SC-100 Practice Test 25 — 15 Questions

Question 1

Your organization uses Microsoft Purview to govern data assets across Azure and on-premises. You need to automatically classify sensitive data such as credit card numbers in Azure SQL Database. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Purview Data Map. Microsoft Purview Data Map is the correct choice because it is the component that scans and automatically classifies data sources such as Azure SQL Database, detecting sensitive information types like credit card numbers and applying classifications. It builds the metadata catalog and applies built-in or custom classification rules during scans, which is exactly what's needed for automated sensitive-data discovery. Microsoft Defender for Cloud provides security posture management and threat protection, not data classification. Microsoft Entra ID handles identity and access management, and Microsoft Sentinel is a SIEM/SOAR solution for security analytics, so neither performs data classification.

Answer

Microsoft Defender for Cloud

Answer

Microsoft Entra ID

Answer

Microsoft Sentinel

Question 2

Your organization is designing a privileged access strategy using Microsoft Entra ID. Which TWO configurations should be part of the design to protect privileged accounts?

Accepted Answer

Require multi-factor authentication for all administrative roles via Conditional Access. Options A and C are correct. Option A: Conditional Access with MFA for admin roles reduces risk of credential theft. Option C: Privileged Identity Management (PIM) provides just-in-time access and approval workflows. Option B is wrong because security defaults enforce MFA for all users but lack granularity for privileged roles. Option D is wrong because self-service password reset is not specific to privileged accounts and does not protect against misuse. Option E is wrong because disabling MFA would weaken security.

Answer

Enable security defaults

Answer

Enable self-service password reset for admins

Answer

Disable multi-factor authentication for emergency admin accounts

Question 3

A financial institution, Contoso Bank, is deploying a new application on Azure Kubernetes Service (AKS) that processes credit card transactions (PCI DSS). The application uses Azure SQL Database and Azure Redis Cache. You need to design a security solution that meets PCI DSS requirements. Which THREE of the following should you implement?

Accepted Answer

Deploy AKS as a private cluster with no public endpoint.. Option A is correct because deploying AKS as a private cluster with no public endpoint removes the API server's public exposure, ensuring all control-plane communication stays on the private network and reducing the PCI DSS attack surface. Option B is correct because Always Encrypted protects sensitive cardholder data columns in Azure SQL Database by keeping encryption keys outside the database engine, so even DBAs or compromised SQL instances cannot read plaintext data. Option D is correct because private endpoints for Azure SQL Database and Azure Cache for Redis route traffic over Azure Private Link, keeping data off the public internet and satisfying PCI DSS network segmentation and encryption-in-transit expectations. Option C is not among the required three because Azure RBAC for Kubernetes authorization is a general access-control hardening measure, not a PCI DSS-specific control for protecting cardholder data in this scenario. Option E is incorrect because disabling TLS on Azure Cache for Redis exposes data in transit and directly violates PCI DSS encryption requirements for cardholder data.

Answer

Enable Azure RBAC for Kubernetes authorization.

Answer

Disable TLS for Azure Cache for Redis to improve performance.

Question 4

You are designing a security operations solution for a multinational organization using Microsoft Sentinel. The organization has multiple Azure subscriptions, each with its own Log Analytics workspace. You need to centralize incident management while minimizing data egress costs. What should you recommend?

Accepted Answer

Use a single Log Analytics workspace for all subscriptions and configure Sentinel in that workspace.. Microsoft Sentinel is enabled on a Log Analytics workspace, and using a single workspace for all subscriptions centralizes incident management in one place while avoiding cross-workspace query and data egress charges. All subscriptions can onboard to that workspace via Azure Lighthouse or the Sentinel data connectors, so incidents, analytics rules, and workbooks are managed centrally. Option A does not truly centralize incidents and adds cross-workspace complexity, while Option B sends data to a third-party SIEM and increases egress costs rather than minimizing them. Option C only allows cross-workspace queries for correlation but still leaves incident management distributed across multiple workspaces.

Answer

Deploy a Sentinel workspace in each region and use cross-workspace views.

Answer

Export all logs to a third-party SIEM using Azure Event Hubs.

Answer

Configure Azure Monitor cross-workspace queries to correlate incidents.

Question 5

Your organization is deploying Microsoft Defender for Cloud Apps. You need to create a policy that blocks downloads of sensitive files from sanctioned cloud apps to unmanaged devices. What type of policy should you create?

Accepted Answer

Session policy. A session policy (option A) is correct because in Microsoft Defender for Cloud Apps, session policies are used with Conditional Access App Control to monitor and control user sessions in real time, including blocking downloads of sensitive files from sanctioned cloud apps to unmanaged devices. Session policies can apply actions such as block download, protect, or block based on the sensitivity of the content and the device state. App discovery policies (option B) are used to identify and assess shadow IT and unsanctioned apps, not to control file downloads in real time. Anomaly detection policies (option C) trigger alerts on unusual user behavior but do not enforce download blocking. Access policies (option D) in Defender for Cloud Apps are used to allow or block sign-ins to apps based on conditions, not to control in-session file download activity.

Answer

App discovery policy

Answer

Anomaly detection policy

Answer

Access policy

Question 6

Your organization is deploying a customer-facing web application in Azure. The application must authenticate users via Microsoft Entra ID and access Microsoft Graph to read user profiles. The security team requires that the application never has access to user passwords. Which authentication flow should you recommend?

Accepted Answer

OAuth 2.0 authorization code flow with PKCE. The correct option is D, OAuth 2.0 authorization code flow with PKCE, because it is the recommended flow for customer-facing web applications that authenticate users interactively via Microsoft Entra ID and call Microsoft Graph on their behalf. With PKCE, the client proves possession of a one-time code verifier, and the user authenticates directly against Entra ID, so the application never handles or sees user passwords. The resulting delegated access token also allows reading user profiles through Microsoft Graph with the appropriate scopes. Option A (implicit grant) is deprecated and exposes tokens in the browser URL fragment, while option B (device authorization flow) is intended for input-constrained devices and is not suited to a normal web app. Option C (client credentials grant) is app-only authentication with no user context, so it cannot authenticate users or read their profiles as required.

Answer

OAuth 2.0 implicit grant flow

Answer

OAuth 2.0 device authorization flow

Answer

OAuth 2.0 client credentials grant flow

Question 7

Your organization uses Microsoft Sentinel to centralize security monitoring. You need to detect anomalous access to a critical Azure SQL Database from unusual geographic locations. Which data connector and analytic rule should you use?

Accepted Answer

Azure SQL Database connector and a custom scheduled query rule with geo-location. The correct option is A: Azure SQL Database connector and a custom scheduled query rule with geo-location. The Azure SQL Database connector ingests SQL audit and diagnostic logs into Microsoft Sentinel, which include client IP addresses, so a custom scheduled analytics rule can parse those IPs, enrich them with geo-location data (e.g., via the GeoIP watchlist or built-in functions), and alert on access from unusual regions. Option B does not fit because Microsoft Entra ID sign-in anomaly rules cover identity authentication events, not direct database access. Option C is wrong because Windows Security Events cover OS-level logons on Windows hosts, not Azure SQL Database access. Option D is wrong because Azure Activity logs track control-plane operations like resource deletion, not data-plane SQL connections.

Answer

Azure Active Directory connector and an anomaly rule for sign-ins

Answer

Windows Security Events connector and a rule for failed logins

Answer

Azure Activity connector and a rule for resource deletion

Question 8

Your organization is planning to deploy Microsoft Defender for Cloud Apps (formerly Cloud App Security). You need to discover shadow IT usage and control access to cloud apps. Which TWO capabilities should you enable? (Choose TWO.)

Accepted Answer

Conditional Access App Control. Cloud Discovery [E] is correct because it is the Defender for Cloud Apps feature that analyzes your traffic logs (from firewalls, proxies, or Defender for Endpoint) against the Cloud App Catalog to identify shadow IT usage, giving risk scores and usage analytics for discovered apps. Conditional Access App Control [A] is correct because it uses reverse-proxy deployment (via Microsoft Entra Conditional Access policies) to enforce real-time session controls—such as block download, block upload, and read-only access—on cloud apps, directly satisfying the requirement to control access to cloud apps. Intune device compliance policies [B] govern device health and compliance, not cloud app discovery or session-level app access control. DLP policies [C] protect sensitive data from exfiltration but do not perform shadow IT discovery or app access control. On-premises app discovery via Defender for Identity [D] only surfaces on-premises shadow IT (e.g., unsanctioned SaaS used from domain controllers), not the broad cloud app discovery and access control this scenario requires.

Answer

Microsoft Intune device compliance policies

Answer

Data Loss Prevention (DLP) policies

Answer

On-premises app discovery via Microsoft Defender for Identity

Question 9

You are designing a CI/CD pipeline for a containerized application using Azure DevOps. You need to ensure that container images are scanned for vulnerabilities before being deployed to production. Which service should you integrate?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud [CORRECT] is the right choice because it provides container image vulnerability scanning for images stored in Azure Container Registry and can be integrated into CI/CD workflows to gate deployments before production. It continuously assesses images and surfaces findings that Azure DevOps pipelines can act on. Azure Policy is for enforcing governance and compliance rules on resources, not for scanning container images for vulnerabilities. Azure Key Vault manages secrets and keys, and Azure Monitor collects telemetry and logs, so neither performs vulnerability scanning.

Answer

Azure Policy

Answer

Azure Key Vault

Answer

Azure Monitor

Question 10

Your organization uses Azure Data Lake Storage Gen2 for big data analytics. You need to secure access to the data using Azure RBAC and ACLs. Which two methods can you use to authorize access? (Choose two.)

Accepted Answer

Assign Azure RBAC roles such as Storage Blob Data Contributor to security principals.. Option B is correct because Azure Data Lake Storage Gen2 supports Azure RBAC role assignments, such as Storage Blob Data Contributor, Storage Blob Data Reader, and Storage Blob Data Owner, to authorize security principals (users, groups, service principals, managed identities) at the container or account scope. Option C is correct because ADLS Gen2 implements a POSIX-like ACL model at the directory and file level, allowing fine-grained read, write, and execute permissions for named users and groups in addition to RBAC. Option A is not a valid authorization method here; IP firewall rules are network-level access restrictions, not an authorization mechanism for data access. Option D is not itself an authorization method—managed identities are an identity type that must still be granted access via RBAC or ACLs. Option E is not the intended answer because SAS tokens are a delegation mechanism primarily associated with Blob Storage and are not the standard authorization approach for ADLS Gen2 hierarchical namespace access via RBAC and ACLs.

Answer

Configure IP firewall rules to restrict access.

Answer

Use managed identities for Azure resources.

Answer

Generate shared access signatures (SAS) for delegated access.

Question 11

You are designing a solution for a healthcare organization that needs to share patient health information (PHI) with a partner organization. The partner must be able to query the data but should not be able to modify it. Both organizations use Microsoft Entra ID. What should you use?

Accepted Answer

Microsoft Entra entitlement management with an access package that grants read-only access to a SharePoint Online site.. The correct option is B: Microsoft Entra entitlement management with an access package that grants read-only access to a SharePoint Online site. Entitlement management is designed for B2B collaboration, allowing external partner users from another Entra ID tenant to request and receive governed access to resources, and an access package can assign a read-only permission level (e.g., SharePoint Visitors/Read) so the partner can query but not modify PHI. Option A is wrong because Entra ID B2C is for customer-facing identity scenarios, not partner B2B collaboration, and a custom API would require you to build and enforce read-only authorization yourself. Option C is wrong because Purview Information Protection labels and encrypts data but does not provide the partner query access or enforce read-only permissions. Option D is wrong because Azure DevOps repositories are for source code, not for sharing PHI with a partner organization.

Answer

Azure Active Directory B2C (now part of Entra) to allow the partner to authenticate and access data via a custom API.

Answer

Microsoft Purview Information Protection to label the data and allow the partner to decrypt it.

Answer

Azure DevOps for sharing the data in a repository with read-only permissions.

Question 12

Your company uses Microsoft Purview to manage data governance. You need to create a data classification rule that scans Azure Data Lake Storage for personally identifiable information (PII) such as email addresses. The rule must also apply a sensitivity label automatically. Which approach should you use?

Accepted Answer

Create a custom scan rule in Microsoft Purview and configure auto-labeling.. The correct option is B: create a custom scan rule in Microsoft Purview and configure auto-labeling. Microsoft Purview is the data governance service that supports scanning Azure Data Lake Storage with custom classification rules (using regex or dictionaries) to detect PII such as email addresses, and its auto-labeling policies can then apply sensitivity labels automatically to matching content. Option A is wrong because Azure Policy enforces resource configuration and compliance, not content-level PII detection or sensitivity labeling. Option C is wrong because Power Automate is a workflow automation tool and does not provide Purview's built-in classification scanning for Data Lake Storage. Option D is wrong because Microsoft Defender for Cloud focuses on security posture and threat protection, not data classification or sensitivity labeling.

Answer

Create an Azure Policy to detect and label PII.

Answer

Use a Power Automate flow to scan files and apply labels.

Answer

Use Microsoft Defender for Cloud to scan for PII.

Question 13

Your organization uses Microsoft Sentinel for SIEM. You need to ensure that security incidents are automatically responded to without human intervention for known false positives. What should you implement?

Accepted Answer

An automation rule with incident closure action. Automation rules in Microsoft Sentinel can be configured to automatically close incidents when specific conditions are met, such as when an incident is identified as a known false positive. This eliminates the need for human intervention by triggering an incident closure action based on predefined criteria, directly addressing the requirement for automated response to false positives.

Answer

An analytics rule with alert suppression

Answer

A playbook that runs on incident creation

Answer

An entity behavior analytics rule

Question 14

Your organization has a Microsoft Defender for Cloud Apps policy that detects suspicious OAuth app permissions. You need to ensure that when a high-risk app is detected, the app is automatically disabled and the user is notified. What is the most efficient design?

Accepted Answer

Use the 'Disable app' governance action in the policy, and configure email notification. Microsoft Defender for Cloud Apps policies natively support governance actions such as 'Disable app,' which can be applied automatically when a policy match occurs, and the same policy can be configured to send email notifications to affected users, making this the most efficient single-policy design. Option B only notifies the user and does not disable the high-risk app, so it fails the requirement. Option C adds unnecessary complexity by routing the alert to Microsoft Sentinel and building a playbook, which is not the most efficient approach when the native governance action exists. Option D relies on an external Power Automate flow triggered by the alert, which is also less efficient than using the built-in 'Disable app' governance action.

Answer

Configure the policy to notify the user via email

Answer

Send the alert to Microsoft Sentinel and create an incident with a playbook

Answer

Create a Power Automate flow that triggers on the alert to disable the app

Question 15

You are designing a secure DevOps pipeline in GitHub that deploys to Azure Kubernetes Service (AKS). The security team requires that no secrets are stored in the pipeline variables and that all container images are scanned for vulnerabilities before deployment. Which approach aligns with security best practices?

Accepted Answer

Use GitHub Actions with OpenID Connect to authenticate to Azure without storing any secrets. Integrate Microsoft Defender for Containers to scan images in Azure Container Registry.. It uses OpenID Connect (OIDC) to authenticate GitHub Actions to Azure without storing any long-lived secrets, which aligns with the requirement that no secrets be stored in pipeline variables. Additionally, integrating Microsoft Defender for Containers provides vulnerability scanning for container images in Azure Container Registry (ACR), meeting the image scanning requirement before deployment to AKS.

Answer

Use Azure DevOps with a service principal that has a client secret stored in Azure Key Vault. Use Trivy to scan images.

Answer

Use GitHub Actions with a managed identity for the GitHub runner. Disable image scanning to speed up deployments.

Answer

Use GitHub Actions with environment secrets for Azure service principal credentials. Use Docker Hub's vulnerability scanning.