SC-100 Practice Test 4 — 25 Questions

Question 1

A company has a hybrid identity deployment using Azure AD Connect. They want to ensure that if a user's on-premises account is disabled, the corresponding Azure AD account is also disabled within 30 minutes. Which setting should they configure?

Accepted Answer

Configure the synchronization interval for directory changes. Option B is correct because Azure AD Connect's default synchronization cycle for directory changes is 30 minutes. By configuring the synchronization interval (via the Azure AD Connect scheduler or PowerShell), you can ensure that disabled on-premises accounts are reflected in Azure AD within that timeframe. This setting directly controls how frequently Azure AD Connect processes and synchronizes changes from the on-premises Active Directory to Azure AD.

Answer

Enable password hash synchronization

Answer

Install Azure AD Application Proxy

Answer

Enable password writeback

Question 2

Which TWO of the following are valid methods to secure traffic between on-premises and Azure?

Accepted Answer

ExpressRoute with MACsec. ExpressRoute with MACsec provides encryption at Layer 2 using the IEEE 802.1AE standard, securing traffic between on-premises and Azure over a private connection without traversing the public internet. Site-to-Site VPN uses IPsec (IKEv1/IKEv2) to encrypt traffic over the public internet, establishing a secure tunnel between the on-premises VPN device and Azure VPN Gateway. Both are valid methods for securing traffic, with ExpressRoute+MACsec offering lower latency and higher throughput for private connectivity.

Answer

Azure Front Door

Answer

Azure Traffic Manager

Answer

Azure CDN

Question 3

An organization uses Microsoft Defender for Cloud to secure their multi-cloud environment, including Azure and AWS. They want to ensure that all AWS EC2 instances are automatically onboarded to Defender for Cloud. What should they configure?

Accepted Answer

Set up the AWS connector in Defender for Cloud. Option C is correct because the AWS connector in Microsoft Defender for Cloud is the native integration that enables automatic discovery and onboarding of AWS resources, including EC2 instances, into Defender for Cloud. Once configured, the connector uses AWS IAM roles and APIs to continuously sync EC2 inventory and apply Defender plans (e.g., Defender for Servers) without requiring manual agent installation on each instance.

Answer

Deploy Azure Arc on each EC2 instance

Answer

Use AWS Systems Manager to push Defender workload

Answer

Configure AWS Config rules to report to Defender

Question 4

A financial services company is deploying a three-tier application on Azure. They need to ensure that the web tier can only communicate with the application tier, and the application tier can only communicate with the data tier. All tiers should use private IP addresses. What is the most secure way to implement this?

Accepted Answer

Deploy Azure Firewall and use application rules. Azure Firewall with application rules (FQDN-based) provides the most secure and granular control for east-west traffic between tiers. It can inspect and filter traffic at Layer 7 (application layer) using TLS inspection, ensuring only allowed application protocols (e.g., HTTPS) and specific FQDNs are permitted, while blocking all other traffic. This meets the requirement for private IP communication and enforces a zero-trust model between tiers.

Answer

Use Network Security Groups (NSGs) on each subnet

Answer

Use VNet peering with route tables

Answer

Use Azure Web Application Firewall (WAF)

Question 5

You are a cybersecurity architect for a multinational corporation that is migrating its on-premises workloads to Azure. The environment includes 500 virtual machines across multiple subscriptions, managed through Azure Policy and Azure Blueprints. The security team has reported that some VMs are not receiving the latest security updates despite being configured for automatic updates via the Azure Update Management solution. Additionally, you have noticed that some VMs are missing the Azure Monitor agent, which is required for security monitoring. The company uses Azure Security Center (now Defender for Cloud) with the standard tier enabled. You need to ensure that all VMs are compliant with the company's security baseline, which requires: (1) all VMs must have the Azure Monitor agent installed, (2) all VMs must be enrolled in the Update Management solution, and (3) all VMs must be protected by Microsoft Defender for Cloud. What should you do to enforce compliance and remediate non-compliant VMs?

Accepted Answer

Use Azure Policy with built-in initiatives such as 'Enable Azure Monitor for VMs' and 'Configure machines to automatically install updates' and assign them to all subscriptions. Option A is correct because Azure Policy with built-in initiatives like 'Enable Azure Monitor for VMs' and 'Configure machines to automatically install updates' provides a declarative, scalable, and continuous compliance enforcement mechanism. These initiatives automatically remediate non-compliant VMs by deploying the required agents and configurations across all subscriptions, ensuring all three security baseline requirements are met without manual intervention.

Answer

Create a new Azure Blueprint that includes the required configurations and assign it to all subscriptions

Answer

Use Azure Automation to run scripts that install the agent and enable updates on all VMs

Answer

Configure Microsoft Defender for Cloud to automatically install the Azure Monitor agent and enable updates

Question 6

A company uses Azure Policy to enforce compliance. They want to automatically remediate non-compliant resources by deploying a custom template. Which effect should they use in the policy definition?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists effect is correct because it allows Azure Policy to automatically remediate non-compliant resources by deploying a custom ARM template when the resource is found to be non-compliant. This effect is specifically designed for automatic remediation scenarios, as it triggers a deployment to bring the resource into compliance without manual intervention.

Answer

Audit

Answer

Disabled

Answer

Deny

Question 7

Refer to the exhibit. A network policy is applied in the production namespace. What is the effect on the webapp pod's ability to reach external services?

Accepted Answer

All egress traffic except to kube-dns is denied. Option D is correct because the network policy in the exhibit defines an egress rule that only allows traffic to kube-dns (port 53, UDP) and denies all other egress traffic by default. Since no other egress rules are specified, the webapp pod cannot reach any external services except the cluster's DNS resolver.

Answer

Ingress traffic is blocked

Answer

The pod can only communicate with kube-dns

Answer

The pod can communicate with any service

Question 8

Which TWO of the following are true about Azure DDoS Protection?

Accepted Answer

It can be used to protect against application-layer attacks when combined with WAF. Option C is correct because Azure DDoS Protection operates at Layers 3 and 4 of the OSI model, but when combined with Azure Application Gateway WAF (Web Application Firewall), it can also mitigate application-layer (Layer 7) attacks such as SQL injection or cross-site scripting. The WAF inspects HTTP/HTTPS traffic and blocks malicious payloads, while Azure DDoS Protection handles volumetric attacks, providing a layered defense.

Answer

It automatically blocks all traffic during an attack

Answer

It protects VMs from internal traffic attacks

Answer

It provides a monthly allowance of attacks

Question 9

A company uses Azure Kubernetes Service (AKS) with Azure Active Directory (Azure AD) integration. They want to restrict developers to only be able to create and manage pods and services, but not modify cluster-level resources like nodes or namespaces. What should they configure?

Accepted Answer

Create a custom ClusterRole with rules for pods and services, then bind it to the developer group with a ClusterRoleBinding. Option B is correct because Kubernetes RBAC allows fine-grained authorization. A custom ClusterRole can define rules for pods and services (core API group resources), and a ClusterRoleBinding binds it to the developer group across all namespaces. This grants the required permissions without allowing modifications to cluster-level resources like nodes or namespaces, which are not included in the custom role's rules.

Answer

Assign the cluster-admin ClusterRole to the developers

Answer

Create a RoleBinding in each namespace for developers

Answer

Use Azure RBAC to grant Contributor role on the AKS cluster

Question 10

Refer to the exhibit. You are analyzing a KQL query in Microsoft Defender XDR advanced hunting. The query is intended to identify the top 10 devices by the number of executable process creations in the last 7 days. However, the results are showing only a few entries with low counts. What is the most likely issue?

Accepted Answer

The ActionType filter is likely missing the correct value for process creation. Option D is correct because the query likely filters on an incorrect ActionType value for process creation. In Microsoft Defender XDR advanced hunting, process creation events use ActionType == "ProcessCreated" (or "CreateProcess" depending on schema), not "ProcessCreate". This mismatch causes the query to return few or no results. Option A is incorrect because DeviceName should be included in the summarize to group by device, but the primary issue is the filter. Option B is incorrect because 'take' is appropriate for limiting results after aggregation. Option C is incorrect because 'bin' on Timestamp is valid for time bucketing.

Answer

The 'summarize' statement should include DeviceName in the aggregate

Answer

The 'take' operator is not appropriate for this aggregation

Answer

The 'bin' function on Timestamp is incorrect

Question 11

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies creation of any virtual machine that is attached to a public IP address.. Option B is correct. The policy denies creation of any virtual machine that has a network interface with a public IP address. The condition in the policy checks if the network interface has a public IP configuration, which is typically indicated by the presence of a public IP address resource ID. Option A is incorrect because the policy does not check for a specific subnet; it checks for a public IP. Option C is incorrect because the policy denies VMs with NICs (specifically those with public IP), not VMs without NICs. Option D is incorrect because the policy denies creation, not allows, and does not target a specific subnet.

Answer

Denies creation of any virtual machine that has a network interface attached to a specific subnet.

Answer

Denies creation of any virtual machine that does not have a network interface.

Answer

Allows creation of virtual machines only if they have a network interface attached to a specific subnet.

Question 12

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to automatically create incidents in Sentinel for high-severity alerts from Defender XDR. You also want to suppress low-severity alerts to reduce noise. What should you configure?

Accepted Answer

Create a scheduled analytics rule that queries Defender XDR alerts with severity filter and creates incidents.. Option D is correct because a scheduled analytics rule can query Microsoft Sentinel's workspace for Defender XDR alerts via the SecurityAlert table and filter by severity to create only high-severity incidents. This is the recommended method to selectively create incidents from Defender XDR alerts. Option A is incorrect because the Microsoft Defender XDR connector, when set to 'Create incidents only for high severity,' only affects how Sentinel ingests alerts but does not automatically create incidents; incidents are created by default for all alerts unless a rule suppresses them. Option B is incorrect because automation rules run after incidents are created and cannot decide which alerts become incidents; they operate on existing incidents. Option C is incorrect because a playbook triggered on alerts would be reactive and complex, and there is no direct alert trigger for Defender XDR alerts in Sentinel; the proper way is through analytics rules.

Answer

Configure the Microsoft Defender XDR connector to create incidents only for high severity.

Answer

Configure an automation rule to create incidents for all alerts.

Answer

Create a playbook that triggers on alerts and creates incidents.

Question 13

Your organization uses Microsoft Defender for Endpoint (MDE) and wants to implement automated investigation and response (AIR) for ransomware. You need to ensure that when a suspicious file is detected, the investigation is automatically started and the file is contained. What should you configure?

Accepted Answer

Configure the automated investigation and response capabilities in MDE.. Option A is correct because automated investigation and response (AIR) in Microsoft Defender for Endpoint can be configured to automatically start investigations and take containment actions like isolating files when suspicious activity is detected. Option B is incorrect because custom detection rules in Microsoft 365 Defender create alerts but do not automatically take response actions like containment; they require manual or automated remediation rules. Option C is incorrect because attack surface reduction rules reduce the attack surface by blocking common techniques but do not automate investigation and response for specific detections. Option D is incorrect because adding file hashes to the indicators of compromise list blocks or allows known threats but does not automate the investigation process.

Answer

Create a custom detection rule in Microsoft 365 Defender.

Answer

Enable attack surface reduction rules.

Answer

Add the file hash to the indicators of compromise list.

Question 14

Your organization uses Microsoft Sentinel with the Microsoft 365 Defender connector. You need to create an analytics rule that generates an incident when a user is reported as compromised by Microsoft Defender for Identity. The rule should use the most efficient method to get this data. What should you use as the data source?

Accepted Answer

The SecurityAlert table with a filter for Defender for Identity.. The SecurityAlert table contains security alerts from various sources, including Microsoft Defender for Identity, when ingested via the Microsoft 365 Defender connector. By filtering for Defender for Identity alerts, you can create an analytics rule that triggers an incident when a user is reported as compromised. This is the most efficient method because the alerts are already available in this table. Option B (DeviceEvents) is from Advanced Hunting and is not directly available in Sentinel tables; it requires running queries against the Microsoft 365 Defender advanced hunting schema, which is less efficient for creating analytics rules. Option C (OfficeActivity) contains Office 365 audit logs, not security alerts. Option D (IdentityInfo) contains identity information such as user details, but not alerts or compromise status.

Answer

The DeviceEvents table from Advanced Hunting.

Answer

The OfficeActivity table.

Answer

The IdentityInfo table.

Question 15

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to design a solution that automatically remediates non-compliant devices by running a remediation script. Which Intune component should you use?

Accepted Answer

Remediation policy in Microsoft Intune. Option A is correct because Intune remediation policies allow you to automatically execute scripts to detect and fix non-compliant settings on devices. Option B (Device compliance policy) sets compliance rules but does not run scripts. Option C (App protection policy) manages app-level data protection, not device remediation. Option D (Device configuration profile) deploys settings but does not include script execution for remediation.

Answer

Device compliance policy

Answer

App protection policy

Answer

Device configuration profile

Question 16

Your organization deploys Microsoft Sentinel and wants to automatically respond to phishing emails reported by users. You need to recommend a solution that creates an incident in Sentinel and blocks the email sender in Exchange Online. What should you configure?

Accepted Answer

Create an automation rule that runs a playbook when an incident is created.. Option B is correct because automation rules in Microsoft Sentinel can trigger a playbook when an incident is created, allowing automated response actions such as blocking the email sender in Exchange Online. Option A is incorrect because watchlists are for reference data, not automation. Option C is incorrect because UEBA analyzes user behavior but does not directly respond to incidents. Option D is incorrect because analytics rules generate incidents from data, but the question asks for a response after an incident is created.

Answer

Use a watchlist to store known phishing senders.

Answer

Enable UEBA to detect anomalous email behavior.

Answer

Create an analytics rule that queries user-reported phishing data.

Question 17

Your company uses Microsoft Intune to manage corporate devices. You need to design a compliance policy that requires devices to have a minimum OS version, be encrypted, and not be jailbroken or rooted. Additionally, you want to automatically block non-compliant devices from accessing corporate email. What should you configure?

Accepted Answer

Intune compliance policies and Conditional Access. Option A is correct because Intune compliance policies define device requirements (minimum OS version, encryption, jailbreak/root status), and Conditional Access policies can block access to corporate email for non-compliant devices. Option B is incorrect because device configuration profiles configure settings but do not enforce access control. Option C is incorrect because app protection policies protect data at the app level, not device-level compliance, and Microsoft Defender for Endpoint provides threat detection but not compliance enforcement. Option D is incorrect because device enrollment restrictions limit which devices can enroll, not access after enrollment.

Answer

Device configuration profiles and Azure AD join

Answer

App protection policies and Microsoft Defender for Endpoint

Answer

Device enrollment restrictions

Question 18

Your organization uses Microsoft Sentinel. You need to design a solution to detect and automatically respond to a potential brute-force attack against an on-premises application that is published via Azure AD Application Proxy. The solution should block the attacker's IP address in Azure AD Conditional Access for one hour after detecting more than 10 failed login attempts within 5 minutes. What should you implement?

Accepted Answer

Create a Microsoft Sentinel analytics rule that triggers on a KQL query detecting the failed logins, then use a playbook to add the IP to a Conditional Access block list via the Azure AD API.. Option B is correct because you can create a Microsoft Sentinel analytics rule with a KQL query that detects more than 10 failed login attempts within 5 minutes. When the rule triggers, it runs a playbook that uses the Azure AD API to add the attacker's IP to a Conditional Access block list, blocking further access for one hour. Option A is incorrect because Microsoft Purview DLP policies are for data protection, not authentication blocking. Option C is incorrect because a WAF rate limit blocks at the network layer but does not integrate with Azure AD Conditional Access, and it cannot read authentication logs from Azure AD App Proxy. Option D is incorrect because Microsoft Entra ID Protection sign-in risk policies are user-based and cannot block specific IPs or apply custom logic like a 1-hour block.

Answer

Create a Microsoft Purview Data Loss Prevention policy to block the IP address based on the login pattern.

Answer

Deploy a web application firewall (WAF) in front of the application and configure rate limiting to block the IP.

Answer

Configure a Microsoft Entra ID Protection sign-in risk policy to automatically block the user's sign-in after detecting anomalous activity.

Question 19

Your organization uses Microsoft Purview to manage data governance. You need to create a unified data catalog that automatically classifies and labels data across Azure SQL Database, Amazon S3, and on-premises SQL Server. What should you configure?

Accepted Answer

Microsoft Purview account with scans for all data sources.. Option A is correct because Microsoft Purview (the unified data governance service) supports scanning and classifying data across multi-cloud and on-premises sources. Option B is wrong because Azure Data Catalog is a legacy service that does not support automatic classification and labeling. Option C is wrong because Azure Purview (legacy) is no longer the current service name; it has been rebranded as Microsoft Purview. Option D is wrong because Microsoft Information Protection scanner is for labeling and protection, not for creating a unified data catalog.

Answer

Azure Data Catalog with custom classification.

Answer

Azure Purview (legacy) with multi-cloud scanning.

Answer

Microsoft Information Protection scanner on each source.

Question 20

Your company uses Microsoft 365 E5 licenses and has deployed Microsoft Defender for Office 365. The security team wants to be alerted when a user reports a phishing email using the built-in report message button in Outlook. The alert should be sent to the security team's email address. You need to configure this in the Microsoft 365 Defender portal. What should you do?

Accepted Answer

Configure the User reported messages settings to send alerts to the security team.. Option B is correct because user-reported messages settings in the Microsoft 365 Defender portal allow you to configure alerts when users report phishing emails using the built-in report message button. Option A is incorrect because anti-phishing policies handle detection and prevention, not user submissions. Option C is incorrect because Safe Attachments policies are for scanning email attachments, not for user-reported messages. Option D is incorrect because Safe Links policies protect against malicious URLs, not for handling user-reported phishing emails.

Answer

Create an anti-phishing policy that notifies users about phishing.

Answer

Create a Safe Attachments policy to detect phishing attachments.

Answer

Create a Safe Links policy that alerts on phishing URLs.