SC-100 Practice Test 5 — 25 Questions

Question 1

A company is designing a Zero Trust network strategy. They want to ensure that all network traffic between on-premises and Azure is inspected and logged, regardless of source or destination. Which Azure service should they use to achieve this?

Accepted Answer

Azure Firewall. Azure Firewall is a managed, cloud-based network security service that provides inbound and outbound traffic inspection and logging for all traffic between on-premises networks and Azure, regardless of source or destination. It supports application and network-level filtering, threat intelligence-based filtering, and integrates with Azure Monitor for comprehensive logging, making it the correct choice for a Zero Trust network strategy that requires full traffic inspection and logging.

Answer

Azure Front Door

Answer

Azure Bastion

Answer

Azure DDoS Protection

Question 2

A company uses Azure App Service to host a web application that stores sensitive data in Azure SQL Database. The security team requires that data at rest in the database be encrypted using a customer-managed key stored in Azure Key Vault. The key must be rotated automatically every 90 days. What is the recommended approach to meet these requirements?

Accepted Answer

Enable TDE with customer-managed keys in Azure Key Vault and set a key rotation policy in Key Vault to rotate the key every 90 days.. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure Key Vault meets the requirement for encrypting data at rest in Azure SQL Database using a key controlled by the customer. Azure Key Vault supports automatic key rotation policies that can be set to rotate the key every 90 days, satisfying the rotation requirement without manual intervention or application code changes.

Answer

Encrypt sensitive columns using cell-level encryption with keys stored in Azure Key Vault and rotate keys manually every 90 days.

Answer

Enable Transparent Data Encryption (TDE) with service-managed keys in Azure SQL Database.

Answer

Use Always Encrypted with column master keys stored in Azure Key Vault and configure key rotation in the application code.

Question 3

A company is deploying Microsoft Defender for Cloud to protect a multi-cloud environment that includes Azure and AWS. The security team wants to prioritize the highest-risk recommendations. Which feature should they use to identify and focus on the most critical security issues?

Accepted Answer

Use Secure Score and its recommendations. Secure Score in Microsoft Defender for Cloud aggregates all security recommendations and assigns a score based on their relative risk and impact. By focusing on recommendations that most improve the Secure Score, the security team can systematically prioritize the highest-risk issues across both Azure and AWS resources. This directly aligns with the goal of identifying and focusing on the most critical security issues.

Answer

Regulatory Compliance dashboard

Answer

Enable Defender for Cloud's enhanced security features

Answer

Review attack path analysis

Question 4

A security administrator applies the Azure Policy definition shown in the exhibit to a management group containing multiple subscriptions. After the policy is assigned, a development team reports they cannot create a new storage account in their subscription. What is the most likely cause?

Accepted Answer

The storage account was created with the 'Secure transfer required' setting disabled.. The Azure Policy definition in the exhibit likely includes an effect (e.g., 'Deny') that requires the 'Secure transfer required' setting to be enabled on storage accounts. When the development team attempts to create a storage account with this setting disabled, the policy denies the request, preventing the creation. This is the most direct cause because Azure Policy enforces compliance rules at resource creation time, and disabling secure transfer violates the policy's condition.

Answer

The storage account was created using an older API version that does not support Azure Policy enforcement.

Answer

The storage account was created in a region that does not support the premium tier.

Answer

The storage account was assigned a network security group (NSG) that blocks inbound HTTPS traffic.

Question 5

Refer to the exhibit. A security administrator created this Azure Policy definition to prevent unauthorized role assignments. However, SOC analysts are unable to assign the Security Operations Contributor role to new team members. What is the most likely cause?

Accepted Answer

The policy uses the 'deny' effect, which blocks any role assignment for the specified role.. Option D is correct because the Azure Policy definition uses the 'deny' effect, which explicitly blocks any role assignment that matches the specified role definition ID. Since the policy targets the Security Operations Contributor role, any attempt to assign that role—including by SOC analysts—is denied by the policy engine, regardless of permissions.

Answer

The policy is scoped to a management group that does not include the SOC team's subscription.

Answer

The parameter 'principalId' is required but not provided when assigning the policy.

Answer

The role definition ID in the policy does not match the Security Operations Contributor role.

Question 6

Which THREE of the following are key components of a security operations strategy according to Microsoft's best practices?

Accepted Answer

Detection and analysis. Detection and analysis is a core component of a security operations strategy because it defines how security events are identified, triaged, and investigated. Microsoft's NIST-based SOC maturity model emphasizes continuous monitoring and analytics (e.g., using Microsoft Sentinel analytics rules, UEBA, and threat intelligence) to reduce mean time to detect (MTTD). Without robust detection and analysis, an organization cannot effectively respond to threats.

Answer

Microsoft Sentinel deployment

Answer

Policy and standards development

Question 7

Refer to the exhibit. You are reviewing an Azure Policy definition that will be assigned to a subscription containing production virtual machines. The policy is intended to enforce security best practices for disk encryption. What is the effect of this policy?

Accepted Answer

The policy denies deployment of virtual machines using Standard_LRS or StandardSSD_LRS managed disks.. The policy uses the 'deny' effect with a condition that checks if the 'Microsoft.Compute/disks/sku.name' property is not equal to 'Premium_LRS'. This means any virtual machine deployment that uses Standard_LRS or StandardSSD_LRS managed disks will be denied, enforcing the use of Premium_LRS disks for production VMs to meet security best practices for disk encryption.

Answer

The policy modifies existing virtual machines to change their disk type to Premium_LRS.

Answer

The policy allows deployment of virtual machines only if they use Standard_LRS or StandardSSD_LRS disks.

Answer

The policy audits virtual machines to ensure they have Azure Disk Encryption enabled.

Question 8

A financial services organization is designing a zero-trust architecture for its Azure environment. They need to ensure that all administrative access to critical systems uses just-in-time (JIT) access and that privileged role assignments are time-bound. Which combination of Microsoft security best practices should they implement?

Accepted Answer

Azure AD Privileged Identity Management (PIM) and Azure Bastion. Azure AD Privileged Identity Management (PIM) provides just-in-time (JIT) activation and time-bound role assignments for privileged roles, directly meeting the requirement for time-bound administrative access. Azure Bastion enables secure, audited RDP/SSH access to Azure VMs without exposing public IP addresses, ensuring that administrative sessions are isolated and monitored. Together, they enforce zero-trust principles by granting ephemeral, scoped access to critical systems.

Answer

Azure AD Conditional Access and Azure AD Identity Protection

Answer

Azure Policy and Azure Blueprints

Answer

Azure Sentinel and Azure Workbook

Question 9

A company uses Azure SQL Database and needs to implement column-level encryption for a column containing social security numbers (SSNs). The encryption must use a customer-managed key stored in Azure Key Vault. The application queries this column using parameterized queries. Which technology should be used?

Accepted Answer

Always Encrypted with secure enclaves. Always Encrypted with secure enclaves is the correct choice because it enables client-side encryption of specific columns (like SSNs) using a customer-managed key stored in Azure Key Vault, while still allowing rich computations (e.g., equality, pattern matching) on the encrypted data within a secure enclave. This meets the requirement for column-level encryption with customer-managed keys and supports parameterized queries without exposing plaintext to the database engine.

Answer

Dynamic Data Masking (DDM)

Answer

Row-Level Security (RLS)

Answer

Transparent Data Encryption (TDE) with customer-managed keys

Question 10

A company uses Azure DevOps for CI/CD. The security team wants to ensure that secrets like API keys and connection strings are never stored in code repositories. Which best practice should they recommend?

Accepted Answer

Use Azure Key Vault references in Azure DevOps variable groups. Option B is correct because Azure Key Vault references in Azure DevOps variable groups allow secrets to be securely linked to pipelines without ever storing them in code repositories. At pipeline runtime, the agent retrieves the secret value directly from Azure Key Vault using a managed identity or service principal, ensuring secrets are never exposed in YAML files, logs, or build artifacts.

Answer

Use environment variables in the pipeline YAML

Answer

Encrypt secrets using Git-secret and commit to repo

Answer

Store secrets in Azure App Configuration with encryption

Question 11

Refer to the exhibit. A security architect reviews the Azure AD Conditional Access policy JSON. The policy is intended to require MFA for all users accessing Azure management (Microsoft Azure Management app ID 797f4846-ba77-4853-9e6f-4433c3e1d1c5), except for the BreakGlassAdmin account and from trusted locations. However, some users report being prompted for MFA even when connecting from the corporate office (which is marked as a trusted location). What is the most likely cause?

Accepted Answer

The corporate office location is not correctly defined as a trusted location in Azure AD. Option A is correct because the policy is designed to require MFA for all users accessing Azure management, except for the BreakGlassAdmin account and from trusted locations. If the corporate office location is not correctly defined as a trusted location in Azure AD, the Conditional Access policy will not recognize it as an exception, and users connecting from that location will still be prompted for MFA. This mismatch between the intended trusted location definition and the actual location configuration is the most likely cause of the unexpected MFA prompts.

Answer

The grant controls operator is set to 'OR' instead of 'AND'

Answer

The policy is in 'Report-only' mode

Answer

The policy applies to all cloud apps, not just Azure management

Question 12

You are designing a network security solution for a multi-tier application hosted in Azure. The front-end web tier must be accessible from the internet, but the back-end database tier must only accept traffic from the front-end tier. Which Azure service should you use to enforce this restriction?

Accepted Answer

Network Security Groups (NSGs). Option B (Network Security Groups) is correct because NSGs can filter traffic between subnets. By applying an NSG to the database subnet with a rule that allows inbound traffic only from the front-end subnet's IP address range (or virtual network), you can effectively restrict database access to only the front-end tier. Option A (Azure Firewall) is a managed firewall service that can also perform this function, but for simple subnet-level filtering within a virtual network, NSGs are more appropriate, cost-effective, and easier to manage. Option C (Application Gateway) is a layer-7 load balancer designed for HTTP/S traffic and does not provide network-layer filtering between subnets. Option D (Azure Bastion) provides secure RDP/SSH access to virtual machines and is not used for network traffic filtering.

Answer

Azure Firewall

Answer

Azure Bastion

Answer

Application Gateway

Question 13

Your organization is planning to deploy Microsoft Defender for Cloud to protect a hybrid environment that includes on-premises servers and Azure virtual machines. You need to ensure that the security recommendations and threat detections are consistently applied across all resources. What should you configure?

Accepted Answer

Enable auto-provisioning for the Log Analytics agent on all subscriptions.. Option B is correct because enabling auto-provisioning for the Log Analytics agent ensures that all existing and future Azure VMs and, via Azure Arc, on-premises servers are automatically monitored by Microsoft Defender for Cloud, allowing security recommendations and threat detections to be consistently applied across all resources. Option A is incorrect because Azure Arc enables management of on-premises servers but does not by itself ensure consistent security policy application; it must be combined with auto-provisioning or policy. Option C is incorrect because configuring an Azure Policy to require deployment of the Log Analytics agent does not automatically deploy it; it only checks compliance. Option D is incorrect because assigning the 'Deploy Log Analytics agent' initiative to a management group will audit or deploy the agent to Azure VMs but does not cover on-premises servers unless they are Azure Arc-enabled, and auto-provisioning is the simpler mechanism to ensure consistent monitoring across all resources.

Answer

Connect on-premises servers using Azure Arc and assign a built-in policy initiative.

Answer

Configure an Azure Policy to require the deployment of the Log Analytics agent.

Answer

Use Azure Policy to assign the 'Deploy Log Analytics agent' initiative to the management group.

Question 14

Your company uses Microsoft Defender for Cloud to protect Azure resources. A critical application uses an Azure SQL Database. You need to ensure that all queries to the database are encrypted in transit and that the encryption protocol is the most secure version available. Which configuration should you enforce?

Accepted Answer

Set the minimal TLS version to 1.2 in the server's firewall rules.. Option A is correct because enforcing a minimal TLS version of 1.2 in the server's firewall rules ensures that all connections use TLS 1.2 or higher, which is the most secure encryption protocol available for Azure SQL Database. Option B is incorrect because rejecting unencrypted connections only enforces encryption but does not specify the TLS version, allowing older, less secure versions. Option C is incorrect because setting the connection policy to Proxy and forcing TCP does not affect encryption or TLS version. Option D is incorrect because 'Force SSL' only mandates encryption but does not restrict the TLS version, potentially allowing TLS 1.0 or 1.1.

Answer

Configure the database to reject unencrypted connections.

Answer

Set the connection policy to Proxy and force TCP.

Answer

Enable 'Force SSL' on the database.

Question 15

Your organization is migrating on-premises Active Directory to Microsoft Entra ID. You need to design a solution that aligns with the Zero Trust principle of 'verify explicitly'. Which approach should you recommend for user authentication?

Accepted Answer

Deploy passwordless authentication using FIDO2 security keys for all users. D is correct because FIDO2 security keys provide phishing-resistant, passwordless authentication that aligns with the Zero Trust 'verify explicitly' principle by requiring a hardware-bound cryptographic proof of identity at every sign-in. This eliminates reliance on shared secrets (passwords) and ensures that authentication is explicitly verified through a physical device, meeting the strictest security requirements for user authentication.

Answer

Deploy passwordless authentication using Microsoft Authenticator with phone sign-in for all users

Answer

Enable users to sign in with Windows Hello for Business and allow password recovery via self-service

Answer

Implement password hash synchronization and enforce MFA only for privileged users

Question 16

Which TWO should you implement to protect privileged accounts in Microsoft Entra ID?

Accepted Answer

Conditional Access policies requiring MFA for privileged roles. Option B is correct because Conditional Access policies can enforce multifactor authentication (MFA) specifically for users assigned to privileged roles in Microsoft Entra ID. This directly protects those accounts by requiring a second authentication factor, reducing the risk of credential theft or reuse. It is a core identity security control recommended by Microsoft for privileged access.

Answer

Microsoft Purview Data Loss Prevention

Answer

Microsoft Defender for Cloud security score

Answer

Microsoft Defender Vulnerability Management

Question 17

Your organization uses Microsoft Purview Information Protection to label and protect sensitive emails and documents. You need to ensure that when a user applies a 'Highly Confidential' label, the content is automatically encrypted and a watermark is added. Which configuration should you use?

Accepted Answer

Configure a sensitivity label with encryption and watermark settings.. Option C is correct because sensitivity labels in Microsoft Purview Information Protection can be configured with encryption and content marking (watermark) settings, which are applied automatically when users apply the label. Option A is incorrect: the Azure Information Protection scanner discovers and labels existing files but does not configure label settings; the label itself must be defined. Option B is incorrect: a DLP policy can block sharing but cannot add watermarks or encrypt content on its own. Option D is incorrect: Microsoft 365 Message Encryption provides encryption for email transport but does not apply watermarks or enforce labels.

Answer

Use Azure Information Protection scanner to apply labels automatically.

Answer

Create a DLP policy that blocks sharing of highly confidential content.

Answer

Enable Microsoft 365 Message Encryption for all emails.

Question 18

Refer to the exhibit. You are reviewing an Azure Policy definition that denies deployment of virtual machines without encryption at host enabled. A developer reports they cannot deploy a VM that already has encryption at host enabled. What is the most likely cause?

Accepted Answer

The policy definition uses an incorrect field path for encryptionAtHost.. The correct answer is C. The policy definition likely uses an incorrect field path for 'encryptionAtHost'. The proper path is 'Microsoft.Compute/virtualMachines/securityProfile/encryptionAtHost'. If the path is wrong, the policy cannot correctly evaluate the encryption setting, so it denies even compliant VMs. Option A is incorrect because the policy targets VMs without encryption, not all VMs. Option B is incorrect because the effect is 'deny', not 'audit', and the developer reports a blocking error. Option D is incorrect because an exemption would not fix a misconfigured policy rule; the issue lies in the policy definition itself.

Answer

The policy applies to all VMs regardless of encryption setting.

Answer

The policy effect is 'audit' instead of 'deny', so it does not block deployment.

Answer

The policy is missing an exemption for the developer's subscription.

Question 19

Which TWO Azure services can be used to protect a virtual network from inbound DDoS attacks at the network layer?

Accepted Answer

Azure DDoS Protection Standard. Azure DDoS Protection Standard is the dedicated service for mitigating volumetric DDoS attacks at the network layer (L3/L4). It automatically monitors and scrubs traffic to protect virtual networks. Other services like Azure Firewall operate at higher layers or are not primary DDoS solutions; Azure Firewall may filter traffic but does not provide specialized DDoS mitigation. Therefore, only Azure DDoS Protection Standard is designed for network-layer DDoS protection.

Answer

Azure Web Application Firewall (WAF)

Answer

Azure Traffic Manager

Answer

Network Security Groups (NSGs)

Answer

Azure Firewall

Question 20

Your organization is deploying a new application on Azure Kubernetes Service (AKS). You need to secure container access to Azure resources using managed identities. Which THREE components are required? (Choose THREE.)

Accepted Answer

Pod identity (e.g., aad-pod-identity). To secure container access using managed identities, three components are required: an identity assignment mechanism (such as workload identity), a secure credential store (like Azure Key Vault), and the Azure AD managed identity itself. Options B and D correspond to the first two; the managed identity is created separately in Azure AD. Therefore, the correct answers are B and D.

Answer

Azure Container Registry

Answer

Azure Firewall