SC-100 Practice Exam 2 — 20 Questions

Question 1

Which THREE of the following are key components of a security operations strategy according to Microsoft's best practices?

Accepted Answer

Detection and analysis. Detection and analysis is a core component of a security operations strategy because it defines how security events are identified, triaged, and investigated. Microsoft's NIST-based SOC maturity model emphasizes continuous monitoring and analytics (e.g., using Microsoft Sentinel analytics rules, UEBA, and threat intelligence) to reduce mean time to detect (MTTD). Without robust detection and analysis, an organization cannot effectively respond to threats.

Answer

Microsoft Sentinel deployment

Answer

Policy and standards development

Question 2

Order the steps to configure a Conditional Access policy requiring MFA for all users.

Accepted Answer

Assign users and groups → Assign cloud apps → Configure access controls (require MFA) → Enable policy. Conditional Access policy creation involves assignments for users and apps, then access controls like MFA.

Answer

Assign cloud apps → Assign users and groups → Configure access controls (require MFA) → Enable policy

Answer

Enable policy → Assign users and groups → Assign cloud apps → Configure access controls (require MFA)

Answer

Assign users and groups → Configure access controls (require MFA) → Assign cloud apps → Enable policy

Question 3

You are designing a secure access strategy for Azure App Service web applications. The requirements are: use Azure AD for authentication, restrict access to specific IP ranges, and require multi-factor authentication (MFA) for all users. Which two components should you configure? (Choose two.)

Accepted Answer

Configure Azure App Service authentication with Microsoft Entra ID. Options B and C are correct. Azure App Service authentication can be configured to use Microsoft Entra ID for user authentication, and a Conditional Access policy can enforce MFA and restrict IP ranges. Option A is incorrect because applying an NSG to the App Service subnet is not the direct method for IP restriction; IP restrictions can be configured directly in the App Service settings. Option D is incorrect because Azure Firewall is a network-level firewall and does not handle user authentication or application-level access control. Option E is incorrect because registering the application is a prerequisite but not a component that directly enforces access rules.

Answer

Apply a network security group (NSG) to the App Service subnet

Answer

Deploy Azure Firewall to filter inbound traffic

Answer

Register the application in Microsoft Entra ID

Question 4

A government agency, Northwind, is deploying a sensitive application on Azure App Service Environment (ASE) v3. The application handles classified data and must meet FedRAMP High requirements. You need to design a security solution that includes: (1) encryption at rest for the app's content and configuration, (2) encryption in transit with TLS 1.2 or higher, (3) network isolation using VNet integration and private endpoints, (4) identity-based access to Azure SQL Database using managed identity, and (5) certificate management for custom domains using Azure Key Vault. Which of the following designs meets all requirements?

Accepted Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.. ASE v3 is deployed in a VNet, providing network isolation. Enforcing HTTPS only with TLS 1.2 ensures encryption in transit. Using system-assigned managed identity allows identity-based access to Azure SQL Database. TLS/SSL certificates from Azure Key Vault support certificate management. Option A is wrong because a multi-tenant App Service plan does not provide network isolation, failing the VNet integration requirement. Option C is wrong because App Service certificates are not managed via Key Vault, failing the certificate management requirement. Option D is wrong because service principal is less secure than managed identity and does not meet the identity-based access requirement.

Answer

Deploy the app on a multi-tenant App Service plan, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.

Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a user-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from App Service certificates.

Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a service principal to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.

Question 5

Your organization uses Microsoft Intune for mobile device management and Microsoft Entra ID for identity. You are designing a solution to ensure that only devices that are compliant with security policies can access corporate resources. The requirements are: 1) Devices must have a minimum OS version. 2) Devices must have encryption enabled. 3) Devices must not be jailbroken or rooted. 4) Access to corporate apps must be blocked if the device is non-compliant. 5) The solution should automatically remediate non-compliant devices when possible. You need to recommend the minimum configuration. What should you do?

Accepted Answer

Create a device compliance policy in Intune with the required settings, and create a Conditional Access policy that requires compliant devices.. Intune device compliance policies define the required security settings (minimum OS, encryption, jailbreak/root detection) and can include actions for automatic remediation when possible. A Conditional Access policy in Entra ID then requires devices to be marked compliant before accessing corporate resources. Option A is incorrect because Microsoft Purview Compliance Manager is a compliance management tool that does not enforce real-time access control. Option B is incorrect because app protection policies (MAM) operate at the app level and do not enforce device-level compliance. Option D is incorrect because device configuration policies are for settings management, not compliance enforcement, and Entra ID Identity Protection is for risk-based policies, not device compliance checks.

Answer

Configure Microsoft Purview Compliance Manager to assess compliance and block access.

Answer

Create an app protection policy in Intune that requires minimum OS and encryption.

Answer

Create a device configuration policy in Intune for the settings, and use Azure AD Identity Protection to block access.

Question 6

A company is implementing a Zero Trust network strategy using Azure Virtual Network Manager (AVNM). They need to ensure that all traffic between virtual networks is encrypted and inspected by a firewall. Which configuration should they use?

Accepted Answer

Use a hub-and-spoke topology with a firewall appliance in the hub. In a Zero Trust network strategy, all traffic must be encrypted and inspected regardless of source. A hub-and-spoke topology with a firewall appliance in the hub forces all inter-VNet traffic through the firewall, enabling deep packet inspection and encryption enforcement. Azure Virtual Network Manager (AVNM) can deploy this topology and route traffic via the hub, ensuring no direct VNet-to-VNet communication bypasses inspection.

Answer

Enable VNet peering between all VNets and use network security groups

Answer

Use a mesh topology with direct connectivity between VNets

Answer

Configure service endpoints for each VNet

Question 7

A company uses Microsoft Defender for Cloud to assess compliance with Azure Security Benchmark (ASB). The security team wants to ensure that all recommendations are being followed. Which three actions should the team take to manage and remediate recommendations effectively?

Accepted Answer

Enable continuous export of compliance data to Log Analytics or Event Hubs.. Enabling continuous export of compliance data to Log Analytics or Event Hubs allows the security team to centralize, query, and monitor compliance data over time. This is essential for tracking the status of all Azure Security Benchmark recommendations, creating custom alerts, and integrating with SIEM or automation workflows. Option C is correct because creating exemption rules for resources that are compliant by other means (e.g., via a third-party tool or compensating controls) prevents false positives and reduces alert fatigue while maintaining accurate compliance posture. Option D is correct because enabling automatic provisioning of the Log Analytics agent ensures that all supported VMs are monitored and can report their compliance status, which is a foundational requirement for many ASB recommendations. Options B and E are incorrect: manual monthly remediation is not scalable or continuous, and disabling recommendations should be done via exemptions rather than outright disabling to maintain auditability.

Answer

Manually remediate all high-severity recommendations each month.

Answer

Disable recommendations that are not applicable to the environment.

Question 8

A company plans to implement a Zero Trust security model. Which of the following is the primary principle that should guide their strategy?

Accepted Answer

Assume breach and verify explicitly. The primary principle of Zero Trust is 'never trust, always verify,' which is operationalized as 'assume breach and verify explicitly.' This means every access request—regardless of source (internal or external)—must be authenticated, authorized, and encrypted before granting access. It eliminates implicit trust based on network location and enforces least-privilege access, which is foundational to the Zero Trust architecture.

Answer

Use a strong perimeter firewall as the primary defense

Answer

Grant trusted users full access to all resources

Answer

Trust but verify all internal traffic

Question 9

Which THREE capabilities are provided by Microsoft Defender for Cloud Apps (MDA) when integrated with Microsoft Defender XDR?

Accepted Answer

Discovery of shadow IT cloud apps.. Microsoft Defender for Cloud Apps (MDA) integrates with Microsoft Defender XDR to provide shadow IT discovery by analyzing traffic logs from network devices and cloud app catalogs, identifying unsanctioned cloud applications used in the organization. This capability is core to MDA's Cloud Discovery feature, which uses log parsing and machine learning to detect and classify shadow IT.

Answer

Email protection against phishing and malware.

Answer

Endpoint detection and response (EDR) for devices.

Question 10

Your organization is implementing Microsoft Defender for Identity to protect on-premises Active Directory. Which THREE activities does Defender for Identity monitor?

Accepted Answer

Privilege escalation attempts. Correct answers: A, B, D. Defender for Identity monitors privilege escalation attempts (A) by detecting suspicious changes in user privileges. Lateral movement paths using Pass-the-Hash (B) are detected by analyzing network activity and authentication patterns. Reconnaissance attacks using LDAP queries (D) are identified by unusual LDAP search patterns. Option C is incorrect: file integrity changes on domain controllers are monitored by Defender for Servers or Azure Policy, not Defender for Identity. Option E is incorrect: network traffic to external IP addresses is monitored by Defender for Network or network security groups, not Defender for Identity.

Answer

File integrity changes on domain controllers

Answer

Network traffic to external IP addresses

Question 11

A company uses Microsoft Entra ID for identity management. They want to ensure that only managed devices can access corporate email. Which Conditional Access policy setting should be configured?

Accepted Answer

Require device to be marked as compliant. To ensure only managed devices can access corporate email, you need to enforce device compliance. The Conditional Access policy setting 'Require device to be marked as compliant' checks that the device is enrolled in Microsoft Intune and meets all compliance policies (e.g., encryption, OS version, jailbreak detection) before granting access. This directly restricts access to managed devices only.

Answer

Require multifactor authentication

Answer

Block legacy authentication

Answer

Require approved client app

Question 12

Your organization uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to design a solution that automatically applies a 'Confidential' sensitivity label to documents that contain credit card numbers and are shared externally. The solution should also generate an alert when this occurs. Which two configurations should you implement? (Choose TWO.)

Accepted Answer

Create a Microsoft Purview auto-labeling policy that includes the 'Credit Card Number' sensitive info type and specifies the 'Confidential' label.. Options D and E are correct because an auto-labeling policy in Microsoft Purview can scan for sensitive info types (credit card numbers) and automatically apply the 'Confidential' label to documents. A Microsoft Defender for Cloud Apps app governance policy can monitor file sharing and trigger an alert when a document with the 'Confidential' label is shared externally. Option A (Microsoft Sentinel analytics rule) could generate alerts but is not the primary mechanism for labeling, and option B (Conditional Access) controls access, not labeling. Option C (Data Loss Prevention) is for blocking, not labeling.

Answer

Configure a Microsoft Sentinel analytics rule that queries audit logs for external sharing of labeled documents and generates an incident.

Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance when accessing documents labeled 'Confidential'.

Answer

Configure a Microsoft Purview Data Loss Prevention (DLP) policy that blocks the sharing of documents containing credit card numbers.

Question 13

Your company uses Microsoft Defender for Cloud to secure Azure workloads. You need to ensure that all storage accounts have the 'Secure transfer required' setting enabled. What should you use?

Accepted Answer

Azure Policy. Azure Policy can audit and enforce the 'Secure transfer required' setting across all storage accounts. Option A (RBAC) is incorrect because RBAC controls access permissions, not resource configuration. Option B (Azure Blueprints) is deprecated and not the direct solution for this requirement. Option C (Microsoft Defender for Cloud regulatory compliance dashboard) provides visibility but does not enforce settings.

Answer

Azure role-based access control (RBAC)

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Question 14

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Accepted Answer

Microsoft Intune for device management and compliance policies. A is correct because Microsoft Intune provides device management and compliance policies that define the security posture required for managed devices, such as requiring encryption, a minimum OS version, or a specific patch level. These compliance policies are evaluated by Azure AD during authentication, ensuring only devices that meet the organization's security standards can access corporate resources.

Answer

Azure AD Application Proxy

Answer

Azure AD B2B collaboration

Question 15

Your organization is adopting a Zero Trust security model. You need to design a solution that ensures continuous verification of user identity and device health before granting access to resources. Which Microsoft Entra ID feature should you prioritize?

Accepted Answer

Microsoft Entra ID Conditional Access. Conditional Access is the primary Microsoft Entra ID feature that enforces continuous verification by evaluating user identity, device health (via compliance policies or Microsoft Defender for Endpoint signals), location, and risk in real-time before granting access. It directly supports the Zero Trust principle of 'never trust, always verify' by requiring authentication and authorization at every access attempt, not just at the perimeter.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 16

You are a security architect for a large financial services company. The company has a hybrid identity environment with on-premises Active Directory synchronized to Microsoft Entra ID using Microsoft Entra Connect. They use Microsoft 365 E5 licenses and have deployed Microsoft Defender for Cloud, Microsoft Defender for Identity, Microsoft Sentinel, and Microsoft Purview. The company has recently suffered a ransomware attack where an attacker gained access via a compromised service account that had permanent Global Administrator privileges. The attacker then used the account to create a backdoor user and exfiltrate sensitive data from SharePoint Online. After the incident, the CISO mandates a Zero Trust security transformation with the following requirements: 
1. Eliminate standing privileged access for all cloud admins.
2. Require phishing-resistant authentication for all privileged roles.
3. Ensure that all sensitive data in SharePoint Online is automatically classified and protected.
4. Enable detection of lateral movement using anomalous behavior analytics. Which combination of actions should you recommend?

Accepted Answer

Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.. It directly addresses all four CISO requirements: Privileged Identity Management (PIM) eliminates standing Global Administrator privileges by requiring just-in-time activation; Authentication Strengths with FIDO2 enforces phishing-resistant authentication for privileged roles; auto-labeling policies in Microsoft Purview automatically classify and protect sensitive data like credit card numbers in SharePoint Online; and Defender for Identity lateral movement path detection uses behavioral analytics to detect anomalous lateral movement, fulfilling the detection requirement.

Answer

Deploy Microsoft Entra Identity Protection for all users, configure Azure AD Conditional Access with MFA, use Microsoft Purview Information Protection with manual labeling, and enable Microsoft Sentinel analytics for lateral movement.

Answer

Configure Conditional Access to require MFA for admins, enable Microsoft Purview DLP for SharePoint, deploy Defender for Cloud Apps, and use Identity Protection for user risk.

Answer

Remove all permanent admin roles and use just-in-time access via PIM, enforce MFA via Conditional Access, apply sensitivity labels via Microsoft Purview Data Map, and use Microsoft Defender for Cloud for network security groups.

Question 17

Your organization uses Microsoft Sentinel and wants to correlate security events from multiple sources to detect multi-stage attacks. What should you create?

Accepted Answer

Fusion rule. Fusion rules in Microsoft Sentinel are specifically designed to correlate security events from multiple sources and detect multi-stage attacks by combining alerts from different detection technologies into a single incident. This matches the requirement to correlate events across sources for complex attack chains, unlike other rule types that focus on single-source or single-event detection.

Answer

Scheduled query rule

Answer

NRT rule

Answer

Anomaly rule

Question 18

A company uses Azure DevOps and wants to implement a DevSecOps practice by scanning code for secrets and vulnerabilities before deployment. Which tool should they integrate into their pipeline?

Accepted Answer

Microsoft Defender for DevOps. Microsoft Defender for DevOps is the correct choice because it is a unified DevSecOps solution that integrates directly into Azure DevOps pipelines to scan code for secrets, vulnerabilities, and open-source dependencies before deployment. It provides actionable security insights and remediation guidance, aligning with the requirement to implement a DevSecOps practice by scanning code for secrets and vulnerabilities.

Answer

Azure Policy

Answer

Microsoft Purview

Answer

GitHub Advanced Security

Question 19

A company is designing a security strategy for their AI-powered applications using Microsoft Azure OpenAI Service. They need to ensure that the AI models are not used to generate harmful content and that the data sent to the models is protected. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) for AI. Microsoft Purview Data Loss Prevention (DLP) for AI is the correct feature because it is specifically designed to monitor and control the data sent to and from AI applications, including Azure OpenAI Service, to prevent the generation of harmful content and protect sensitive data. It uses deep content analysis and policy-based controls to detect and block policy violations in real-time, directly addressing the dual requirements of content safety and data protection.

Answer

Microsoft Purview Endpoint DLP

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Question 20

A company uses Azure App Service to host a web application that stores sensitive data in Azure SQL Database. The security team requires that data at rest in the database be encrypted using a customer-managed key stored in Azure Key Vault. The key must be rotated automatically every 90 days. What is the recommended approach to meet these requirements?

Accepted Answer

Enable TDE with customer-managed keys in Azure Key Vault and set a key rotation policy in Key Vault to rotate the key every 90 days.. Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure Key Vault meets the requirement for encrypting data at rest in Azure SQL Database using a key controlled by the customer. Azure Key Vault supports automatic key rotation policies that can be set to rotate the key every 90 days, satisfying the rotation requirement without manual intervention or application code changes.

Answer

Encrypt sensitive columns using cell-level encryption with keys stored in Azure Key Vault and rotate keys manually every 90 days.

Answer

Enable Transparent Data Encryption (TDE) with service-managed keys in Azure SQL Database.

Answer

Use Always Encrypted with column master keys stored in Azure Key Vault and configure key rotation in the application code.