SC-100 Practice Test 23 — 15 Questions

Question 1

Refer to the exhibit. A security architect is reviewing the network configuration of an Azure App Service app named 'finance-app'. The app needs to be accessible from a backend subnet via private endpoint. Which additional configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a private endpoint and associate it with the App Service. The correct option is C: Create a private endpoint and associate it with the App Service. For an Azure App Service app to be reachable from a backend subnet over a private IP, a private endpoint must be created and linked to the app, which provisions a private IP in the target subnet via Azure Private Link. Option A is wrong because setting publicNetworkAccess to Enabled exposes the app publicly rather than providing private access. Option B is wrong because regional VNet integration enables outbound traffic from the app into a VNet, not inbound private access to the app. Option D is wrong because IP-based SSL only binds a certificate to an IP address and does not create private connectivity.

Answer

Set publicNetworkAccess to Enabled

Answer

Configure regional VNet integration for the app

Answer

Enable IP-based SSL for the app

Question 2

Refer to the exhibit. A security administrator needs to ensure that the storage account 'securestore' is compliant with the company policy that requires encryption at rest using customer-managed keys and network access restricted to a specific virtual network. Which of the following statements is correct?

Accepted Answer

The storage account is compliant because it uses customer-managed keys from Key Vault and network access is restricted to a specific virtual network.. Option C is correct because it states that the storage account uses customer-managed keys from Key Vault for encryption at rest and restricts network access to a specific virtual network, which exactly matches the company policy requirements. Customer-managed keys stored in Azure Key Vault satisfy the encryption-at-rest requirement, and a virtual network rule or service endpoint scoped to one VNet satisfies the network restriction. Option A is wrong because enabling encryption for blob and file services does not by itself address the customer-managed key or network restriction requirements. Option B is wrong because it assumes Microsoft-managed keys, which contradicts the scenario where customer-managed keys are used. Option D is wrong because it claims network access is open to any virtual network, which is not the case when access is restricted to a specific VNet.

Answer

The storage account is compliant only if encryption is enabled for blob and file services.

Answer

The storage account is non-compliant because it uses Microsoft-managed keys for encryption.

Answer

The storage account is non-compliant because network access is allowed from any virtual network.

Question 3

Match each security operations tool to its primary function.

Accepted Answer

Microsoft Sentinel: Provides intelligent security analytics and threat intelligence across the enterprise, with log ingestion and automated response.. These tools form the Microsoft security operations stack. Sentinel handles SIEM/SOAR, Defender XDR provides XDR across domains, and Defender for Cloud secures cloud workloads.

Answer

Microsoft Sentinel: Monitors and protects identities by detecting sign-in risks and providing conditional access policies.

Answer

Microsoft Defender XDR: Provides security posture management for cloud environments.

Question 4

You are designing a network security architecture for an Azure application that uses Azure Front Door and Azure Application Gateway. The application must be protected from DDoS attacks and common web exploits. Application traffic should be inspected by a web application firewall (WAF) before reaching the backend. What is the recommended deployment order?

Accepted Answer

Azure Front Door with WAF in front of Azure Application Gateway with WAF.. The recommended architecture places Azure Front Door with WAF at the global edge to absorb DDoS and block common web exploits close to the client, then routes traffic to Azure Application Gateway with WAF for regional, path-based, and application-layer protection before reaching the backend. This layered approach provides defense in depth and satisfies the requirement that traffic be inspected by a WAF before reaching the backend.

Answer

Azure Front Door with WAF only, no Application Gateway.

Answer

Azure Front Door without WAF in front of Azure Application Gateway without WAF.

Answer

Azure Application Gateway with WAF in front of Azure Front Door.

Question 5

Your company uses Microsoft Sentinel as its SIEM. You need to design a solution that automatically responds to high-severity incidents by creating a ticket in ServiceNow and notifying the security team via Teams. Which Sentinel feature should you configure?

Accepted Answer

Automation rules. Automation rules in Microsoft Sentinel are designed to trigger automated responses to incidents based on conditions like severity. They can integrate with external systems via playbooks (Azure Logic Apps) to create ServiceNow tickets and send Teams notifications, making them the correct choice for this requirement.

Answer

Workbooks

Answer

Analytics rules

Answer

Hunting queries

Question 6

Refer to the exhibit. You are deploying this Bicep template to enable Microsoft Defender for Cloud's VM protection. After deployment, you notice that Agentless VM scanning is not enabled for existing VMs. What is the most likely reason?

Accepted Answer

The extension 'AgentlessVmScanning' must be defined outside the pricing resource.. The 'AgentlessVmScanning' extension is not a valid sub-resource of the pricing resource. In Bicep, agentless VM scanning is configured via a separate 'Microsoft.Security/vmScanners' resource, not nested inside the pricing resource. Defining it inside the pricing resource would cause a configuration error, resulting in agentless scanning not being enabled. Option B is incorrect: agentless scanning is automatically enabled for all existing and new VMs when the plan is enabled; existing VMs do not require manual rescanning.

Answer

The pricing tier must be 'Free' to enable agentless scanning.

Answer

Agentless scanning is only enabled for new VMs; existing VMs require rescanning.

Answer

The resource name 'VirtualMachines' is incorrect; it should be 'virtualMachines'.

Question 7

Which THREE are valid sources for ingesting data into Microsoft Sentinel? (Choose three.)

Accepted Answer

AWS CloudTrail. AWS CloudTrail is a valid data source for Microsoft Sentinel because Sentinel supports ingesting AWS service logs via the AWS CloudTrail data connector. This connector uses the AWS S3 bucket to collect CloudTrail logs, which are then pulled into Sentinel for analysis. This allows organizations to monitor and detect threats across their AWS environment alongside other cloud and on-premises data sources.

Answer

Adobe Analytics

Answer

Google BigQuery

Question 8

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts using pass-the-hash attacks. Which data source should you prioritize for ingestion?

Accepted Answer

Windows Security Events (Event ID 4624). The correct option is D, Windows Security Events (Event ID 4624), because pass-the-hash lateral movement is detected by analyzing logon events, and Event ID 4624 (successful logon) with Logon Type 3 (network) and NTLM authentication reveals the use of stolen NTLM hashes to authenticate to remote systems. Microsoft Sentinel's built-in analytics rules and the SecurityEvent table rely on these 4624 records to correlate anomalous NTLM logons across hosts. Option A (Sysmon Event ID 1) captures process creation and may show suspicious tools but does not directly record the authentication mechanism used in pass-the-hash. Option B (DNS Query Logs) and Option C (Azure Activity Logs) track name resolution and control-plane operations respectively, neither of which exposes NTLM network logon activity needed to detect pass-the-hash.

Answer

Sysmon Event ID 1 (Process creation)

Answer

DNS Query Logs

Answer

Azure Activity Logs

Question 9

A company uses Microsoft 365 Defender to protect their endpoints, email, and identities. They want to create a custom detection for a specific behavior that is not covered by built-in detections. Which tool should they use?

Accepted Answer

Custom detection rules in Microsoft 365 Defender. Microsoft 365 Defender provides a 'Custom detection' feature under the 'Advanced hunting' section that allows security teams to create custom detection rules based on Kusto Query Language (KQL) queries. This is the correct tool because the question specifies creating a detection for behavior not covered by built-in detections within the Microsoft 365 Defender ecosystem, and custom detection rules are designed exactly for that purpose—they run on a schedule and generate alerts when the custom query matches.

Answer

Microsoft Sentinel analytics rules

Answer

Azure AD Identity Protection user risk policies

Answer

Microsoft Defender for Cloud Apps policies

Question 10

Your organization is deploying a new web application in Azure and needs to secure it against common web attacks like SQL injection and cross-site scripting. You need to configure a solution that provides centralized protection at the network edge. Which Azure service should you use?

Accepted Answer

Azure Web Application Firewall (WAF) on Azure Application Gateway. Azure Web Application Firewall (WAF) on Azure Application Gateway is correct because it provides centralized, edge-level protection specifically against Layer 7 web attacks such as SQL injection and cross-site scripting (XSS) using OWASP rule sets. It inspects HTTP/HTTPS traffic at the application layer and can be attached to Application Gateway to filter malicious requests before they reach the web application. NSGs operate at Layers 3/4 and only filter traffic by IP, port, and protocol, so they cannot detect SQL injection or XSS payloads. Azure DDoS Protection mitigates volumetric and protocol-level denial-of-service attacks, not application-layer injection or scripting attacks. Azure Firewall is a stateful Layer 3-7 network firewall with FQDN and threat-intelligence filtering, but it does not provide the dedicated OWASP-based web attack inspection that WAF does.

Answer

Network Security Groups (NSGs)

Answer

Azure DDoS Protection

Answer

Azure Firewall

Question 11

Your company plans to migrate on-premises servers to Azure. You need to ensure that the migrated servers are protected against malware and vulnerabilities. Which Microsoft Defender for Cloud plan should you enable for the Azure VMs?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (option D) is the correct choice because it is the Defender for Cloud plan specifically designed to protect Azure VMs and on-premises servers, providing threat detection, vulnerability assessment, and malware protection through integration with Microsoft Defender for Endpoint. It covers server workloads regardless of whether they run in Azure, other clouds, or on-premises, which matches the migration scenario. The other options target different resource types: Defender for SQL (A) protects Azure SQL and SQL Server workloads, Defender for Storage (B) protects Azure Storage accounts against threats like malware uploads and data exfiltration, and Defender for Containers (C) protects Kubernetes clusters and container registries, none of which address VM-level malware and vulnerability protection.

Answer

Microsoft Defender for SQL

Answer

Microsoft Defender for Storage

Answer

Microsoft Defender for Containers

Question 12

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). Each microservice needs to authenticate to Azure SQL Database using its own identity. The security team requires that no service principal secrets or certificates be stored in the cluster. What should you implement to authenticate the microservices to Azure SQL Database?

Accepted Answer

Use Azure AD Workload Identity for each pod to authenticate to Azure SQL Database using managed identities.. Microsoft Entra ID Workload Identity is the correct choice because it federates a Kubernetes service account with an Microsoft Entra ID managed identity, allowing each pod to obtain Microsoft Entra ID tokens without any stored secrets or certificates in the cluster. This directly satisfies the requirement that each microservice authenticates with its own identity and that no service principal secrets or certificates be stored. Option A is wrong because it still relies on a service principal secret stored in Key Vault and mounted into the cluster. Option B is wrong because a node-level system-assigned managed identity is shared by all pods on the node, so it does not give each microservice its own identity. Option D is wrong because storing credentials in a Kubernetes secret violates the no-secrets requirement and is not identity-based authentication.

Answer

Create a service principal and store its secret in Azure Key Vault; use the Key Vault Secrets Store CSI driver to mount it.

Answer

Enable a system-assigned managed identity on the AKS cluster nodes and have pods use it.

Answer

Store the Azure SQL connection string with credentials in a Kubernetes secret.

Question 13

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. The policy is enabled but users who are detected as high risk are still able to sign in. What is the most likely reason?

Accepted Answer

No users or groups are assigned to the policy. A Conditional Access policy must have at least one user or group assigned to it to be evaluated. If no users or groups are assigned, the policy is effectively inactive, even if enabled. In this scenario, the policy is enabled but not applied to any identities, so high-risk users are not subject to its controls.

Answer

The policy state is set to 'enabled' but not 'enforced'

Answer

The user risk level is set to 'high' but sign-in risk is 'medium'

Answer

The grant control is set to 'block' but should be 'require MFA'

Question 14

Your company uses Microsoft Entra ID for identity management. You need to implement a solution to automatically detect and remediate risky sign-ins using machine learning. What should you configure?

Accepted Answer

Configure Microsoft Entra ID Protection and enable risk-based policies.. Microsoft Entra ID Protection is the correct choice (Option C) because it uses machine learning to detect risky sign-ins and user risk events, and it lets you enable risk-based Conditional Access policies that automatically remediate those risks (for example, requiring MFA or blocking access). It is purpose-built for identity risk detection and automated remediation, matching the scenario's requirement exactly. Option A, Entra Connect, only synchronizes on-premises identities to Entra ID and does not perform risk detection. Option B, Conditional Access with session controls, enforces access and session restrictions but does not itself provide the machine-learning risk detection engine. Option D, PIM, manages just-in-time privileged role activation and approvals, not risky sign-in detection or remediation.

Answer

Configure Microsoft Entra Connect to sync on-premises identities.

Answer

Configure Conditional Access policies with session controls.

Answer

Configure Privileged Identity Management (PIM) for admin roles.

Question 15

You are designing a secure remote access solution for on-premises web applications using Microsoft Entra ID. The solution must support multifactor authentication (MFA) and conditional access. Which service should you use?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy (option A) is correct because it is the service designed to publish on-premises web applications for secure remote access through Microsoft Entra ID, and it natively supports Entra ID authentication, multifactor authentication (MFA), and conditional access policies. It works via a lightweight connector on the on-premises network, so users authenticate to Entra ID before reaching the internal web app, satisfying the MFA and conditional access requirements. Windows Server DirectAccess (B) provides seamless intranet connectivity for domain-joined Windows clients but does not integrate with Entra ID conditional access for publishing web apps. A VPN gateway with RADIUS authentication (C) provides network-level access and can use MFA via RADIUS, but it does not natively enforce Entra ID conditional access for individual web applications. Microsoft Entra ID (D) is the identity provider itself, not the remote-access publishing service, so it alone cannot expose on-premises web applications.

Answer

Windows Server DirectAccess

Answer

VPN gateway with RADIUS authentication

Answer

Microsoft Entra ID (Azure AD)