SC-100 Practice Test 27 — 15 Questions

Question 1

Your organization uses Microsoft Entra ID for identity and access management. You are developing a web application that needs to access Microsoft Graph API on behalf of the signed-in user. Which authentication flow should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Authorization Code Flow with PKCE. Authorization Code Flow with PKCE (C) is correct because it is the recommended OAuth 2.0 flow for web applications that call Microsoft Graph on behalf of a signed-in user, exchanging the authorization code for delegated access and refresh tokens while PKCE protects the code exchange against interception. Implicit Flow (A) is deprecated for this purpose and returns tokens directly from the authorization endpoint without an authorization code, offering weaker security. Client Credentials Flow (B) is app-only and has no signed-in user, so it cannot act on behalf of a user. Device Code Flow (D) is intended for input-constrained devices, not a standard web application with a browser-based sign-in.

Answer

Implicit Flow

Answer

Client Credentials Flow

Answer

Device Code Flow

Question 2

Your organization uses Microsoft Entra ID for identity and access management. You are developing a web application that needs to access Microsoft Graph API on behalf of the signed-in user. Which authentication flow should you implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Intune device compliance policy. Option D (Microsoft Intune device compliance policy) is correct because it defines and evaluates the security requirements—such as BitLocker, OS version, and firewall settings—that a device must meet to be marked compliant, which is the foundation for gating access to the sensitive application. Option E (Microsoft Entra ID Conditional Access policy that requires a compliant device) is correct because Conditional Access enforces the access decision at authentication time, granting access only when Intune reports the device as compliant and blocking personal or non-compliant devices. Together, the compliance policy determines device state and the Conditional Access policy enforces it for the target app. Option A is not correct because app protection policies (MAM) protect app data on unmanaged/personal devices rather than blocking access from them. Option B is not correct because requiring hybrid Microsoft Entra ID join restricts access to domain-joined devices and does not directly enforce the company's compliance policy baseline. Option C is not correct because device enrollment alone only registers devices in Intune; without a compliance policy and Conditional Access enforcement, it does not block personal or non-compliant devices.

Answer

Microsoft Intune app protection policy

Answer

Microsoft Entra ID Conditional Access policy that requires hybrid Azure AD join

Answer

Microsoft Intune device enrollment

Question 3

Refer to the exhibit. You run the PowerShell command to retrieve information about a Managed HSM in Azure. The output shows that the HSM is in 'Provisioned' state and has two security domains. What is the purpose of the security domains?

Accepted Answer

To back up and restore the HSM's key material and configuration.. Security domains in Azure Managed HSM are used to back up and restore the HSM's key material and configuration. A security domain is a specially encrypted blob containing the HSM's full key material and configuration, and it is the only way to restore an HSM to a new instance or recover from a total loss of the HSM. Options A, C, and D are incorrect because private endpoint connections, RBAC, and network/firewall rules are managed through Azure networking and Azure RBAC features, not through security domains.

Answer

To manage the HSM's private endpoint connections.

Answer

To enable role-based access control (RBAC) for the HSM.

Answer

To define the HSM's network access and firewall rules.

Question 4

Your organization uses Microsoft Purview to protect sensitive data. You need to implement a solution that automatically detects and protects personally identifiable information (PII) in Microsoft 365. Which THREE should be part of your solution? (Choose THREE.)

Accepted Answer

Microsoft Purview Information Protection scanner. Sensitivity labels in Microsoft Purview Information Protection (E) are the core classification mechanism that lets you tag content containing PII so protection (encryption, marking, access restrictions) travels with the data across Microsoft 365 workloads. Microsoft Purview Data Loss Prevention (DLP) policies (D) automatically detect PII using sensitive information types and then block, warn, or audit risky sharing in Exchange Online, SharePoint, OneDrive, Teams, and endpoint locations. The Microsoft Purview Information Protection scanner (C) extends that same labeling and protection to on-premises file shares and SharePoint Server repositories, which is required for a complete PII detection and protection solution. Azure Policy (A) governs Azure resource compliance and cannot classify or protect PII in Microsoft 365 content, and Microsoft Defender for Cloud (B) is a cloud security posture and workload protection service, not a data classification or DLP tool for Microsoft 365 PII.

Answer

Azure Policy

Answer

Microsoft Defender for Cloud

Question 5

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that investigates and responds to a ransomware incident. Which three actions should you take? (Choose THREE.)

Accepted Answer

Isolate affected devices using Microsoft Defender for Endpoint.. Option A is correct because isolating affected devices via Microsoft Defender for Endpoint (using the live response 'isolate device' action) immediately contains the ransomware and prevents lateral spread while investigation continues. Option B is correct because the unified incident timeline in Microsoft Defender XDR correlates alerts, evidence, and entities across endpoints, identities, email, and cloud apps, giving the analyst the full attack story needed to scope and respond to the incident. Option E is correct because running a hunting query (KQL) in Microsoft Sentinel lets you search ingested logs across connected data sources to identify additional affected devices and indicators beyond those already alerted on. Option C is not required for investigation or response; workbooks are for visualization and reporting, not incident triage. Option D is wrong because deleting log data destroys forensic evidence and violates retention requirements, and it does nothing to improve incident response.

Answer

Create a new workbook to visualize the incident.

Answer

Delete all log data older than 24 hours to improve performance.

Question 6

A company is designing a secure data sharing solution with a partner organization. The data will be stored in Azure Blob Storage. Requirements include: encryption at rest with customer-managed keys, granular access control to specific blobs, and the ability to expire access automatically. Which TWO solutions should you combine? (Choose two.)

Accepted Answer

Generate shared access signatures (SAS) with specific permissions and expiry times.. Option A is correct because shared access signatures (SAS) let you delegate granular, time-limited access to specific blobs or containers, specifying exact permissions (read, write, etc.) and an expiry time, which directly satisfies the requirements for granular access control and automatic access expiration. Option E is correct because Azure Storage Service Encryption with customer-managed keys stored in Azure Key Vault provides encryption at rest where the customer controls the key lifecycle, meeting the customer-managed key requirement. Option B is not correct because enabling Microsoft Entra ID authentication alone does not provide granular per-blob access or automatic expiry; it is an authentication mechanism, not an access delegation or expiration feature. Option C is not correct because IP firewall rules restrict network access but do not provide granular blob-level permissions or automatic access expiration. Option D is not correct because the Storage Blob Data Reader role grants broad read access at the scope assigned and does not inherently expire, so it fails the granularity and automatic expiration requirements.

Answer

Enable Azure Active Directory authentication for the storage account.

Answer

Configure a firewall on the storage account to allow only partner IP addresses.

Answer

Use Azure RBAC to assign the Storage Blob Data Reader role to partner users.

Question 7

Which TWO actions should you take to improve the security posture of an Azure subscription using Microsoft Defender for Cloud? (Select two.)

Accepted Answer

Enable Azure Defender plans for all supported resource types. Option B is correct because enabling Microsoft Defender (Azure Defender) plans for all supported resource types activates the advanced threat protection and workload protection capabilities in Microsoft Defender for Cloud, such as Defender for Servers, Defender for Storage, and Defender for SQL, which provide detection and alerting beyond the free Secure Score recommendations. Option C is correct because acting on the top security recommendations surfaced by Secure Score directly remediates the highest-impact misconfigurations and control gaps, which is the intended workflow for measurably improving the subscription's security posture. Option A is not the best choice because Azure Policy enforces compliance with organizational standards but does not itself provide the threat protection and prioritized remediation that Defender for Cloud is designed to deliver. Option D is not correct because custom security policies are a governance customization rather than a Defender for Cloud posture-improvement action. Option E is not correct because deploying a vulnerability assessment solution is only one specific recommendation within Defender for Servers and is narrower than enabling the full Defender plans and acting on top recommendations.

Answer

Assign Azure Policy to enforce resource compliance

Answer

Create custom security policies

Answer

Deploy vulnerability assessment solution to all VMs

Question 8

Your organization is designing a Zero Trust architecture using Microsoft 365 security features. You need to ensure that all access requests are verified and least-privilege principles are applied. Which TWO capabilities should you implement?

Accepted Answer

Privileged Identity Management (PIM). Conditional Access (E) is a core Zero Trust policy engine in Microsoft Entra ID that evaluates signals such as user, device, location, and risk at access time, enforcing controls like MFA and compliant-device requirements so every access request is explicitly verified. Privileged Identity Management (A) enforces least privilege by making admin roles eligible rather than permanently active, requiring activation with justification, approval, MFA, and time-bound assignments, which directly satisfies the least-privilege requirement. Together they cover the two stated needs: verify every request (Conditional Access) and minimize standing privileges (PIM). Microsoft Defender for Cloud Apps (B) provides CASB visibility and threat protection but is not the mechanism that verifies access requests or enforces least privilege. Microsoft Entra ID (C) is the underlying identity platform that hosts Conditional Access and PIM, but as a directory service it is not itself the specific capability being implemented. Microsoft Purview (D) addresses data governance, compliance, and information protection, not access verification or privilege minimization.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID

Answer

Microsoft Purview

Question 9

Your organization uses Microsoft Defender for Endpoint (MDE) and wants to implement automated investigation and response (AIR) for ransomware. You need to ensure that when a suspicious file is detected, the investigation is automatically started and the file is contained. What should you configure?

Accepted Answer

Configure the automated investigation and response capabilities in MDE.. Option A is correct because Microsoft Defender for Endpoint's automated investigation and response (AIR) capabilities are the built-in feature that automatically triggers investigations when alerts are raised and can take remediation actions such as containing or quarantining a suspicious file. Configuring AIR settings (including automation levels and remediation permissions) ensures that detections like ransomware lead to automatic investigation and file containment without manual intervention. Option B is incorrect because custom detection rules only generate alerts based on queries; they do not themselves perform automated investigation or containment. Option C is incorrect because attack surface reduction rules block specific risky behaviors but do not initiate automated investigations or file containment. Option D is incorrect because adding a file hash to the indicators of compromise list only creates a block/allow indicator and does not start an automated investigation.

Answer

Create a custom detection rule in Microsoft 365 Defender.

Answer

Enable attack surface reduction rules.

Answer

Add the file hash to the indicators of compromise list.

Question 10

Your organization uses Microsoft Intune to manage devices. You need to design a compliance policy that requires devices to have a minimum OS version and be encrypted. Which policy type should you use?

Accepted Answer

Create a device compliance policy in Microsoft Intune.. The correct option is D: Create a device compliance policy in Microsoft Intune. Compliance policies are specifically designed to define rules such as minimum OS version, encryption status, and other security settings that devices must meet, and they evaluate device state against these requirements. Device configuration profiles (A) push settings to devices but do not evaluate compliance, while Conditional Access policies (B) use compliance results to grant or block access rather than define the requirements themselves. App protection policies (C) protect app data on mobile devices and do not enforce OS version or device encryption compliance.

Answer

Create a device configuration profile in Microsoft Intune.

Answer

Create a Conditional Access policy in Microsoft Entra ID.

Answer

Create an app protection policy in Microsoft Intune.

Question 11

You are designing a secure DevOps pipeline for a critical application using GitHub Actions and Microsoft Defender for Cloud. You need to ensure that container images are scanned for vulnerabilities before being deployed to Azure Kubernetes Service (AKS). What should you implement?

Accepted Answer

Integrate Microsoft Defender for Containers with the CI/CD pipeline to scan images in Azure Container Registry.. The correct option is A: integrating Microsoft Defender for Containers with the CI/CD pipeline to scan images in Azure Container Registry. Defender for Containers provides image vulnerability scanning for ACR, and integrating it into the GitHub Actions pipeline lets you detect vulnerabilities before deployment to AKS, matching the requirement to scan images pre-deployment. Option B, GitHub Advanced Security, focuses on code and secret scanning rather than container image vulnerability assessment. Option C, Azure Policy, can audit or deny deployments based on vulnerability findings but does not itself perform image scanning in the pipeline. Option D, ACR Tasks, builds images but does not provide vulnerability scanning.

Answer

Enable GitHub Advanced Security for the repository.

Answer

Configure Azure Policy to require vulnerability assessment.

Answer

Use Azure Container Registry Tasks to build images.

Question 12

Your organization plans to use Microsoft Defender for Cloud to protect a hybrid environment with servers in Azure and on-premises. You need to ensure that security policies are consistently applied across all servers. What should you configure?

Accepted Answer

Onboard all servers to Azure Arc and assign Defender for Cloud policies.. Option A is correct because onboarding on-premises and Azure servers to Azure Arc makes them manageable as connected machine resources in Azure, allowing Defender for Cloud policies and plans (such as Defender for Servers) to be applied consistently across the hybrid estate. Azure Arc is the supported mechanism for extending Azure management and Defender for Cloud coverage to non-Azure servers. Option B is wrong because Azure Automation State Configuration (DSC) enforces configuration state, not Defender for Cloud security policies. Option C is wrong because Microsoft Sentinel is a SIEM/SOAR solution for analytics and detection, not policy assignment. Option D is wrong because Azure Policy guest configuration audits/configures in-guest settings but does not itself onboard servers to Defender for Cloud or apply its security plans.

Answer

Deploy Azure Automation State Configuration (DSC) to all servers.

Answer

Connect all servers to Microsoft Sentinel and use analytics rules.

Answer

Use Azure Policy with guest configuration on all servers.

Question 13

Your organization uses Microsoft Purview to manage data governance. The compliance team needs to be able to search for and investigate whether any sensitive data (e.g., credit card numbers) is stored in Microsoft Teams messages. They also need to place a legal hold on specific user's Teams messages for eDiscovery. You need to design the solution. What should you configure?

Accepted Answer

Use Microsoft Purview eDiscovery (Premium) to create a case, search for credit card numbers in Teams messages, and place a hold on the user's mailbox and Teams data.. Option C is correct because Microsoft Purview eDiscovery (Premium) supports creating a case, running content searches across Microsoft 365 workloads including Teams messages, and placing a legal hold on a user's mailbox and Teams data for investigative and litigation purposes. This directly satisfies both requirements: searching for sensitive data like credit card numbers in Teams messages and preserving specific users' Teams messages. Option A is wrong because sensitivity labels classify and protect content but do not provide search or legal hold capabilities. Option B is wrong because a DLP policy detects and blocks or warns about sensitive data in Teams but does not support eDiscovery search or legal hold. Option D is wrong because Purview Audit only records and searches audit events, not message content, and cannot place holds.

Answer

Configure a sensitivity label for credit card numbers and apply it to Teams messages.

Answer

Create a Data Loss Prevention policy that monitors Teams messages for credit card numbers.

Answer

Enable Microsoft Purview Audit to search the audit log for Teams messages containing credit card numbers.

Question 14

Your organization uses Microsoft Entra ID for identity management and wants to implement a least-privilege access model for administrators. You need to reduce standing privileges and ensure that admin roles are activated only when needed with approval workflow. Requirements: (1) Require approval for activation of Global Administrator role, (2) Set activation duration to 4 hours maximum, (3) Require Azure MFA for activation, (4) Receive notifications when roles are activated, (5) Audit all activations for compliance. Which Microsoft Entra ID capability should you use?

Accepted Answer

Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) is the correct choice because it provides just-in-time role activation with configurable approval workflows, maximum activation duration, MFA enforcement, activation notifications, and audit history for privileged roles like Global Administrator. In PIM, you can set the Global Administrator role as eligible, require approval, cap activation at 4 hours, require Azure MFA, and enable notifications and auditing, which directly satisfies all five requirements. Access Reviews (A) only handles periodic attestation of group or role membership and cannot enforce activation approval, duration, or MFA. Identity Protection (C) detects risky sign-ins and users but does not manage privileged role activation workflows. Conditional Access (D) can enforce MFA and other access controls at sign-in, but it does not provide role activation approval, time-bound activation, or activation audit trails.

Answer

Access Reviews

Answer

Identity Protection

Answer

Conditional Access

Question 15

You are designing a secure hybrid network connectivity solution between an on-premises datacenter and Azure. The requirement is to have encrypted traffic and high availability. Which service should you use?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway (option C) is correct because it establishes encrypted IPsec/IKE site-to-site tunnels between on-premises networks and Azure, and it supports high availability through active-active configurations, multiple gateway instances, and zone-redundant SKUs. This directly satisfies the stated requirements of encrypted traffic and high availability for hybrid connectivity. Azure ExpressRoute (option B) provides private, dedicated connectivity but does not natively encrypt traffic over the circuit, so it does not meet the encryption requirement by itself. Azure Front Door (option A) is a global HTTP/HTTPS application delivery and load-balancing service, not a hybrid network tunnel, and Azure Bastion (option D) provides secure RDP/SSH access to VMs over the Azure portal without exposing public IPs, not site-to-site hybrid connectivity.

Answer

Azure Front Door

Answer

Azure ExpressRoute

Answer

Azure Bastion