SC-100 Practice Test 26 — 15 Questions

Question 1

Your organization uses Microsoft Defender for Cloud to protect Azure resources. You need to ensure that only authorized applications can access Azure Key Vault secrets. The solution must use managed identities and least privilege. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign a system-assigned managed identity to the application and grant it Key Vault Secrets User role. Option B is correct because assigning a system-assigned managed identity to the application and granting it the Key Vault Secrets User role provides an Microsoft Entra ID-backed identity that can be authorized via RBAC to read secrets, eliminating stored credentials and enforcing least privilege. The Key Vault Secrets User role grants only read access to secret contents, which matches the requirement that only authorized applications access secrets. Option A is wrong because SAS tokens are not the managed identity mechanism for Key Vault and storing a token in an environment variable introduces a shared secret. Option C is wrong because restricting inbound IP addresses controls network reachability, not application identity or least-privilege authorization. Option D is wrong because client certificate authentication does not use managed identities and requires certificate lifecycle management rather than Azure RBAC.

Answer

Use a shared access signature (SAS) token stored in an environment variable

Answer

Enable public network access on Key Vault and restrict inbound IP addresses

Answer

Install a client certificate on the application server and use it to authenticate to Key Vault

Question 2

Your organization wants to enable Microsoft Defender for Cloud Apps to monitor and control the use of Box and Dropbox. Which TWO steps must you perform?

Accepted Answer

Connect the app using an app connector. Option A is correct because Defender for Cloud Apps monitors and governs sanctioned SaaS apps such as Box and Dropbox by connecting them through an app connector (API connector), which uses the app's APIs and OAuth to pull activity logs, files, and user data for governance and control. Option D is correct because Conditional Access App Control (session control) uses Microsoft Entra Conditional Access policies and a reverse proxy to enforce real-time session controls like block download, block upload, and read-only access for Box and Dropbox. Option B is incorrect because adding apps to the unsanctioned list only tags them in Cloud Discovery as unsanctioned; it does not enable monitoring or control of the apps. Option C is incorrect because a forward proxy is not required; Cloud Discovery can use log upload or Defender for Cloud Apps log collectors, and session control uses a reverse proxy, not a forward proxy. Option E is incorrect because running a Cloud Discovery report only provides visibility into discovered apps and does not by itself enable monitoring and control of Box and Dropbox.

Answer

Add Box and Dropbox to the unsanctioned list

Answer

Deploy a forward proxy

Answer

Run a cloud discovery report

Question 3

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy do?

Accepted Answer

Denies virtual machines with managed disks if the OS disk type is not Standard_LRS or Premium_LRS. The correct option is C: the policy denies virtual machines with managed disks when the OS disk type is not Standard_LRS or Premium_LRS. This matches a typical Azure Policy definition that evaluates the managed disk's storage account type (for example, the field Microsoft.Compute/disks sku.name) and uses a deny effect to block any value outside the allowed set of Standard_LRS and Premium_LRS. Option A is wrong because encryption at host is controlled by a different setting (encryptionAtHost) and is not what this disk-type policy enforces. Option B is wrong because the policy targets managed disks, not unmanaged disks, and it does not allow unmanaged disks. Option D is wrong because the policy does not deny all VMs without managed disks; it only denies managed-disk VMs whose OS disk SKU is not Standard_LRS or Premium_LRS.

Answer

Requires all virtual machines to use encryption at host

Answer

Allows only virtual machines with unmanaged disks

Answer

Denies all virtual machines without managed disks

Question 4

Your organization uses Microsoft Sentinel as a SIEM. You need to design a solution to detect advanced persistent threats (APTs) by correlating data from multiple sources, including network logs, endpoint data, and threat intelligence feeds. The solution must use machine learning to identify anomalies and reduce false positives. Which analytics rule type should you configure?

Accepted Answer

Fusion. Fusion analytics rules in Microsoft Sentinel are specifically designed for advanced multistage attack detection, using machine learning to correlate alerts and signals from multiple sources (network logs, endpoint data, threat intelligence) into high-fidelity incidents, which matches the APT detection and false-positive reduction requirement. ML Behavior Analytics rules focus on specific user/entity behavior anomalies rather than cross-source APT correlation. Anomaly detection rules identify unusual behavior within a single data type and do not perform the multistage fusion correlation. Scheduled query rules run KQL queries on a schedule and lack the built-in ML-driven cross-source correlation for APTs.

Answer

ML Behavior Analytics

Answer

Anomaly detection rules

Answer

Scheduled query rules

Question 5

You are designing a secure hybrid network architecture for a company that uses Azure and an on-premises datacenter. The company requires that all traffic between Azure and on-premises traverses Microsoft's backbone network and never the public internet. Additionally, the solution must provide automatic failover if the primary connection fails. Which Azure service should you include in the design?

Accepted Answer

Azure ExpressRoute with redundant circuits. Azure ExpressRoute with redundant circuits is correct because ExpressRoute provides a private, dedicated connection through a connectivity provider that does not traverse the public internet, and deploying two or more circuits in different peering locations enables automatic failover if the primary circuit fails. Azure Virtual WAN is a networking hub service that can aggregate connectivity but does not by itself guarantee private backbone-only transport or automatic failover. Azure Front Door is a global HTTP/HTTPS load balancer and CDN for web applications, not a hybrid connectivity service. Azure VPN Gateway sends traffic over the public internet via IPsec tunnels, so it fails the requirement that traffic never use the public internet.

Answer

Azure Virtual WAN

Answer

Azure Front Door

Answer

Azure VPN Gateway

Question 6

You are designing a data security solution for a Microsoft 365 tenant that contains highly confidential files. You need to ensure that these files are encrypted and can only be accessed by authorized users, even if the files are downloaded and stored on a personal device. Which technology should you use?

Accepted Answer

Microsoft Purview Information Protection with encryption and usage rights. Microsoft Purview Information Protection with encryption and usage rights (option B) is correct because it applies persistent protection to the file itself via sensitivity labels, so the encryption and usage restrictions travel with the document even after it is downloaded to a personal device, and only authorized users with the granted rights can open it. Office 365 Message Encryption (A) only protects email messages in transit and does not persist on files stored locally. BitLocker (C) encrypts the whole drive at the OS level, so protection is lost once the file leaves that device. Azure Information Protection (D) is the legacy predecessor now superseded by Purview Information Protection, making B the current, appropriate choice.

Answer

Office 365 Message Encryption

Answer

BitLocker Drive Encryption

Answer

Azure Information Protection

Question 7

Your organization is planning to deploy a new web application on Azure VMs. The security team requires that all incoming traffic to the VMs be inspected by a network virtual appliance (NVA) before reaching the VMs. Which Azure networking solution should you use to route traffic through the NVA?

Accepted Answer

User Defined Routes (UDRs). User Defined Routes (UDRs) are the correct choice because they let you override Azure's default system routes and force traffic to be sent to a specific next hop, such as the private IP of a network virtual appliance, so packets are inspected before reaching the VMs. In this scenario, the security team requires traffic to pass through the NVA, which is exactly what a UDR with the NVA as the next hop accomplishes. Azure Firewall (A) is itself a managed firewall service, not the routing mechanism used to redirect traffic to a third-party NVA. Azure Load Balancer (B) distributes traffic across endpoints but does not control routing paths, and Network Security Groups (C) only filter traffic with allow/deny rules rather than steering it through an appliance.

Answer

Azure Firewall

Answer

Azure Load Balancer

Answer

Network Security Groups (NSGs)

Question 8

Refer to the exhibit. You are reviewing an Azure Policy definition that uses a 'modify' effect. The policy is intended to automatically enable transparent data encryption (TDE) on Azure SQL databases after they are created. Which condition must be met for the modify effect to work?

Accepted Answer

A managed identity must be associated with the policy assignment and have permissions to modify TDE.. The correct answer is B: a managed identity must be associated with the policy assignment and have permissions to modify TDE. Azure Policy's modify effect performs remediation-style changes to resources, so the assignment needs a system-assigned or user-assigned managed identity with the required RBAC permissions (such as SQL DB Contributor or a custom role granting Microsoft.Sql/servers/databases/transparentDataEncryption/write) to actually enable TDE on the database. Option A is incorrect because modify works at any assignment scope (management group, subscription, resource group) as long as the identity and permissions are configured. Option C is incorrect because modify can act on existing resources during evaluation/remediation, not only newly created ones. Option D is incorrect because TDE enablement via modify is not limited to the General Purpose service tier.

Answer

The policy must be assigned at the management group scope.

Answer

The database must be newly created.

Answer

The SQL database must be using the General Purpose service tier.

Question 9

Refer to the exhibit. You are reviewing an Azure Policy definition. What is the effect of this policy?

Accepted Answer

Denies creation of Windows VMs without automatic updates enabled. The correct answer is D: the policy denies creation of Windows VMs without automatic updates enabled. In Azure Policy, a Deny effect blocks the deployment request when the resource does not satisfy the condition, so a Windows VM whose automatic updates setting is not enabled would fail the policy evaluation and be rejected. This matches the scenario of enforcing automatic updates on Windows VMs at creation time. Option A is incorrect because it reverses the condition, denying VMs that already have automatic updates enabled. Option B is incorrect because it describes an Audit effect, not Deny, and audits VMs with updates disabled rather than blocking noncompliant deployments. Option C is incorrect because it targets Linux VMs and uses Audit, neither of which matches the policy's Windows VM Deny behavior.

Answer

Denies creation of Windows VMs that have automatic updates enabled

Answer

Audits Windows VMs that have automatic updates disabled

Answer

Audits Linux VMs that have automatic updates enabled

Question 10

Your company develops a web application hosted on Azure App Service. The application uses Azure SQL Database and requires managed identities to access the database. You need to ensure that the application can authenticate to Azure SQL without storing credentials in code. Which authentication method should you implement?

Accepted Answer

Enable system-assigned managed identity on the App Service and grant it access to the SQL database.. Enabling a system-assigned managed identity on the Azure App Service creates an identity in Microsoft Entra ID tied to the app's lifecycle, and that identity can be granted access to Azure SQL Database (for example, by creating a contained database user with CREATE USER [app-name] FROM EXTERNAL PROVIDER and assigning db_datareader/db_datawriter roles), letting the app authenticate without storing any credentials in code. This is the recommended passwordless approach for App Service to Azure SQL. Option A still requires managing and referencing a client certificate, which is credential material rather than eliminating secrets. Option B uses a service principal with a client secret, which is exactly the stored credential the scenario wants to avoid. Option C only restricts network access via firewall rules and does not provide authentication or authorization to the database.

Answer

Store a client certificate in Azure Key Vault and reference it from the app.

Answer

Use an Azure AD service principal with a client secret.

Answer

Use Azure SQL database-level firewall rules with a static IP restriction.

Question 11

Your organization uses Azure API Management (APIM) to expose APIs to external partners. You need to ensure that only authorized partners can access the APIs and that the API requests are rate-limited to prevent abuse. What should you implement?

Accepted Answer

Use a validate JWT policy to authenticate partners and a rate-limit by key policy to control request rates.. In Azure API Management, the validate-jwt policy validates OAuth 2.0/JWT bearer tokens issued by an identity provider (such as Microsoft Entra ID), ensuring only authorized partners with valid tokens can call the APIs, while the rate-limit-by-key policy throttles requests based on a key such as the subscription key or a claim (e.g., partner ID), directly preventing abuse. Together these policies satisfy both the authentication and rate-limiting requirements within the APIM policy pipeline. Option B does not fit because client certificate authentication alone does not provide token-based authorization and a global rate limit applies to all callers rather than per-partner, so one partner could exhaust the quota. Option C is insufficient because a subscription key is a shared secret that can be leaked and IP whitelisting is brittle and does not enforce per-partner request limits. Option D is incomplete because OAuth 2.0 tokens and Key Vault key storage address credential handling but do not themselves implement rate limiting in APIM.

Answer

Configure client certificate authentication and set a global rate limit in the APIM service.

Answer

Require a subscription key for each partner and configure IP whitelisting.

Answer

Use OAuth 2.0 tokens and store partner API keys in Azure Key Vault.

Question 12

You need to design a solution to protect Azure VMs from malware and provide security recommendations. Which Azure service should you enable?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud (option D) is the correct choice because it provides cloud workload protection, including Microsoft Defender for Servers, which delivers antimalware/endpoint protection and security recommendations for Azure VMs. It continuously assesses VM configurations and surfaces hardening recommendations, satisfying both the malware protection and security-recommendation requirements. Azure Sentinel (A) is a SIEM/SOAR platform for collecting and analyzing security events, not for directly protecting VMs from malware. Microsoft Intune (B) is for mobile device and endpoint management, primarily for user devices, not Azure VM workload protection. Azure Monitor (C) collects metrics and logs for observability but does not provide malware protection or security recommendations.

Answer

Azure Sentinel

Answer

Microsoft Intune

Answer

Azure Monitor

Question 13

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Accepted Answer

Microsoft Intune for device management and compliance policies. Microsoft Intune (A) is the correct MDM/MAM service for enforcing device compliance policies (e.g., encryption, OS version, jailbreak detection) and marking devices as managed or compliant, which is the foundation for device-based Zero Trust access. Microsoft Entra ID device registration (B) is required so devices have an identity in Microsoft Entra ID (registered, joined, or hybrid-joined), enabling Conditional Access to evaluate device state and compliance signals. Microsoft Entra Conditional Access policies (C) are the policy engine that enforces the requirement that only compliant and managed devices can access corporate resources, using conditions and grant controls tied to device compliance. Microsoft Entra application proxy (D) is a remote-access/publishing solution for on-premises web apps and does not enforce device compliance or management. Microsoft Entra B2B collaboration (E) governs external guest user access and is unrelated to ensuring devices are managed and compliant.

Answer

Azure AD Application Proxy

Answer

Azure AD B2B collaboration

Question 14

Your company uses Microsoft Sentinel to manage security incidents. You need to design a solution that automatically triages low-severity incidents and enriches them with threat intelligence. Which THREE capabilities would you include? (Choose three.)

Accepted Answer

Playbooks to perform enrichment actions like querying threat intelligence.. Option C is correct because Microsoft Sentinel playbooks, built on Azure Logic Apps, are the automation mechanism that can call the Threat Intelligence connectors and other enrichment actions to add context (for example, IP/domain reputation) to an incident. Option D is correct because automation rules evaluate incident conditions (such as severity or title) at incident creation and can trigger the playbook, which is exactly how low-severity incidents get automatically triaged and enriched. Option E is correct because watchlists let you upload and correlate known indicators (IPs, domains, hashes) against incident entities, providing a lightweight threat-intelligence enrichment source within Sentinel. Option A is not appropriate here because advanced hunting queries are manual, interactive KQL investigations rather than an automated triage/enrichment capability. Option B is not appropriate because analytics rules generate alerts and incidents; they do not perform the automated triage or threat-intelligence enrichment the scenario requires.

Answer

Advanced hunting queries to investigate incidents.

Answer

Analytics rules to generate alerts for low-severity incidents.

Question 15

Your organization uses Microsoft Purview to manage data governance. You need to create a unified data catalog that automatically classifies and labels data across Azure SQL Database, Amazon S3, and on-premises SQL Server. What should you configure?

Accepted Answer

Microsoft Purview account with scans for all data sources.. The correct option is A: a Microsoft Purview account with scans for all data sources. Microsoft Purview is the unified data governance service that builds a data map and catalog by registering and scanning sources such as Azure SQL Database, Amazon S3, and on-premises SQL Server, then automatically applying built-in and custom classifications and sensitivity labels during those scans. The other options do not fit: Azure Data Catalog is a retired service that lacks automated classification and labeling, Azure Purview (legacy) is the former branding of the same service and not the current configuration, and the Microsoft Information Protection scanner only discovers and labels sensitive files on file shares and on-premises repositories, not cloud databases or S3 buckets.

Answer

Azure Data Catalog with custom classification.

Answer

Azure Purview (legacy) with multi-cloud scanning.

Answer

Microsoft Information Protection scanner on each source.