SC-100 Practice Test 24 — 15 Questions

Question 1

Your organization uses Microsoft Intune for mobile device management. Employees report they cannot access corporate email on their personal iOS devices. The helpdesk confirms devices are enrolled and compliant. What should you check first?

Accepted Answer

Verify the conditional access policy for Exchange Online includes iOS devices.. Option A is correct because conditional access policies in Entra ID enforce access rules for cloud apps like Exchange Online. Option B is wrong because compliance policies define device requirements, not access. Option C is wrong because app protection policies manage data within apps. Option D is wrong because device configuration profiles set device settings but not access.

Answer

Confirm the device configuration profile includes email settings.

Answer

Review the app protection policy for Outlook.

Answer

Ensure the compliance policy allows iOS devices.

Question 2

You need to design a compliance solution using Microsoft Purview that automatically detects and protects credit card numbers in emails and documents. Which TWO features should you include? (Choose two.)

Accepted Answer

Data Loss Prevention (DLP) policies to detect and block credit card numbers.. Option A is correct because DLP policies can detect sensitive data and enforce actions. Option B is correct because auto-labeling can apply sensitivity labels. Option C is wrong because retention labels are for retention, not protection. Option D is wrong because trainable classifiers are for pattern detection, but DLP and auto-labeling are more direct. Option E is wrong because eDiscovery is for search and legal hold.

Answer

Retention labels to retain credit card data for a specified period.

Answer

Trainable classifiers to identify credit card numbers.

Answer

eDiscovery to search for credit card numbers.

Question 3

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only compliant devices can access Exchange Online. Which Microsoft Entra ID feature should you use?

Accepted Answer

Conditional Access with the 'Require device to be marked as compliant' grant. Conditional Access policies in Entra ID can require that devices be marked as compliant with Intune compliance policies before granting access to cloud apps like Exchange Online. The other options are not correct: Device Compliance is a policy in Intune, not an Entra feature; MFA is authentication; and Azure AD Join is for device identity.

Answer

Azure AD device registration

Answer

Multi-factor authentication

Answer

Intune device compliance policy

Question 4

Your organization uses Microsoft Purview to manage data governance. You need to create a unified data catalog that automatically classifies and labels data across Azure SQL Database, Amazon S3, and on-premises SQL Server. What should you configure?

Accepted Answer

Microsoft Purview account with scans for all data sources.. Option A is correct because Microsoft Purview (the unified data governance service) supports scanning and classifying data across multi-cloud and on-premises sources. Option B is wrong because Microsoft Information Protection is for labeling, not scanning. Option C is wrong because Azure Purview (now part of Microsoft Purview) is the correct service. Option D is wrong because Azure Data Catalog is legacy and limited.

Answer

Azure Data Catalog with custom classification.

Answer

Azure Purview (legacy) with multi-cloud scanning.

Answer

Microsoft Information Protection scanner on each source.

Question 5

Your company uses Microsoft Purview Compliance Manager to track compliance with regulatory standards. You need to generate a report that shows the percentage of controls that are not yet implemented for the PCI DSS standard. What should you do?

Accepted Answer

In Compliance Manager, open the PCI DSS assessment and view the control status.. Option C is correct because Compliance Manager provides pre-built assessments for standards like PCI DSS, and you can view the control status. Option A is incorrect because Data Lifecycle Management is for retention policies. Option B is incorrect because Communication Compliance is for internal risk detection. Option D is incorrect because risk assessments in Compliance Manager are built-in, not created manually for this purpose.

Answer

Create a Data Lifecycle Management policy for PCI DSS.

Answer

Create a custom risk assessment in Compliance Manager for PCI DSS.

Answer

Configure a Communication Compliance policy to monitor PCI DSS compliance.

Question 6

Which THREE capabilities are part of Microsoft Purview's insider risk management solution? (Choose three.)

Accepted Answer

Forensic evidence capturing user activity on devices.. Options A, C, and E are correct. Option A is correct because indicators for data leaks are core. Option C is correct because forensic evidence captures user activity. Option E is correct because policy templates exist for data theft. Option B is incorrect because DLP is separate. Option D is incorrect because communication compliance is a different solution.

Answer

Communication compliance policies for monitoring emails.

Answer

Data Loss Prevention policies that block sensitive data.

Question 7

Your organization plans to use Microsoft Sentinel and Microsoft Defender XDR to manage security incidents. You need to design a solution that ensures all Defender for Cloud Apps alerts are automatically synchronized to Microsoft Sentinel as incidents with the least administrative effort. What should you configure?

Accepted Answer

Enable the Microsoft Defender XDR data connector in Microsoft Sentinel and set incident creation to 'All alerts'.. Option D is correct because enabling the Microsoft Defender XDR connector in Sentinel automatically ingests alerts from all Defender workloads, including Defender for Cloud Apps, and creates incidents. Option A (manual API) is not minimal effort. Option B (Defender for Cloud Apps connector) is legacy and duplicates effort. Option C (Azure AD connector) does not include Defender for Cloud Apps alerts.

Answer

Enable the Microsoft Defender for Cloud Apps data connector in Microsoft Sentinel.

Answer

Create a custom Azure Function that polls the Defender for Cloud Apps API and sends alerts to Sentinel via a custom Log Analytics table.

Answer

Enable the Microsoft Entra ID (Azure AD) data connector in Microsoft Sentinel.

Question 8

Your organization uses Microsoft Entra ID and Microsoft Intune. You need to design a solution that allows only hybrid Azure AD joined devices to access a sensitive application. The solution must also require that the device is compliant with company policies. Which two components should you configure? (Choose TWO.)

Accepted Answer

Conditional Access policy with 'Require hybrid Azure AD joined device'. Options A and C are correct because Conditional Access policies can require hybrid Azure AD join as a grant control, and Intune compliance policies define the compliance rules. Option B (MFA) is not required by the scenario. Option D (app protection) is for app-level protection. Option E (device enrollment) is a prerequisite but not an access control.

Answer

Intune app protection policy

Answer

Conditional Access policy with 'Require multifactor authentication'

Answer

Intune device enrollment

Question 9

Refer to the exhibit. You are reviewing an Azure Policy definition for GDPR compliance. The policy is intended to audit storage accounts that do not have encryption enabled. However, the policy is not evaluating correctly. What is the most likely reason?

Accepted Answer

The effect should be 'Audit' instead of 'auditIfNotExists'. Option B is correct because the effect 'auditIfNotExists' requires a resource to audit if a dependent resource does not exist. However, storage account encryption is a property of the storage account itself, not a separate resource. The policy should use 'Audit' effect with a condition that checks if encryption is disabled. Option A is wrong because 'Indexed' mode is appropriate for storage accounts. Option C is wrong because the policy is built-in but the snippet shows custom properties. Option D is wrong because the field type is correct.

Answer

The field 'type' should be 'Microsoft.Storage/storageAccounts/encryption'

Answer

The policy type should be 'Custom'

Answer

The policy mode should be 'All' instead of 'Indexed'

Question 10

Which TWO actions should you take to implement a least-privilege identity security model using Microsoft Entra ID? (Choose two.)

Accepted Answer

Create conditional access policies to restrict access based on user, device, and location.. Option A is correct because PIM provides just-in-time privileged access. Option C is correct because conditional access policies enforce access controls. Option B is wrong because permanent assignment contradicts least-privilege. Option D is wrong because guest review is about governance, not least-privilege directly. Option E is wrong because MFA is a security control, not least-privilege.

Answer

Enable Azure AD Identity Governance for guest user access reviews.

Answer

Require multi-factor authentication for all users.

Answer

Assign global administrator role to all IT staff for simplicity.

Question 11

You are designing identity security for a hybrid organization using Microsoft Entra ID. You need to enforce multi-factor authentication (MFA) for all users accessing sensitive applications. What is the recommended approach?

Accepted Answer

Create a Conditional Access policy that requires MFA for the sensitive applications. Conditional Access policies in Entra ID are the recommended method to require MFA for specific applications. The other options are less granular or outdated: per-user MFA is legacy, Security defaults apply to all apps and cannot be scoped, and Azure AD Identity Protection focuses on risk-based policies.

Answer

Enable Security defaults

Answer

Enable per-user MFA in Entra ID

Answer

Use Azure AD Identity Protection user risk policy

Question 12

Your organization uses Microsoft Intune for mobile device management. You need to ensure that users can access corporate email on their personal iOS devices only if the device is enrolled in Intune and compliant with security policies. What should you configure?

Accepted Answer

Create an app protection policy for iOS requiring managed apps to be enrolled and compliant.. Option A is correct because an app protection policy with conditional launch settings can require device enrollment and compliance before allowing access. Option B is wrong because conditional access policies in Entra ID require device compliance, but they do not enforce app-level protection. Option C is wrong because a compliance policy alone does not block access. Option D is wrong because a device configuration policy sets settings but does not enforce access.

Answer

Configure a device configuration policy to enforce passcode and encryption.

Answer

Configure a conditional access policy in Microsoft Entra ID requiring compliant device.

Answer

Create a device compliance policy for iOS and assign it to all users.

Question 13

Refer to the exhibit. You are analyzing a KQL query in Microsoft Sentinel. What is the primary purpose of this query?

Accepted Answer

To enrich Mimikatz alerts with user account names.. Option B is correct because the query joins security alerts with identity info to get the account name for alerts about Mimikatz detection. Option A is wrong because it does not investigate lateral movement. Option C is wrong because it does not trigger an automation rule. Option D is wrong because it does not summarize data.

Answer

To summarize Mimikatz alerts by account.

Answer

To create an automation rule based on the query.

Answer

To detect lateral movement after a Mimikatz alert.

Question 14

Your company uses Microsoft Purview Data Loss Prevention (DLP). You need to ensure that credit card numbers are not shared externally via email. What should you configure?

Accepted Answer

Create a DLP policy that detects credit card numbers and blocks external sharing.. Option A is correct because DLP policies can detect sensitive information like credit card numbers and block external sharing. Option B is incorrect because sensitivity labels are for classification, not blocking. Option C is incorrect because retention policies manage retention, not sharing. Option D is incorrect because auto-labeling applies labels, but DLP enforces actions.

Answer

Create a sensitivity label that applies encryption to emails containing credit card numbers.

Answer

Configure auto-labeling for credit card numbers in Microsoft 365.

Answer

Create a retention policy for credit card data.

Question 15

Your organization uses Microsoft Sentinel. You need to design a solution to detect and automatically respond to a potential brute-force attack against an on-premises application that is published via Azure AD Application Proxy. The solution should block the attacker's IP address in Azure AD Conditional Access for one hour after detecting more than 10 failed login attempts within 5 minutes. What should you implement?

Accepted Answer

Create a Microsoft Sentinel analytics rule that triggers on a KQL query detecting the failed logins, then use a playbook to add the IP to a Conditional Access block list via the Azure AD API.. Option C is correct because you can create a Microsoft Sentinel analytics rule to detect the suspicious activity, and then use a playbook that invokes the Azure AD Conditional Access custom control (block action) to block the IP. Option A is incorrect because Microsoft Entra ID Protection does not cover on-premises apps published via App Proxy with custom logic. Option B is incorrect because a DLP policy is not for authentication. Option D is incorrect because a WAF operates at the network layer and does not integrate directly with Conditional Access.

Answer

Create a Microsoft Purview Data Loss Prevention policy to block the IP address based on the login pattern.

Answer

Deploy a web application firewall (WAF) in front of the application and configure rate limiting to block the IP.

Answer

Configure a Microsoft Entra ID Protection sign-in risk policy to automatically block the user's sign-in after detecting anomalous activity.