SC-100 Practice Test 21 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to ensure that your Azure App Service web applications are protected against common web vulnerabilities like SQL injection. What should you enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Web Application Firewall (WAF) on Azure Front Door. The correct option is A: Web Application Firewall (WAF) on Azure Front Door. A WAF inspects incoming HTTP/HTTPS traffic and applies managed rule sets (such as the OWASP Core Rule Set) to block common web exploits like SQL injection and cross-site scripting before they reach the App Service. Just-in-time (JIT) VM access (B) only brokers temporary, approved RDP/SSH access to virtual machines and has no bearing on web application layer attacks. Adaptive Application Controls (C) are an Azure Security Center/Defender for Cloud feature that whitelists processes on VMs to detect anomalous execution, not HTTP payloads. Azure DDoS Protection (D) mitigates volumetric and protocol-level network floods, not application-layer injection attacks.

Answer

Just-in-time (JIT) VM access

Answer

Adaptive Application Controls

Answer

Azure DDoS Protection

Question 2

You are reviewing the ARM template snippet for an Azure Storage container. What does the 'denyEncryptionScopeOverride' property set to 'true' ensure?

Accepted Answer

Users cannot override the default encryption scope for blobs in this container.. Option D is correct because setting denyEncryptionScopeOverride to true on a container prevents clients from specifying a different encryption scope when uploading blobs, forcing them to use the container's default encryption scope. This property is specifically about locking the encryption scope at the container level, not about enabling or requiring encryption itself. Option A is wrong because double encryption is configured via infrastructure encryption settings, not this property. Option B is wrong because encryption at rest is always enabled for Azure Storage blobs by default and is not controlled by denyEncryptionScopeOverride. Option C is wrong because customer-managed keys are configured through the account's encryption key source settings, not through this container property.

Answer

Double encryption is enabled for the container.

Answer

Encryption at rest is required for all blobs in the container.

Answer

The container automatically uses a customer-managed key for encryption.

Question 3

You are designing a secure access solution for a manufacturing company's IoT devices that send telemetry to Azure IoT Hub. The devices run on a private network with no internet access except through a firewall. You need to ensure that device-to-cloud communication is authenticated and encrypted, and that device credentials are rotated regularly. What should you include in the design?

Accepted Answer

Use X.509 certificates with Azure Device Provisioning Service (DPS) for automatic enrollment and certificate rotation.. X.509 certificates provide mutual TLS authentication and encryption for device-to-cloud traffic to IoT Hub, and Azure Device Provisioning Service (DPS) supports automatic enrollment plus certificate rotation workflows (for example, via enrollment groups and rolling certificate updates), which directly meets the requirement for regularly rotated device credentials. Azure Firewall (A) is a network security control and does not authenticate or encrypt IoT device application traffic end-to-end. SAS tokens (C) can authenticate devices but are symmetric shared secrets that are harder to rotate safely at scale and do not provide the same certificate-based identity lifecycle as DPS-managed X.509. Managed identities (D) are for Azure resources accessing Azure services and cannot be assigned to external IoT devices.

Answer

Configure Azure Firewall to authenticate and encrypt device traffic.

Answer

Use shared access signature (SAS) tokens with a central key management system.

Answer

Assign managed identities to each IoT device.

Question 4

Your organization, Contoso Ltd., is migrating its on-premises workloads to Azure. The environment includes 200 virtual machines (VMs) running Windows Server and 50 VMs running Linux. You are responsible for designing the security infrastructure. The company has the following requirements: 1) All VMs must be protected against malware. 2) Security updates must be applied automatically to Windows VMs within 24 hours of release. 3) Linux VMs must receive critical security patches within 48 hours. 4) A central dashboard must provide visibility into the security posture of all VMs. 5) All VMs must be onboarded to Microsoft Defender for Cloud to enable advanced threat protection. 6) The solution must minimize administrative overhead. You have implemented the following: - All VMs are enrolled in Microsoft Defender for Cloud with the enhanced security features enabled. - Azure Update Manager is configured to schedule updates. - Microsoft Defender for Endpoint is installed on all Windows VMs. However, after a month, the security team reports that: - 50 Windows VMs did not receive security updates within 24 hours. - 10 Linux VMs have not received any patches. - The central dashboard shows that 30 VMs are not reporting their security status. - A malware outbreak occurred on 5 Windows VMs that were not protected by Defender for Endpoint. You need to identify the most likely root cause and recommend a corrective action.

Accepted Answer

Review the network security groups (NSGs) and firewall rules to ensure outbound connectivity to the required Microsoft endpoints for Microsoft Defender for Endpoint and Windows Update.. The symptoms—VMs missing updates, not reporting status, and lacking Defender for Endpoint protection—point to a connectivity failure. Microsoft Defender for Endpoint and Windows Update require outbound connectivity to specific Microsoft endpoints (e.g., *.endpoint.microsoft.com, *.update.microsoft.com). Without this, VMs cannot receive updates, report security posture, or download Defender definitions, directly explaining all reported issues.

Answer

Onboard the VMs to Azure Arc and enable the Azure Update Manager on all VMs via Arc.

Answer

Implement Azure Policy to enforce that all VMs have the 'Deploy default Microsoft IaaS anti-malware extension for Windows' policy assigned and create a remediation task.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for update deployments.

Question 5

Your organization uses Microsoft Intune to manage iOS/iPadOS devices. You need to ensure that devices must have a minimum OS version and cannot be jailbroken. Which configuration profile type should you assign?

Accepted Answer

Compliance policy.. A compliance policy (option D) is the correct choice because Intune compliance policies are specifically designed to evaluate device health and posture, including defining a minimum OS version for iOS/iPadOS and detecting jailbroken devices via the device compliance check. When a device fails these conditions, it is marked noncompliant, which can then drive Conditional Access or other remediation actions. Device configuration policies (A) and device restrictions profiles (B) push settings to devices but do not evaluate jailbreak status or enforce a minimum OS version as a compliance condition. Enrollment restrictions (C) only control which devices or platforms are allowed to enroll, not the ongoing OS version or jailbreak state of already-enrolled devices.

Answer

Device configuration policy.

Answer

Device restrictions profile.

Answer

Enrollment restriction.

Question 6

Which TWO of the following are features of Microsoft Defender for Cloud that help secure infrastructure? (Choose two.)

Accepted Answer

Secure Score. Secure Score (A) is a core Microsoft Defender for Cloud capability that continuously assesses your Azure resources and subscriptions against security recommendations and benchmarks, aggregating the results into a numeric score so you can prioritize hardening actions for your infrastructure. Just-in-time (JIT) VM access (C) is also a Defender for Cloud feature that reduces the attack surface of virtual machines by blocking inbound management ports (RDP 3389, SSH 22) by default and opening them only for approved, time-limited requests from authorized IPs. Both directly serve Defender for Cloud's mission of strengthening and monitoring infrastructure security posture. Incident investigation (B) and User and Entity Behavior Analytics (E) are capabilities of Microsoft Sentinel (the SIEM/SOAR solution), not Defender for Cloud. Privileged Identity Management (D) is a separate Microsoft Entra ID (Azure AD) service for just-in-time privileged role activation and access reviews, not a Defender for Cloud infrastructure feature.

Answer

Incident investigation

Answer

Privileged Identity Management

Answer

User and Entity Behavior Analytics (UEBA)

Question 7

Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?

Accepted Answer

Microsoft Intune. Microsoft Intune provides device compliance policies and can send device posture signals to Entra ID Conditional Access. With Intune, you can enforce device health and compliance requirements before granting access. Option A is wrong because Microsoft Purview focuses on data governance and compliance, not device management. Option C is wrong because Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) and does not directly manage device compliance. Option D is wrong because Microsoft Sentinel is a security information and event management (SIEM) solution and does not provide device posture signals.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 8

A company plans to implement Microsoft Purview to enforce data loss prevention (DLP) policies. They need to prevent users from sharing credit card numbers via email. What should they configure?

Accepted Answer

Create a DLP policy that detects and blocks credit card numbers in Exchange Online. Microsoft Purview Data Loss Prevention (DLP) policies can be configured to detect sensitive data types, such as credit card numbers, in Exchange Online emails. When a DLP policy is created with a rule that identifies credit card numbers and blocks the email from being sent, it directly prevents users from sharing that data via email. This is the native mechanism for enforcing DLP on email traffic in Microsoft 365.

Answer

Create a sensitivity label and apply it to emails

Answer

Enable communication compliance policies

Answer

Configure a retention policy for email

Question 9

Your organization uses Microsoft Intune to manage devices and wants to ensure that only compliant devices can access corporate email. Which conditional access policy setting should you configure?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' setting in a Conditional Access policy enforces that only devices meeting your Intune compliance policies (e.g., encryption, OS version, threat level) can access corporate email. This setting checks the device's compliance status reported by Intune to Microsoft Entra ID during authentication, blocking non-compliant devices before they reach Exchange Online.

Answer

Require approved client app

Answer

Require Multi-Factor Authentication

Answer

Require domain join

Question 10

A company is migrating on-premises applications to Azure. They need to ensure that applications can use their existing Active Directory credentials for authentication. Which Azure service should they use?

Accepted Answer

Azure AD Domain Services. Microsoft Entra Domain Services (Microsoft Entra Domain Services) provides managed domain services such as domain join, group policy, and Kerberos/NTLM authentication. This allows legacy on-premises applications that rely on Active Directory credentials to authenticate without needing to deploy and manage domain controllers in Azure. It bridges the gap by synchronizing identities from Microsoft Entra ID and exposing traditional AD features over a virtual network.

Answer

Azure Active Directory

Answer

Azure AD Connect

Answer

Azure AD B2C

Question 11

Which THREE features of Microsoft Defender for Cloud help secure Azure Kubernetes Service (AKS) clusters? (Select three.)

Accepted Answer

Azure Defender for Kubernetes (cluster hardening). Azure Defender for Kubernetes (option B) is correct because it provides cluster hardening by continuously assessing AKS configurations against CIS Kubernetes benchmark controls and surfacing misconfiguration recommendations in Microsoft Defender for Cloud. Vulnerability assessment for container images (option C) is correct because Defender for Cloud scans images stored in Azure Container Registry and images running in AKS, using Qualys-based scanning to detect known CVEs in OS packages and language dependencies. Runtime threat detection for AKS clusters (option E) is correct because Defender for Containers monitors AKS node and workload activity via eBPF-based sensors and Kubernetes audit logs to alert on suspicious behavior such as crypto-mining, privilege escalation, and anomalous process execution. Option A does not belong because Advanced threat protection for Azure Cosmos DB protects database accounts, not AKS clusters. Option D does not belong because DDoS Protection Standard mitigates volumetric network attacks at the Azure edge and is not an AKS workload security feature of Defender for Cloud.

Answer

Advanced threat protection for Azure Cosmos DB

Answer

DDoS Protection Standard

Question 12

Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?

Accepted Answer

Application rule. Application rules in Azure Firewall allow filtering outbound traffic based on fully qualified domain names (FQDNs) for HTTP and HTTPS protocols. Option A is wrong because NAT rules only perform destination network address translation, not FQDN filtering. Option C is wrong because threat intelligence rules are used to block traffic from known malicious IP addresses, not for allowing FQDNs. Option D is wrong because network rules filter traffic based on IP addresses, ports, and protocols, not FQDNs.

Answer

NAT rule

Answer

Threat intelligence rule

Answer

Network rule

Question 13

Your organization uses Microsoft Sentinel and wants to improve threat hunting efficiency. Which THREE actions should you take?

Accepted Answer

Enable UEBA (User and Entity Behavior Analytics). UEBA (User and Entity Behavior Analytics) in Microsoft Sentinel uses machine learning models to establish baseline behavioral patterns for users, hosts, and other entities. It then detects anomalous activities such as unusual logon times, impossible travel, or abnormal data exfiltration, which directly enhances threat hunting by surfacing suspicious behaviors that might otherwise go unnoticed.

Answer

Use watchlists to filter out known benign IPs

Answer

Reduce data retention period to improve query speed

Question 14

Your company is deploying a new AI-powered customer service chatbot using Azure OpenAI Service. The chatbot will access customer data stored in Azure Cosmos DB. The security team requires that all data in transit is encrypted, and that the chatbot only accesses data necessary for its function. Additionally, the chatbot must use managed identities to authenticate to Cosmos DB. You need to design the security architecture. Which combination of controls should you implement?

Accepted Answer

Enable TLS enforcement on Cosmos DB. Use a managed identity for the chatbot and assign the Cosmos DB Built-in Data Reader role. Configure the chatbot to authenticate using the managed identity.. It enforces TLS for data in transit, uses a managed identity for authentication, and assigns the Cosmos DB Built-in Data Reader role to implement least privilege access. Option A is incorrect because IP restrictions alone do not provide authentication and the Account Reader role does not allow data access. Option B is incorrect because using a connection string exposes secrets and the Contributor role grants excessive permissions. Option D is incorrect because it uses a service principal instead of a managed identity, which is a requirement.

Answer

Restrict network access to the chatbot's IP address. Use a system-assigned managed identity and assign the Cosmos DB Account Reader role.

Answer

Use a connection string with the Cosmos DB account key and enforce TLS 1.2. Grant the chatbot's managed identity contributor role.

Answer

Use Azure AD authentication with a service principal and assign the Cosmos DB Built-in Data Contributor role. Enforce TLS 1.2.

Question 15

A company uses Microsoft Defender for Cloud Apps to discover and control cloud apps. They want to receive alerts when a user accesses a sanctioned app from an unusual location. Which feature should they configure?

Accepted Answer

Anomaly detection policies. Anomaly detection policies in Microsoft Defender for Cloud Apps are specifically designed to identify behavioral deviations, such as a user accessing a sanctioned app from an unusual geographic location. These policies leverage machine learning to establish a baseline of normal user activity and trigger alerts when access patterns deviate from that baseline, enabling detection of potential account compromise or insider threats.

Answer

Session policies

Answer

File policies

Answer

App discovery policies