SC-100 Practice Test 24 — 15 Questions

Question 1

A company uses Azure Arc to manage on-premises servers. The security team wants to enforce that all servers (on-premises and Azure) have Microsoft Defender for Endpoint installed and running. Which solution should you use to ensure compliance across hybrid environments?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy with Guest Configuration. Azure Policy with Guest Configuration is the correct choice because it extends Azure Policy's audit and enforcement capabilities into the operating system of both Azure VMs and Azure Arc-enabled on-premises servers, allowing you to audit and enforce settings such as whether the Microsoft Defender for Endpoint agent is installed and running. Guest Configuration assignments (built on the Guest Configuration extension and DSC-based audit/apply policies) can detect and remediate the MDE agent state across hybrid machines, which is exactly the cross-environment compliance requirement here. Microsoft Intune (A) manages device configuration and endpoint security primarily for enrolled user devices and does not provide the same Azure Policy-driven compliance enforcement for Arc-enabled servers. Azure Update Manager (C) handles patching and update compliance, not endpoint protection agent enforcement, and Microsoft Defender for Cloud (D) provides security posture and threat protection but does not itself enforce agent installation state through policy assignments.

Answer

Microsoft Intune

Answer

Azure Update Manager

Answer

Microsoft Defender for Cloud

Question 2

Your organization uses Microsoft Defender for Cloud to assess security posture. You need to design a solution that automatically applies a security baseline to new Azure VMs. Which feature should you use?

Accepted Answer

Azure Policy with Guest Configuration. Azure Policy with Guest Configuration is the correct choice because it uses the Guest Configuration extension (via the Azure Connected Machine/VM agent) to audit and enforce OS-level settings inside Azure VMs, including applying security baselines such as the Windows or Linux security baseline definitions. It continuously evaluates machines against the policy and can deploy configuration assignments to new VMs automatically, which directly matches the requirement to apply a baseline to new Azure VMs. The regulatory compliance dashboard (A) only reports compliance status against standards and does not apply baselines. Azure Update Management (B) handles OS patch orchestration, not security baseline configuration. Azure Automation State Configuration (C) can apply DSC configurations but is a separate, more manual pull/push mechanism and is not the Defender for Cloud-integrated baseline enforcement feature.

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Answer

Azure Update Management

Answer

Azure Automation State Configuration (DSC)

Question 3

Your company uses Microsoft Sentinel for security operations. You need to detect brute-force attacks against Azure VMs by correlating failed sign-in events from multiple sources. Which data connector should you enable?

Accepted Answer

Windows Security Events via AMA (Azure Monitor Agent) connector.. The Windows Security Events via AMA connector is correct because it collects Windows security event logs—including failed logon events (Event ID 4625)—from Azure VMs into Microsoft Sentinel, enabling correlation of brute-force attempts across multiple sources. The Microsoft Entra ID (Microsoft Entra ID) sign-in logs connector only ingests Entra ID authentication events, not local or VM-level Windows logon failures. The Syslog connector targets Linux/network device logs (e.g., via rsyslog) and does not capture Windows Security event data. The Azure Activity log connector records Azure control-plane operations (resource changes), not sign-in or authentication events.

Answer

Azure Active Directory (now Microsoft Entra ID) sign-in logs connector.

Answer

Syslog connector.

Answer

Azure Activity log connector.

Question 4

Which TWO actions should you take to secure Azure Functions with HTTP triggers?

Accepted Answer

Enable App Service Authentication (EasyAuth). Option A is correct because enabling App Service Authentication (EasyAuth) on the Function App enforces identity verification via Microsoft Entra ID or other identity providers before requests reach the function, providing strong authentication for HTTP triggers. Option B is correct because configuring network restrictions (access restrictions / IP allowlists) on the Function App limits inbound HTTP traffic to trusted IP ranges, reducing exposure to unauthorized or malicious callers. Option C is wrong because setting the authorization level to anonymous removes the function key requirement and allows unauthenticated access, weakening security. Option D is wrong because Application Insights is a monitoring and telemetry service, not a security control. Option E is wrong because function keys alone are shared secrets that can be leaked and do not provide robust authentication or network-level protection.

Answer

Set authorization level to anonymous

Answer

Enable Application Insights

Answer

Use function keys only

Question 5

A healthcare organization is designing a zero-trust application security strategy. They use Microsoft Entra ID for identity and plan to deploy a legacy on-premises web application with no modern authentication support. The solution must ensure that only authorized users can access the app and that access is logged for auditing. Which Microsoft security service should they use to secure access?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy (option B) is correct because it is designed to publish on-premises web applications, including legacy apps without modern authentication support, and enforce Entra ID pre-authentication plus conditional access before traffic reaches the app, while also providing access logging for auditing. It fits the zero-trust scenario by brokering remote access through the Application Proxy connector without exposing the app directly to the internet. Azure AD B2C (option A) is for customer identity and access management for consumer-facing apps, not for securing internal legacy on-premises apps. Microsoft Defender for Cloud Apps (option C) is a CASB for discovering, monitoring, and controlling cloud app usage, not for publishing and pre-authenticating on-premises web apps. Microsoft Intune (option D) is for device and mobile application management, not for brokering authenticated access to legacy on-premises web applications.

Answer

Azure AD B2C

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Intune

Question 6

A multinational company is implementing a Zero Trust security model. The security team needs to ensure that all access requests to critical applications are evaluated based on user identity, device health, and real-time risk signals. Which Microsoft solution should they use to centralize policy enforcement?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra Conditional Access is the correct choice because it is the policy engine in Microsoft Entra ID that centralizes access decisions by evaluating signals such as user identity, group membership, device compliance/health, location, and real-time risk before granting access to applications. This aligns directly with Zero Trust's 'verify explicitly' principle, since Conditional Access enforces grant controls (for example, require MFA or a compliant device) and session controls at the point of access. Microsoft Defender for Cloud Apps is a CASB for discovering and governing cloud app usage, not the central policy enforcement point for identity-based access. Microsoft Entra ID Protection detects and reports risky users and sign-ins and feeds risk signals into Conditional Access, but it does not itself centralize access policy enforcement. Microsoft Purview Compliance Manager is a compliance assessment and improvement tool, not an access control solution.

Answer

Microsoft Defender for Cloud Apps

Answer

Azure AD Identity Protection

Answer

Microsoft Purview Compliance Manager

Question 7

Which TWO of the following are valid methods to secure Azure Kubernetes Service (AKS) workloads?

Accepted Answer

Integrate Azure AD for cluster authentication. Option A is correct because integrating Microsoft Entra ID (Azure AD) with AKS enables cluster authentication and authorization via Azure RBAC, allowing you to control who can access the Kubernetes API server and manage workloads using identity-based controls rather than static credentials. Option E is correct because Azure Policy for AKS uses the Gatekeeper admission controller (Open Policy Agent) to enforce policies on pods and cluster resources at admission time, preventing non-compliant workloads from being deployed and thus hardening the workload configuration. Option B is not the intended answer because Network Security Groups apply at the subnet/NIC level for network traffic filtering, not specifically for securing AKS workloads at the pod or admission level, and pod-level security typically uses Kubernetes Network Policies. Option C is not correct in this context because Azure Firewall provides network perimeter protection and egress filtering but does not directly secure AKS workloads themselves. Option D is not correct because Azure Front Door is a global HTTP/HTTPS load balancer and WAF for web applications, not a mechanism for securing AKS workloads internally.

Answer

Apply Network Security Groups to pod subnets

Answer

Deploy Azure Firewall in front of the AKS cluster

Answer

Use Azure Front Door to protect API endpoints

Question 8

A company uses Microsoft Defender for Cloud to assess the security posture of their Azure subscriptions. They want to ensure that critical recommendations are automatically remediated. They create a workflow automation that triggers a Logic App for specific recommendations. However, the Logic App fails to run. What is the most likely cause?

Accepted Answer

The managed identity of the Logic App lacks permissions on the target resources.. The most likely cause is that the Logic App's managed identity lacks the necessary permissions on the target Azure resources. Workflow automations in Defender for Cloud use a Logic App that executes remediation actions; if the Logic App's identity (either system-assigned or user-assigned) does not have the required RBAC role (e.g., Contributor or a custom role with specific actions) on the resource scope, the remediation run will fail with an authorization error. This is a common misconfiguration because the automation trigger itself succeeds, but the downstream action fails due to insufficient permissions.

Answer

The subscription is not onboarded to Defender for Cloud.

Answer

Defender for Cloud is disabled for the resource group.

Answer

The recommendation is disabled in the security policy.

Question 9

You are the lead security architect for a multinational corporation that recently completed a merger. The new entity, Contoso Ltd., has a complex Azure environment with over 200 subscriptions spread across multiple management groups. The company's security team has identified several critical issues: (1) many subscriptions have Azure Security Center's Secure Score below 30%, (2) there are numerous unmanaged VMs with public IP addresses, (3) there is no centralized logging for security events, and (4) identity management is fragmented with multiple Azure AD tenants. The CEO mandates a 'zero-trust' security posture within 12 months. You have a limited budget and must prioritize the most impactful actions. Which course of action should you take first?

Accepted Answer

Consolidate all Azure AD tenants into a single tenant and establish a common identity baseline. Identity is the foundational control plane for zero-trust architecture. Without a unified identity baseline across a single Microsoft Entra ID tenant, you cannot enforce consistent conditional access policies, least-privilege access, or authentication strength—making all other security controls ineffective. Consolidating tenants first directly addresses the fragmented identity management issue and enables centralized policy enforcement, which is the highest-impact, lowest-cost action to improve the security posture within 12 months.

Answer

Implement Azure Sentinel to centralize logs and create automated response playbooks

Answer

Deploy Azure Firewall and enforce forced tunneling for all VNets

Answer

Deploy Azure Policy to deny creation of VMs with public IPs and enforce NSGs

Question 10

Your organization uses Microsoft Entra ID. You need to design a solution that requires users to perform multifactor authentication when accessing a critical application from an untrusted network. The solution should not require additional licensing beyond Microsoft Entra ID P1. What should you use?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID.. Create a Conditional Access policy in Microsoft Entra ID. Conditional Access is included with Microsoft Entra ID P1 and lets you enforce MFA specifically when users access a chosen cloud app from an untrusted network location, using conditions such as the application and named locations plus a grant control requiring multifactor authentication. Option B is not the best fit because risk-based sign-in/user risk policies require Microsoft Entra ID P2 (Entra ID Protection), exceeding the stated P1 licensing limit. Option C, per-user MFA, can require MFA but is an all-or-nothing setting that cannot target a specific application or network condition. Option D, an Intune device compliance policy, addresses device configuration and compliance rather than directly enforcing MFA for app access from untrusted networks.

Answer

Configure a risk-based policy in Microsoft Entra ID Protection.

Answer

Enable per-user MFA in Microsoft Entra ID.

Answer

Deploy a device compliance policy in Microsoft Intune.

Question 11

Your company uses Microsoft Azure to host a critical application that processes credit card payments. The application must comply with PCI DSS. You need to ensure that all access to cardholder data is logged and monitored, and that any unauthorized access attempts trigger an alert. Which combination of services should you use?

Accepted Answer

Azure Monitor and Microsoft Sentinel. Azure Monitor and Microsoft Sentinel (option D) are the right combination because Azure Monitor collects and retains the logs and metrics from the application and its Azure resources, while Microsoft Sentinel ingests those logs to correlate events, detect unauthorized access attempts to cardholder data, and generate alerts via analytics rules and incident creation, satisfying PCI DSS logging and monitoring requirements. Azure Monitor provides the telemetry pipeline (Log Analytics workspace, diagnostic settings) and Sentinel adds SIEM/SOAR detection and alerting on top of it. Option A is wrong because Azure Policy enforces configuration compliance and Defender for Cloud Apps is a CASB for SaaS discovery/control, not a log-monitoring and alerting SIEM. Option B is wrong because Azure Policy and Defender for Cloud provide posture management and threat protection but do not deliver the centralized log correlation and custom alerting on access to cardholder data that Sentinel does. Option C is wrong because Azure Key Vault only manages secrets, keys, and certificates, and Defender for Cloud alone does not provide the required log aggregation and alerting.

Answer

Azure Policy and Microsoft Defender for Cloud Apps

Answer

Azure Policy and Microsoft Defender for Cloud

Answer

Azure Key Vault and Microsoft Defender for Cloud

Question 12

Which TWO Azure services should you use to implement a defense-in-depth strategy for protecting Azure virtual machines?

Accepted Answer

Network Security Groups (NSGs). Network Security Groups (NSGs) are correct because they enforce network-layer defense-in-depth by filtering inbound and outbound traffic to and from Azure VMs using allow/deny security rules based on source/destination IP, port, and protocol, effectively segmenting and restricting access at the subnet or NIC level. Azure Backup is correct because it provides the data-recovery layer of defense-in-depth, protecting VM data against accidental deletion, corruption, or ransomware by creating recoverable recovery points stored in a Recovery Services vault. Azure Logic Apps is not a security control for VMs; it is a workflow-orchestration service for integrating apps and automating business processes. Azure Automation is a configuration-management and process-automation service (runbooks, DSC, update management) and does not itself provide a protective security boundary for VM traffic or data. Azure Front Door is a global layer-7 web application delivery and CDN/WAF service for HTTP/HTTPS workloads, not a mechanism for protecting Azure VMs directly.

Answer

Azure Logic Apps

Answer

Azure Automation

Answer

Azure Front Door

Question 13

Your organization uses Microsoft Intune to manage endpoints. The security team wants to ensure that devices that cannot be enrolled in Intune (e.g., unmanaged BYOD devices) are still subject to security policies when accessing corporate resources. Which Microsoft Entra ID feature should you use?

Accepted Answer

Microsoft Entra Conditional Access policies. Microsoft Entra Conditional Access policies (option A) are correct because they evaluate signals such as user, device state, and location at authentication time and can enforce controls like requiring MFA or compliant devices even for unmanaged BYOD endpoints that cannot be enrolled in Intune. Conditional Access can block or restrict access to corporate resources for devices that don't meet policy, which directly addresses the scenario. Intune enrollment policies (B) only apply to devices being enrolled and cannot govern unenrolled devices. Windows Defender Application Control (C) is an application control mechanism on Windows endpoints, not an access policy for corporate resources. Microsoft Defender for Endpoint (D) is an endpoint detection and response platform, not the feature that enforces access policy for unmanaged devices.

Answer

Microsoft Intune enrollment policies

Answer

Windows Defender Application Control

Answer

Microsoft Defender for Endpoint

Question 14

Your organization uses Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. You need to design a solution that centralizes security alerts and automates remediation across all clouds. Which security operations capability should you prioritize?

Accepted Answer

Use Microsoft Sentinel as a single SIEM and SOAR platform with connectors for AWS and GCP. Microsoft Sentinel is the correct choice because it functions as a cloud-native SIEM and SOAR platform that can ingest security alerts from Azure, AWS, and GCP via native data connectors, then centralize them and drive automated remediation through playbooks (Logic Apps). This directly satisfies the requirement to centralize alerts and automate remediation across a multi-cloud estate. Option B is only partially relevant: Defender for Cloud's multi-cloud connector aggregates posture and alert data but does not provide the full SIEM/SOAR automation capability Sentinel delivers. Option A (Purview Compliance Manager) is for regulatory compliance assessments, not security operations, and Option D (Defender for Identity) only monitors identity signals in hybrid Active Directory environments, not multi-cloud alert centralization or remediation.

Answer

Configure Microsoft Purview Compliance Manager for regulatory assessments

Answer

Enable Microsoft Defender for Cloud's multi-cloud connector to aggregate alerts

Answer

Deploy Microsoft Defender for Identity to monitor hybrid identities

Question 15

A company uses Microsoft Sentinel for SIEM. They need to ensure that security events from Azure Active Directory (now Microsoft Entra ID) are ingested into Sentinel. Which data connector should they enable?

Accepted Answer

Microsoft Entra ID connector. The Microsoft Entra ID connector (option A) is correct because it is the built-in Microsoft Sentinel data connector designed to ingest sign-in logs, audit logs, and other security events from Microsoft Entra ID / Microsoft Entra ID. Enabling it streams Entra ID diagnostic logs into the Sentinel workspace for analytics and detection. The Office 365 connector (B) ingests Exchange, SharePoint, and Teams activity logs, not Entra ID sign-in or audit events. The Azure Activity connector (C) collects subscription-level control-plane operations from Azure Resource Manager, not directory events. The Microsoft Defender XDR connector (D) pulls alerts and incidents from Defender services rather than raw Entra ID security logs.

Answer

Office 365 connector

Answer

Azure Activity connector

Answer

Microsoft Defender XDR connector