the Microsoft Sentinel data connector. You can connect Azure Activity Logs as a data connector in Microsoft Sentinel. Option A is wrong because Log Analytics workspace is the underlying storage, but the connection is made via data connectors. Option B is wrong because Azure Policy can enforce configuration but not directly ingest logs. Option C is wrong because Azure Monitor is a broader service; the specific connector is needed.

Answer

Configure a Log Analytics workspace to collect Activity Logs

Answer

Use Azure Policy to stream Activity Logs to Sentinel

Answer

Enable Azure Monitor to forward Activity Logs to Sentinel

Question 4

A company uses Microsoft Intune to manage devices. They need to ensure that only compliant devices can access corporate email. They plan to use Conditional Access in Microsoft Entra ID. Which THREE components must be configured?

Accepted Answer

Device registration in Entra ID. Device registration in Entra ID (A) is required because Conditional Access policies evaluate device compliance based on the device's identity in Entra ID. Without registration, the device lacks a unique identity that Entra ID can assess for compliance status, making it impossible to enforce access controls based on device state.

Answer

Windows Autopilot deployment profile

Answer

Configuration profile in Intune

Question 5

A company is evaluating their incident response (IR) process. They use Microsoft Sentinel as their SIEM. During a security incident, the IR team struggles to quickly find related alerts and entities. Which improvement should they implement to enhance investigation efficiency?

Accepted Answer

Leverage the investigation graph to explore entity relationships.. The investigation graph in Microsoft Sentinel provides a visual, interactive map of entity relationships (e.g., users, hosts, IP addresses, alerts) connected to an incident. This directly addresses the IR team's struggle to quickly find related alerts and entities by allowing them to explore and pivot across linked data points, drastically reducing manual correlation time.

Answer

Create more analytics rules to cover additional scenarios.

Answer

Configure automation rules to automatically classify incidents.

Answer

Increase data retention for all log tables.

Question 6

Your organization is implementing a zero-trust network strategy. You need to ensure that all network traffic between Azure virtual machines is encrypted and authenticated at the IP layer, regardless of the virtual network they are in. Which Azure feature should you configure?

Accepted Answer

Azure Virtual Network encryption. Azure Virtual Network encryption provides IPsec encryption for traffic between VMs within the same virtual network or peered virtual networks. Service endpoints use public IPs. Private Link is for accessing PaaS services privately. VPN Gateway is for site-to-site.

Answer

Azure Service Endpoints

Answer

Azure VPN Gateway

Answer

Azure Private Link

Question 7

An organization uses Microsoft Defender for Cloud to secure their multi-cloud environment, including Azure and AWS. They want to ensure that all AWS EC2 instances are automatically onboarded to Defender for Cloud. What should they configure?

Accepted Answer

Set up the AWS connector in Defender for Cloud. The AWS connector in Microsoft Defender for Cloud is the native integration that enables automatic discovery and onboarding of AWS resources, including EC2 instances, into Defender for Cloud. Once configured, the connector uses AWS IAM roles and APIs to continuously sync EC2 inventory and apply Defender plans (e.g., Defender for Servers) without requiring manual agent installation on each instance.

Answer

Deploy Azure Arc on each EC2 instance

Answer

Use AWS Systems Manager to push Defender workload

Answer

Configure AWS Config rules to report to Defender

Question 8

You need to design a solution to synchronize on-premises Active Directory users to Microsoft Entra ID for hybrid identity. Which tool should you use?

Accepted Answer

Microsoft Entra Connect. Microsoft Entra Connect is the correct tool for synchronizing on-premises Active Directory users to Microsoft Entra ID for hybrid identity because it provides a comprehensive, full-featured synchronization engine that supports password hash synchronization, pass-through authentication, and federation integration. It is the primary tool for hybrid identity scenarios where you need to synchronize a single on-premises AD forest to a single Entra ID tenant, handling attributes, password writeback, and device synchronization.

Answer

Microsoft Identity Manager (MIM)

Answer

Microsoft Entra Connect Cloud Sync

Answer

Active Directory Federation Services (AD FS)

Question 9

A company is designing a data protection strategy for Azure SQL Database. They need to ensure that backups are retained for 7 years to meet regulatory compliance. Which Azure feature should they use?

Accepted Answer

Long-Term Retention (LTR). Long-Term Retention (LTR) for Azure SQL Database allows you to retain full database backups for up to 10 years, which meets the 7-year regulatory compliance requirement. LTR is specifically designed for archival and compliance scenarios, storing backups in separate containers with configurable retention policies based on weekly, monthly, or yearly intervals.

Answer

Geo-redundant backup storage

Answer

Point-in-Time Restore

Answer

Active Geo-Replication

Question 10

A company is implementing a Zero Trust security model. Which principle requires verifying every access request as if it originates from an uncontrolled network?

Accepted Answer

Verify explicitly. The 'Assume breach' principle is not about verifying requests. 'Verify explicitly' is the Zero Trust principle that mandates authenticating and authorizing every access request. 'Least privilege' limits access rights. 'Micro-segmentation' is a network isolation technique.

Answer

Least privilege

Answer

Micro-segmentation

Answer

Assume breach

Question 11

A security architect is designing a data protection strategy for a Microsoft 365 tenant. The company must prevent users from sharing sensitive documents with external users via SharePoint Online. They want to apply a policy that automatically detects sensitive content and blocks external sharing. Which Microsoft Purview solution should they use?

Accepted Answer

Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive data and block external sharing. Option C is correct. Option A is wrong because sensitivity labels require manual application or automatic classification, but blocking external sharing is typically done by DLP. Option B is wrong because retention policies are for data retention, not blocking sharing. Option D is wrong because Microsoft Purview Information Protection is the umbrella, but the specific policy is DLP.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Microsoft Purview Information Protection

Question 12

Your organization is using Microsoft Defender for Cloud to manage security across multiple Azure subscriptions. You need to ensure that all virtual machines in the subscriptions are monitored by Defender for Cloud and that security alerts are sent to the security operations team. You also need to enforce that any new VMs are automatically onboarded to Defender for Cloud. You have a Log Analytics workspace in the central subscription. What should you do?

Accepted Answer

In Defender for Cloud, enable auto-provisioning for the Log Analytics agent at the management group level and specify the central workspace.. Enabling auto-provisioning of the Log Analytics agent at the management group scope ensures all VMs across subscriptions are monitored and new VMs are automatically onboarded. Option A is wrong because configuring only the workspace does not auto-provision. Option B is wrong because Azure Policy can enforce agent deployment, but auto-provisioning is simpler and more direct. Option D is wrong because enabling Defender for Cloud at the subscription level does not automatically install the agent.

Answer

Enable Defender for Cloud on each subscription and configure email notifications for alerts.

Answer

Assign an Azure Policy that deploys the Log Analytics agent to all VMs.

Answer

Create a Log Analytics workspace in each subscription and configure Defender for Cloud to use that workspace.

Question 13

You are designing security for a web application that will be developed by an external vendor. The vendor will have access to the source code repository and the development environment. You need to ensure that no secrets (e.g., API keys, connection strings) are stored in the source code. What is the best approach to manage secrets for this application?

Accepted Answer

Use Azure Key Vault to store secrets and configure the application to use managed identity to retrieve them.. Using Azure Key Vault to store secrets and referencing them from the application is the standard best practice. The application can use managed identity to authenticate to Key Vault securely. Storing secrets in app settings is not secure if the repository is accessible. Using environment variables is better but still not as secure as Key Vault. Hardcoding is unacceptable.

Answer

Store secrets in environment variables on the application server.

Answer

Store secrets in Azure App Service application settings encrypted at rest.

Answer

Embed secrets in the compiled code using obfuscation.

Question 14

A security administrator applies the Azure Policy definition shown in the exhibit to a management group containing multiple subscriptions. After the policy is assigned, a development team reports they cannot create a new storage account in their subscription. What is the most likely cause?

Accepted Answer

The storage account was created with the 'Secure transfer required' setting disabled.. The Azure Policy definition in the exhibit likely includes an effect (e.g., 'Deny') that requires the 'Secure transfer required' setting to be enabled on storage accounts. When the development team attempts to create a storage account with this setting disabled, the policy denies the request, preventing the creation. This is the most direct cause because Azure Policy enforces compliance rules at resource creation time, and disabling secure transfer violates the policy's condition.

Answer

The storage account was created using an older API version that does not support Azure Policy enforcement.

Answer

The storage account was created in a region that does not support the premium tier.

Answer

The storage account was assigned a network security group (NSG) that blocks inbound HTTPS traffic.

Question 15

A company's security team wants to automate response to common incidents like malware detected on endpoints. They have Microsoft 365 Defender and Microsoft Sentinel. Which feature should they use to create automated playbooks?

Accepted Answer

Microsoft Sentinel automation rules and playbooks. Microsoft Sentinel's automation rules and playbooks are the correct choice because they are specifically designed to automate incident response by triggering predefined actions (e.g., running a Logic App) when a detection event, such as malware on an endpoint, is ingested from Microsoft 365 Defender. This integration allows security teams to create custom, automated workflows that respond to common incidents without manual intervention.

Answer

Microsoft Purview's data loss prevention policies

Answer

Azure Policy

Answer

Microsoft Defender for Cloud's workflow automation

Question 16

You are designing a hybrid identity solution for an organization that uses Microsoft Entra ID and an on-premises Active Directory. The organization requires that users who are located in a remote office without a direct VPN connection to the main office can authenticate against on-premises resources using their Entra ID credentials. The solution must minimize latency and support passwordless authentication. Which feature should you implement?

Accepted Answer

Implement Microsoft Entra Kerberos authentication. Microsoft Entra Kerberos authentication enables users to authenticate to on-premises resources using their Entra ID credentials without requiring a VPN, and it supports passwordless methods like FIDO2 and Windows Hello for Business. Option A is incorrect because Entra Application Proxy is designed for publishing on-premises web applications, not for general authentication. Option C is incorrect because Conditional Access policies enforce access controls but do not provide authentication or passwordless capabilities. Option D is incorrect because Entra Connect Sync with password hash synchronization only syncs password hashes and does not support real-time passwordless authentication without a VPN.

Answer

Configure Microsoft Entra Application Proxy

Answer

Enable Microsoft Entra Conditional Access policies

Answer

Deploy Microsoft Entra Connect Sync with password hash synchronization

Question 17

Which TWO of the following are best practices for securing Microsoft 365 tenants? (Choose two.)

Accepted Answer

Enable security defaults in Microsoft Entra ID. Enabling security defaults provides a baseline of security. Using Conditional Access policies allows granular access control. These are best practices. Disabling modern authentication is counterproductive. Allowing all external sharing is risky. Using basic authentication is insecure. So the correct two are A and B.

Answer

Enable basic authentication for all apps

Answer

Disable modern authentication for legacy protocols

Answer

Allow all external sharing in SharePoint

Question 18

A healthcare provider is building a new patient portal on Azure App Service. The portal calls a backend API hosted on Azure Functions. The security team requires that the API accept requests only from the portal, that the portal prove its identity to the API without storing secrets in code or configuration, and that the credentials rotate automatically. You need to recommend an authentication approach for the portal-to-API call. What should you recommend?

Accepted Answer

Enable a system-assigned managed identity on the App Service and use it to request an access token for the Azure Functions app.. The cleanest way for one Azure compute resource to authenticate to another without secrets is a managed identity. The App Service obtains a Microsoft Entra ID token for the Functions app's audience, and the Functions app validates the token and authorizes the specific identity. The credential lifecycle is handled by the platform, which satisfies the automatic rotation requirement and eliminates secret sprawl.

Answer

Store a client secret in Azure Key Vault and have the portal retrieve it at runtime to call the API.

Answer

Issue each portal instance a client certificate and configure mutual TLS between App Service and Azure Functions.

Answer

Configure IP restrictions on the Azure Functions app to allow only the App Service outbound IP addresses.

Question 19

A company uses Microsoft Entra ID with P2 licenses. They want to implement a Zero Trust approach that requires step-up authentication for accessing high-value data in SharePoint. The solution must use risk-based policies and minimize user friction. Which combination should you recommend?

Accepted Answer

Microsoft Entra Conditional Access with sign-in risk policy and authentication context for sensitive data. It combines Conditional Access with a sign-in risk policy (from Identity Protection) and an authentication context that is applied to sensitive SharePoint data. This enforces step-up authentication only when risk is detected and the user accesses high-value data, minimizing friction for low-risk sessions while meeting Zero Trust requirements.

Answer

Microsoft Entra Conditional Access with trusted locations policy

Answer

Azure AD Conditional Access with MFA for all SharePoint access

Answer

Microsoft Entra Identity Protection user risk policy with MFA

Question 20

Order the steps to configure a Conditional Access policy requiring MFA for all users.

Accepted Answer

Assign users and groups → Assign cloud apps → Configure access controls (require MFA) → Enable policy. Conditional Access policy creation involves assignments for users and apps, then access controls like MFA.

Answer

Assign cloud apps → Assign users and groups → Configure access controls (require MFA) → Enable policy

Answer

Enable policy → Assign users and groups → Assign cloud apps → Configure access controls (require MFA)

Answer

Assign users and groups → Configure access controls (require MFA) → Assign cloud apps → Enable policy