SC-100 Practice Exam 3 — 20 Questions

Question 1

Trey Research, a biotech firm, is developing a machine learning model on Azure Machine Learning that uses sensitive genomic data. The data is stored in Azure Blob Storage. The company requires that all data be encrypted at rest using customer-managed keys stored in Azure Key Vault, and that access to the storage account be restricted to the Azure Machine Learning workspace and specific data scientists via Azure AD authentication. Additionally, the storage account must be accessible only from the company's virtual network. Which of the following configurations should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable encryption at rest with a customer-managed key, configure a private endpoint for the storage account, and grant the Machine Learning workspace and data scientists access using Azure RBAC with the Storage Blob Data Contributor role.. It provides encryption at rest with a customer-managed key (CMK) stored in Azure Key Vault, a private endpoint to restrict access to the company's virtual network, and Azure RBAC with the Storage Blob Data Contributor role for both the Machine Learning workspace and data scientists, ensuring Microsoft Entra ID authentication. Option A is wrong because firewall rules using IP ranges are less secure than private endpoints, and granting access via storage account access keys bypasses Microsoft Entra ID authentication. Option B is wrong because it uses a service-managed key, which does not meet the customer-managed key requirement. Option D is wrong because a service endpoint is less secure than a private endpoint, and using a SAS token does not provide Microsoft Entra ID-based access control.

Answer

Enable encryption at rest with a customer-managed key, configure a firewall to allow the Machine Learning workspace's IP range, and grant data scientists access via storage account access keys.

Answer

Enable encryption at rest with a service-managed key, configure a private endpoint, and grant data scientists access using Azure RBAC with the Storage Blob Data Reader role.

Answer

Enable encryption at rest with a customer-managed key, configure a service endpoint for the storage account, and grant the Machine Learning workspace access using a SAS token.

Question 2

A government agency, Northwind, is deploying a sensitive application on Azure App Service Environment (ASE) v3. The application handles classified data and must meet FedRAMP High requirements. You need to design a security solution that includes: (1) encryption at rest for the app's content and configuration, (2) encryption in transit with TLS 1.2 or higher, (3) network isolation using VNet integration and private endpoints, (4) identity-based access to Azure SQL Database using managed identity, and (5) certificate management for custom domains using Azure Key Vault. Which of the following designs meets all requirements?

Accepted Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.. ASE v3 provides a fully isolated, single-tenant App Service environment deployed into a customer VNet, which is required for FedRAMP High and network isolation. It also correctly combines HTTPS-only with TLS 1.2, a system-assigned managed identity for passwordless Azure SQL authentication, and Key Vault for certificate management — all of which are supported natively in ASE v3. The other options either use multi-tenant App Service (not isolated) or substitute components that don't meet the full requirement set.

Answer

Deploy the app on a multi-tenant App Service plan, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.

Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a user-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from App Service certificates.

Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a service principal to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.

Question 3

You are a security architect for a large enterprise that is migrating to Microsoft 365. The organization has 50,000 users across multiple regions. They have recently experienced a ransomware attack that encrypted files on SharePoint Online and OneDrive for Business. The security team wants to implement a comprehensive protection strategy. Requirements: 1. Automatically detect and block ransomware-like behavior in real-time. 2. Provide users with self-service recovery of files encrypted by ransomware. 3. Ensure that all files in SharePoint and OneDrive are scanned for malware upon upload. 4. Minimize administrative overhead. Which combination of Microsoft 365 security features should you recommend?

Accepted Answer

Enable Microsoft Defender for Office 365 to scan files on upload and use version history and recycle bin for recovery.. Microsoft Defender for Office 365 provides real-time scanning of files uploaded to SharePoint and OneDrive, detecting and blocking known malware. Combined with version history and the recycle bin, users can self-recover files encrypted by ransomware without administrative intervention, satisfying all requirements with minimal overhead.

Answer

Use Microsoft Entra ID Protection to detect compromised accounts and automatically block access.

Answer

Enable Microsoft Endpoint DLP and configure file policies to block encrypted files.

Answer

Configure Microsoft Purview auto-labeling to apply a 'Ransomware' label and then block all labeled files.

Question 4

Which TWO are recommended practices for securing Microsoft 365 workloads? (Select two.)

Accepted Answer

Enable unified audit logging in Microsoft Purview. Option D is correct because enabling unified audit logging in Microsoft Purview ensures that user and admin activities across Exchange Online, SharePoint Online, OneDrive, and Teams are recorded, which is essential for incident investigation, forensic analysis, and compliance reporting. Option E is correct because a Microsoft Defender for Office 365 Safe Attachments policy detonates email attachments in a sandbox before delivery, blocking zero-day malware and malicious payloads that traditional signature-based filtering would miss. The unmarked options do not belong: A weakens security by exposing SharePoint content externally, B undermines account protection by removing MFA even for trusted IPs (which can be spoofed or compromised), and C grants broad OAuth access to third-party apps, increasing the risk of data exfiltration and consent-phishing attacks.

Answer

Allow external sharing for all SharePoint sites

Answer

Disable multifactor authentication for users who access from trusted IPs

Answer

Allow all third-party apps to access Microsoft 365 data

Question 5

Which TWO of the following are key components of a Zero Trust architecture according to Microsoft? (Choose two.)

Accepted Answer

Use least privilege access. Option D, 'Verify explicitly,' is correct because Microsoft's Zero Trust model requires that every access request be authenticated and authorized based on all available data points, including user identity, device health, location, and data sensitivity, rather than assuming trust based on network location. Option C, 'Use least privilege access,' is correct because Zero Trust limits user access with just-in-time and just-enough-access (JIT/JEA) principles, risk-based adaptive policies, and data protection to minimize lateral movement and exposure. The three guiding principles Microsoft defines are verify explicitly, use least privilege access, and assume breach, so these two options align directly with that framework. Option A, 'Trust but verify,' is not a Zero Trust principle; it reflects a traditional perimeter mindset where trust is initially granted. Option B, 'Implicit trust for internal traffic,' contradicts Zero Trust, which removes implicit trust based on network location. Option E, 'Rely on a strong perimeter,' is also contrary to Zero Trust, which assumes the perimeter can be breached and therefore does not rely on it for security.

Answer

Trust but verify

Answer

Implicit trust for internal traffic

Answer

Rely on a strong perimeter

Question 6

You are the security architect for a company that uses Microsoft Defender for Cloud. The company has Azure virtual machines (VMs) and on-premises Windows Servers onboarded to Microsoft Defender for Servers Plan 2. The security team requires that all servers be protected against fileless attacks and that suspicious process behavior be detected in near real-time. You need to recommend a solution that meets these requirements while minimizing administrative effort. What should you include in your recommendation?

Accepted Answer

Enable Microsoft Defender for Endpoint integration and ensure that the automatic provisioning of the Microsoft Defender for Endpoint agent is turned on for all supported machines.. The requirement is for advanced endpoint detection and response, specifically fileless attack detection and behavioral monitoring. Microsoft Defender for Servers Plan 2 includes Defender for Endpoint integration, which delivers these capabilities. Automatic provisioning ensures the agent is deployed to all supported machines with minimal administrative effort, satisfying both the technical and operational requirements.

Answer

Enable just-in-time (JIT) VM access for all servers to limit exposure to brute-force attacks.

Answer

Configure adaptive application controls in Microsoft Defender for Cloud to allow only approved applications to run on the servers.

Answer

Deploy the Log Analytics agent to all servers and create custom alerts based on Windows Security event logs.

Question 7

Your organization uses Microsoft Sentinel as its SIEM. You need to design a solution to automatically respond to detected threats in Azure resources. The response must include isolating the affected virtual machine and creating a support ticket. Which approach should you use?

Accepted Answer

Create a Microsoft Sentinel automation rule that triggers a playbook when an incident is generated. The playbook uses Azure Logic Apps to isolate the VM and create a ticket in your IT service management tool.. Microsoft Sentinel automation rules can trigger playbooks (Azure Logic Apps) when incidents are generated. Logic Apps provide native connectors to isolate Azure VMs (via the Azure Resource Manager connector) and create tickets in IT service management tools (e.g., ServiceNow, Jira), meeting both requirements in a single automated workflow.

Answer

Create an Azure Policy initiative that automatically remediates non-compliant resources

Answer

Create a Microsoft Sentinel analytics rule that runs a KQL query and automatically sends an email to the security team

Answer

Create an Azure Automation runbook that runs on a schedule to check for threats and isolate VMs

Question 8

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. Based on the JSON snippet, what is the most likely outcome when a user with high user risk attempts to sign in?

Accepted Answer

The sign-in is blocked because user risk is high. The Conditional Access policy shown in the JSON snippet includes a condition for 'userRiskLevels' set to 'high', and the grant control is 'block'. When a user with high user risk attempts to sign in, the policy evaluates the user risk level and, since it matches the condition, applies the block action, preventing the sign-in entirely.

Answer

The sign-in is blocked only if sign-in risk is also high

Answer

The sign-in is allowed because sign-in risk is not high

Answer

The user is prompted for multi-factor authentication

Question 9

Your organization uses Microsoft Sentinel for security operations. You need to ensure that all incidents related to a specific critical asset are automatically assigned to the senior SOC analyst. The assignment should occur as soon as the incident is created. What should you configure?

Accepted Answer

Create an automation rule that sets the incident owner to the senior SOC analyst.. Automation rules in Microsoft Sentinel can directly set the incident owner upon creation without requiring a playbook. This is the simplest and most efficient method for immediate assignment, as automation rules run automatically when an incident is created and can modify incident properties like owner.

Answer

Modify the analytics rule to include a custom details field for owner.

Answer

Create a playbook and trigger it from an automation rule.

Answer

Configure a workbook to display incidents and manually assign them.

Question 10

Your organization is implementing a zero-trust security model. You need to design a solution that continuously verifies user identity, device compliance, and access context before granting access to corporate resources. The solution should also support risk-based policies. Which Microsoft security capability should be at the core of this design?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the core policy engine for zero-trust, enabling continuous verification of user identity, device compliance, and access context before granting resource access. It integrates with risk signals from Microsoft Entra ID Protection to enforce risk-based policies, such as requiring multi-factor authentication when sign-in risk is high. This aligns directly with the zero-trust principle of 'never trust, always verify' by evaluating conditions in real time.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 11

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You need to create an analytics rule that generates an incident when a user is reported as compromised by Microsoft Defender for Identity. The rule should use the most efficient method to get this data. What should you use as the data source?

Accepted Answer

The SecurityAlert table with a filter for Defender for Identity.. The SecurityAlert table contains security alerts from various sources, including Microsoft Defender for Identity, when ingested via the Microsoft 365 Defender connector. By filtering for Defender for Identity alerts, you can create an analytics rule that triggers an incident when a user is reported as compromised. This is the most efficient method because the alerts are already available in this table. Option B (DeviceEvents) is from Advanced Hunting and is not directly available in Sentinel tables; it requires running queries against the Microsoft 365 Defender advanced hunting schema, which is less efficient for creating analytics rules. Option C (OfficeActivity) contains Office 365 audit logs, not security alerts. Option D (IdentityInfo) contains identity information such as user details, but not alerts or compromise status.

Answer

The DeviceEvents table from Advanced Hunting.

Answer

The OfficeActivity table.

Answer

The IdentityInfo table.

Question 12

Your organization uses Microsoft Intune for mobile device management and Microsoft Entra ID for identity. You are designing a solution to ensure that only devices that are compliant with security policies can access corporate resources. The requirements are: 1) Devices must have a minimum OS version. 2) Devices must have encryption enabled. 3) Devices must not be jailbroken or rooted. 4) Access to corporate apps must be blocked if the device is non-compliant. 5) The solution should automatically remediate non-compliant devices when possible. You need to recommend the minimum configuration. What should you do?

Accepted Answer

Create a device compliance policy in Intune with the required settings, and create a Conditional Access policy that requires compliant devices.. The minimum configuration is to create a device compliance policy in Intune with the required settings (minimum OS version, encryption, jailbreak/root detection) and create a Conditional Access policy that requires compliant devices. This ensures only compliant devices can access corporate resources, and Intune can automatically remediate non-compliant devices where possible.

Answer

Configure Microsoft Purview Compliance Manager to assess compliance and block access.

Answer

Create an app protection policy in Intune that requires minimum OS and encryption.

Answer

Create a device configuration policy in Intune for the settings, and use Azure AD Identity Protection to block access.

Question 13

Your organization is deploying a new line-of-business application on Azure App Service. The app must authenticate users from Microsoft Entra ID and also access a downstream API that requires a client secret. You need to recommend the most secure method for managing the client secret. What should you use?

Accepted Answer

Store the secret in Azure Key Vault and use a Key Vault reference in App Service.. Storing the client secret in Azure Key Vault and referencing it from App Service via a Key Vault reference is the most secure method. Key Vault provides centralized secret management, access control via Entra ID, auditing, rotation capabilities, and hardware-backed protection (HSM) for keys. App Service can resolve Key Vault references at runtime using its managed identity, so the secret never appears in application settings or code.

Answer

Store the secret in the Azure AD app registration manifest.

Answer

Store the secret in an App Service application setting.

Answer

Store the secret in the application code as a constant.

Question 14

A multinational corporation uses Microsoft Entra ID for identity and Microsoft Defender for Cloud Apps for SaaS app governance. The security team wants to deploy a conditional access policy that blocks access from untrusted locations for all cloud apps except Microsoft 365, which should only be blocked if the device is not compliant. How should you configure the policy?

Accepted Answer

Create two conditional access policies: one for all cloud apps except Microsoft 365 blocking untrusted locations, and one for Microsoft 365 requiring compliant device.. Option B is correct because Conditional Access policies apply to either all cloud apps or specific apps, and Microsoft 365 cannot be excluded from one policy while having different conditions applied within the same policy. The scenario requires two separate policies: one targeting all cloud apps with Microsoft 365 excluded that blocks untrusted locations, and a second targeting Microsoft 365 that requires a compliant device. Option A is wrong because Defender for Cloud Apps session policies monitor or control sessions but do not block sign-ins from untrusted locations. Option C is wrong because a single policy cannot apply a compliant-device requirement only to Microsoft 365 while including all other cloud apps with different conditions. Option D is wrong because it blocks Microsoft 365 from untrusted locations unconditionally, ignoring the compliant-device exception.

Answer

Use a session policy in Defender for Cloud Apps to monitor non-compliant devices.

Answer

Create one conditional access policy that includes all cloud apps and requires compliant device for Microsoft 365 only.

Answer

Configure a conditional access policy that blocks access from untrusted locations for all apps.

Question 15

Your organization is implementing a privileged access strategy using Microsoft Entra Privileged Identity Management (PIM). The compliance team requires that all privileged role activations be approved by a manager and that an audit trail is maintained for at least one year. Which configuration should you recommend?

Accepted Answer

Set PIM role settings to require approval and enable audit logging. It directly addresses both compliance requirements: requiring approval ensures a manager authorizes each activation, and enabling audit logging in PIM retains activation history for at least one year. PIM role settings allow you to configure approval workflows and automatically log all activations to the Microsoft Entra audit log, which can be exported and retained for compliance purposes.

Answer

Configure access reviews for privileged roles

Answer

Enable Conditional Access policies for privileged roles

Answer

Require Azure MFA for role activation

Question 16

Wide World Importers is deploying a critical line-of-business application on Azure Kubernetes Service (AKS). The application processes financial transactions and must meet SOX compliance. You need to design a security solution that includes: encryption of secrets (e.g., database connection strings) using Azure Key Vault, automatic certificate rotation for TLS termination, network isolation of the AKS cluster, and audit logging of all access to secrets. The solution should use a managed identity for the AKS cluster to access Key Vault. Which of the following designs meets the requirements?

Accepted Answer

Enable managed identity for the AKS cluster, integrate Key Vault with AKS using the Secrets Store CSI driver, deploy the cluster as a private cluster, and enable diagnostic settings on Key Vault to send logs to a Log Analytics workspace.. Option A meets all requirements: using managed identity for AKS to access Key Vault (secure, no credentials), integrating Key Vault with AKS via the Secrets Store CSI driver (enables encryption and automatic certificate rotation), deploying as a private cluster (network isolation), and enabling diagnostic settings on Key Vault to send logs to Log Analytics (audit logging). This design leverages Azure-native integrations for security and compliance.

Answer

Use a service principal for AKS to access Key Vault, store secrets as Kubernetes secrets, configure a private cluster, and enable audit logging on Key Vault.

Answer

Enable managed identity for the AKS cluster, store secrets in the cluster's native Kubernetes secrets, use a private endpoint for the AKS API server, and enable Azure Monitor for containers.

Answer

Use a service principal to access Key Vault, store secrets as encrypted Kubernetes secrets with a customer-managed key, deploy a public cluster with network policies, and enable Key Vault logging.

Question 17

Your company uses Microsoft Entra ID for identity management. You need to implement a solution that allows external partners to access a specific application using their own identity providers, while ensuring that their accounts are automatically deprovisioned when removed from their home organization. Which feature should you use?

Accepted Answer

Entitlement management with connected organizations. Entitlement management with connected organizations in Microsoft Entra ID (part of Identity Governance) is designed exactly for this scenario: it lets you onboard external partners, define access packages tied to their home identity providers, and automatically deprovision access when the user leaves their home organization via lifecycle workflows and connected-organization sync. This provides both the cross-tenant access and the automatic deprovisioning requirement.

Answer

B2B direct federation

Answer

Self-service sign-up

Answer

Identity Governance access reviews

Question 18

A healthcare organization uses Microsoft Purview Information Protection to classify and protect patient data. They want to automatically apply a 'High Confidentiality' label to any document containing a patient ID pattern (###-####). The label should also encrypt the document. Which configuration should they use?

Accepted Answer

Sensitivity label with auto-labeling for sensitive info types. To automatically apply a label that encrypts documents containing a patient ID pattern, the organization should use a sensitivity label with auto-labeling configured for sensitive info types. Sensitivity labels can enforce encryption and are applied automatically based on conditions such as the presence of sensitive information types (e.g., a custom regex for ###-####).

Answer

Retention label with auto-labeling policy

Answer

Data Loss Prevention (DLP) policy with a block action

Answer

Trainable classifier with a retention policy

Question 19

A company uses Microsoft 365 and wants to protect sensitive documents from being shared externally. They need a solution that automatically classifies documents containing personally identifiable information (PII) and applies appropriate protection. Which two services should they combine?

Accepted Answer

Microsoft Purview Information Protection and Data Loss Prevention (DLP). Microsoft Purview Information Protection allows for classification and labeling of documents based on content, while Data Loss Prevention (DLP) policies can enforce actions such as blocking external sharing or applying encryption. Together, they provide automated protection for sensitive documents like those containing PII. Option D is correct because these two services work together to classify and protect documents. Option A is incorrect because Microsoft Defender for Cloud Apps focuses on SaaS app security and Intune is for device management; they do not directly classify documents. Option B is incorrect because Compliance Manager is for managing compliance posture, and Sentinel is a SIEM; they are not used for automatic document classification. Option C is incorrect because Azure Information Protection is a previous version, now part of Purview, and Microsoft Entra ID is an identity service; they do not provide the same integrated classification and DLP capabilities as the Purview solutions.

Answer

Microsoft Defender for Cloud Apps and Microsoft Intune

Answer

Microsoft Purview Compliance Manager and Microsoft Sentinel

Answer

Azure Information Protection and Microsoft Entra ID

Question 20

Your organization uses Microsoft Intune for mobile device management. You need to ensure that only compliant devices can access corporate email. What should you configure?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires compliant device.. Conditional Access in Microsoft Entra ID can enforce device compliance for access. Option A is incorrect because app protection policies protect data within apps but do not control device-level access. Option B is incorrect because device configuration policies define settings but do not enforce compliance-based access. Option D is incorrect because device compliance policies define compliance requirements, but Conditional Access is needed to enforce them.

Answer

Configure an app protection policy in Intune.

Answer

Create a device configuration policy in Intune.

Answer

Create a device compliance policy in Intune.