SC-100 Practice Test 22 — 15 Questions

Question 1

Your organization uses Microsoft Defender XDR for incident response. You need to design a process to automatically isolate a compromised device when a high-severity incident is triggered. Which automation approach should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use automation rules in Microsoft Sentinel with a playbook that runs a Defender for Endpoint isolation action. Microsoft Sentinel's automation rules can directly trigger a playbook (Azure Logic App) that executes the Microsoft Defender for Endpoint 'Isolate device' action. This provides near-real-time, event-driven isolation without polling, aligning with the requirement to automatically isolate a compromised device when a high-severity incident is triggered in Defender XDR.

Answer

Create a compliance policy in Microsoft Intune that marks the device as noncompliant

Answer

Configure an Azure Automation runbook to poll Defender alerts and isolate devices

Answer

Set up a Power Automate flow triggered by email notifications from Defender

Question 2

Your organization uses Microsoft Purview Information Protection to label and protect sensitive emails and documents. You need to ensure that when a user applies a 'Highly Confidential' label, the content is automatically encrypted and a watermark is added. Which configuration should you use?

Accepted Answer

Configure a sensitivity label with encryption and watermark settings.. Sensitivity labels in Microsoft Purview Information Protection can be configured with encryption and content marking (watermark) settings, which are applied automatically when users apply the label. Option A is incorrect: the Azure Information Protection scanner discovers and labels existing files but does not configure label settings; the label itself must be defined. Option B is incorrect: a DLP policy can block sharing but cannot add watermarks or encrypt content on its own. Option D is incorrect: Microsoft 365 Message Encryption provides encryption for email transport but does not apply watermarks or enforce labels.

Answer

Use Azure Information Protection scanner to apply labels automatically.

Answer

Create a DLP policy that blocks sharing of highly confidential content.

Answer

Enable Microsoft 365 Message Encryption for all emails.

Question 3

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Microsoft Teams. You need to prevent users from sharing credit card numbers in Teams chat messages. However, the policy should allow sharing with external vendors if they are in your organization's approved list. What should you configure?

Accepted Answer

Configure a DLP policy with a condition to block sharing of credit card numbers to external users except those from approved domains.. You can configure a DLP policy in Microsoft Purview to block sensitive data like credit card numbers in Teams messages, and use the 'Block sharing to external users except' condition to allow sharing with approved domains. This meets the requirement to prevent sharing with unauthorized external users while allowing sharing with approved vendors. Option B is wrong because blocking all external sharing is too restrictive and does not allow the approved external vendors. Option C is wrong because Information Protection labels do not have the granular control over sharing conditions based on external domains. Option D is wrong because sensitivity labels are not designed for DLP actions such as blocking sharing in Teams chat based on external approval.

Answer

Create a DLP policy that blocks credit card numbers and set the action to 'Block external sharing' for all external users.

Answer

Use Microsoft Purview Information Protection to automatically apply a 'Confidential' label to messages containing credit card numbers and block forwarding.

Answer

Create a sensitivity label for credit card data and publish it to Teams, then configure auto-labeling.

Question 4

A large financial services company is migrating its customer-facing web application to Azure. The application handles sensitive personal data and must comply with PCI DSS. The solution will use Azure App Service (Linux) with a custom container, Azure SQL Database, and Azure Redis Cache. The security architect mandates that all data in transit be encrypted using the latest TLS version, and that the application must be protected against common web vulnerabilities. The company also wants to ensure that only authenticated users can access the Redis cache. Users will authenticate via Microsoft Entra ID. The operations team needs to be able to monitor for SQL injection attempts and anomalous access patterns. You need to design the security configuration. Which of the following is the most comprehensive approach that meets all requirements?

Accepted Answer

Configure App Service to enforce TLS 1.2 as minimum. Deploy Azure Application Gateway with WAF enabled in front of App Service. Enable Azure AD authentication for Azure Redis Cache. Enable Microsoft Defender for SQL for Azure SQL Database.. Azure App Service enforces TLS 1.2/1.3 by default. Azure WAF (Web Application Firewall) in front of App Service protects against OWASP Top 10. Microsoft Entra ID authentication for Redis Cache is supported via Microsoft Entra ID RBAC for Redis (currently in preview but available). Microsoft Defender for SQL detects SQL injection and anomalous access. Option A covers all requirements. Option B uses Application Gateway without WAF. Option C uses Redis firewall which doesn't enforce authentication. Option D uses Azure Front Door without WAF.

Answer

Use Azure Front Door with custom domain and enforce TLS 1.2. Configure IP firewall on Redis Cache. Use Azure SQL Database with VNet service endpoints.

Answer

Deploy App Service with HTTPS only enabled. Use Azure API Management with WAF. Use Redis Cache with access keys. Enable SQL audit logging.

Answer

Enable TLS 1.3 on App Service. Use Azure CDN with WAF. Configure Redis Cache with a firewall rule allowing only App Service outbound IPs.

Question 5

Your company is designing a zero-trust security posture for a new application in Azure. The application uses Azure Functions, Azure SQL Database, and Azure Blob Storage. You need to ensure that data in transit is encrypted and that the application can authenticate without storing secrets in code. Which THREE actions should you take?

Accepted Answer

Enable 'Enforce minimum TLS version' on the Blob Storage account. Options A, B, and C are correct. Enforcing a minimum TLS version on Blob Storage (A) and configuring the application to use TLS 1.2 or higher (B) both ensure data in transit is encrypted. Using managed identity for Azure Functions to access Azure SQL Database (C) provides secretless authentication. Option D (CMK) encrypts data at rest, not in transit. Option E (firewall IP restriction) controls network access but does not encrypt data in transit.

Answer

Enable customer-managed keys (CMK) for Azure SQL Database

Answer

Configure the Azure SQL firewall to allow only the Functions IP range

Question 6

Your company has a Microsoft Defender for Cloud environment with Azure Arc-enabled on-premises servers. The security team wants to ensure that all servers have the Log Analytics agent installed and that missing updates are automatically remediated for critical vulnerabilities. Which policy initiative should you assign to the management group containing these servers?

Accepted Answer

Azure Security Benchmark. The Azure Security Benchmark initiative includes policies for agent installation and vulnerability remediation. The other options are either not policy initiatives or focus on different aspects like container security or regulatory compliance.

Answer

Azure Policy for Kubernetes

Answer

CIS Microsoft Azure Foundations Benchmark

Answer

NIST SP 800-53 R5

Question 7

A company is designing a secure baseline for Azure VMs using Azure Policy and Microsoft Defender for Cloud. Which TWO recommendations should you include to ensure VMs are protected against common threats?

Accepted Answer

Deploy the Log Analytics agent on all VMs. Enabling just-in-time (JIT) VM access reduces attack surface by blocking inbound traffic to management ports. Deploying the Log Analytics agent is required for Defender for Cloud to collect security data. The other options are either not security baselines or not VM-specific.

Answer

Configure Azure Backup for all VMs

Answer

Enable Azure Site Recovery

Answer

Use Azure Disk Encryption with Azure Key Vault

Question 8

An organization uses Microsoft Purview to classify and protect sensitive data. Which THREE capabilities can be used to discover sensitive data? (Choose three.)

Accepted Answer

Trainable classifiers. Trainable classifiers use machine learning to identify content based on patterns and context, not just exact matches. They can be trained on sample data to recognize custom sensitive information, such as specific contract clauses or internal project codes, enabling discovery of sensitive data that predefined sensitive information types might miss.

Answer

Data loss prevention policies

Answer

Retention labels

Question 9

An organization is planning to use Microsoft Defender for Cloud's regulatory compliance dashboard to track adherence to PCI DSS. The security team wants to ensure that all Azure resources are covered by the compliance assessment. What is the first step?

Accepted Answer

Enable Microsoft Defender for Cloud on all subscriptions and ensure resources are covered.. For the regulatory compliance dashboard to assess resources, Microsoft Defender for Cloud must first be enabled on all subscriptions and resources must be covered by its enhanced security features. Without enabling Defender for Cloud, the compliance dashboard cannot collect the necessary data to evaluate compliance. Option B is incorrect because configuring the dashboard to show PCI DSS controls is a subsequent step after ensuring coverage. Option C is incorrect because creating a custom standard is not the first step; the built-in PCI DSS initiative should be used. Option D is incorrect because the built-in PCI DSS policy initiative in Azure Policy does not automatically apply to resources unless Defender for Cloud is already enabled and the initiative is assigned; enabling Defender for Cloud is the prerequisite.

Answer

Configure the compliance dashboard to show PCI DSS controls.

Answer

Create a custom regulatory compliance standard for PCI DSS.

Answer

Enable the built-in PCI DSS policy initiative in Azure Policy.

Question 10

Refer to the exhibit. You are deploying an ARM template for a Windows VM. The adminPassword parameter references a secret in Key Vault. However, the deployment fails with an access denied error. What is the most likely cause?

Accepted Answer

The deployment principal lacks 'Get' and 'List' permissions on the Key Vault secret.. When referencing a Key Vault secret in an ARM template parameter, the user or service principal deploying the template must have 'Get' and 'List' permissions on the secret. If the deployment principal does not have those permissions, access is denied. Option A is wrong because special characters in secrets are supported, but the deployment still requires permissions. Option B is wrong because the template uses a parameter reference to the secret, not the secret's URI directly; that is the correct approach. Option D is wrong because the Key Vault can be in a different resource group than the deployment, as long as the deployment principal has the necessary permissions.

Answer

The secret value contains special characters that need to be escaped.

Answer

The template should use the secret's URI directly instead of a parameter reference.

Answer

The Key Vault is in a different resource group than the deployment.

Question 11

A company is deploying Microsoft Entra ID Governance. They need to implement a least privilege access model for their Azure resources. Which TWO features should they use? (Choose two.)

Accepted Answer

Privileged Identity Management (PIM). Privileged Identity Management (PIM) is correct because it provides just-in-time (JIT) privileged access to Azure resources, enabling time-bound and approval-based role activation. This directly supports a least privilege model by ensuring users only have elevated permissions when needed, reducing standing access.

Answer

Identity Protection

Answer

Conditional Access policies

Answer

Microsoft Intune compliance policies

Question 12

Your organization is a small business with 50 employees that uses Microsoft 365 Business Premium. You need to design a security baseline that protects against common threats like phishing, ransomware, and data leakage. The solution must be easy to manage and require minimal ongoing effort. You have the following requirements: 1. Block malicious emails and links. 2. Protect sensitive data from being shared externally. 3. Require multi-factor authentication for all users. 4. Keep devices healthy. Which combination of policies should you implement?

Accepted Answer

Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments. Create a Microsoft Purview DLP policy to prevent external sharing of sensitive data. Create a Conditional Access policy to require MFA and device compliance.. It directly addresses all four requirements: Microsoft Defender for Office 365 Safe Links and Safe Attachments blocks malicious emails and links; a Microsoft Purview DLP policy prevents external sharing of sensitive data, protecting against data leakage; a Conditional Access policy requiring MFA and device compliance enforces multi-factor authentication for all users and ensures devices are healthy. This combination is easy to manage with minimal ongoing effort, as it leverages built-in Microsoft 365 Business Premium capabilities without complex custom configurations.

Answer

Enable Microsoft Defender for Office 365 for phishing protection. Use Microsoft Purview Information Protection to automatically label sensitive emails. Create a Conditional Access policy to require MFA for admins only. Use Azure Information Protection scanner.

Answer

Enable Exchange Online Protection (EOP) for spam and malware filtering. Create a Conditional Access policy to require MFA for all users. Enable device compliance policies in Microsoft Intune.

Answer

Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments. Create a Microsoft Purview DLP policy to block sharing of credit card numbers. Enable security defaults in Microsoft Entra ID to enforce MFA.

Question 13

A company plans to deploy Azure Virtual Desktop (AVD) in a secure environment. They require that all user connections be established over a reverse connect protocol to avoid inbound firewall rules. Which component enables this?

Accepted Answer

AVD Gateway service. The AVD Gateway service is the correct component because it establishes a reverse connect transport, where the session host initiates an outbound connection to the gateway over HTTPS (port 443). This eliminates the need for any inbound firewall rules to the session hosts, as user connections are relayed through the gateway without directly exposing the session hosts to the internet.

Answer

Azure Bastion

Answer

Azure AD Application Proxy

Answer

Session host configuration

Question 14

Order the steps to configure Azure Key Vault firewall and virtual network service endpoints.

Accepted Answer

Enable service endpoint on subnet, then add virtual network rule in Key Vault firewall, then (optionally) allow trusted Microsoft services, then save the firewall configuration.. The correct sequence for configuring Azure Key Vault firewall and virtual network service endpoints begins by enabling the service endpoint for Microsoft.KeyVault on the target subnet. Next, you add a virtual network rule in the Key Vault firewall settings that references that subnet. Optionally, you can configure the firewall to allow trusted Microsoft services. Finally, you save the configuration to apply all changes. This order ensures that network rules are valid and the firewall behaves as expected.

Answer

Add virtual network rule in Key Vault firewall, then enable service endpoint on subnet, then save, then allow trusted Microsoft services.

Answer

Enable service endpoint on subnet, then save the firewall configuration, then add virtual network rule, then allow trusted Microsoft services.

Answer

Allow trusted Microsoft services, then enable service endpoint, then add virtual network rule, then save.

Question 15

You are designing a secure solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that pods can only communicate with specific back-end services and that traffic is encrypted. What should you implement?

Accepted Answer

Implement Kubernetes network policies and enable mTLS using a service mesh like Istio or Linkerd.. Kubernetes network policies allow you to restrict pod-to-pod communication to specific back-end services, and mutual TLS (mTLS) from a service mesh like Istio or Linkerd encrypts the traffic. Option B is incorrect because network security groups (NSGs) operate at the subnet level and cannot enforce pod-level network policies. Option C is incorrect because Azure Application Gateway Ingress Controller handles inbound traffic from outside the cluster, not pod-to-pod communication. Option D is incorrect because Azure Firewall controls north-south traffic (ingress/egress) and does not manage east-west traffic between pods.

Answer

Use network security groups (NSGs) on the subnet.

Answer

Configure Azure Application Gateway Ingress Controller.

Answer

Deploy Azure Firewall and configure application rules.