SC-100 Practice Test 27 — 15 Questions

Question 1

Your organization is a small business with 200 users using Microsoft 365 Business Premium. You need to secure user identities against common attacks like phishing and password spray. The solution must be easy to deploy and manage with minimal overhead. Requirements: (1) Enable multi-factor authentication (MFA) for all users, (2) Block legacy authentication protocols, (3) Detect and block risky sign-ins, (4) Provide security recommendations to users, (5) Integrate with Microsoft Defender for Office 365 for email protection. Which Microsoft security service should you primarily use?

Accepted Answer

Microsoft Entra ID P1 with Conditional Access and Identity Protection. Option B is correct because Microsoft Entra ID P1 (included in Business Premium) provides Conditional Access for MFA and blocking legacy authentication, Identity Protection for risky sign-ins, and security defaults for easy deployment. Option A is wrong because Entra ID P2 is overkill for small business. Option C is wrong because Microsoft Defender for Cloud is for cloud workloads. Option D is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Purview Insider Risk Management

Answer

Microsoft Entra ID P2

Answer

Microsoft Defender for Cloud

Question 2

Your organization is designing a Zero Trust architecture using Microsoft 365 security features. You need to ensure that all access requests are verified and least-privilege principles are applied. Which TWO capabilities should you implement?

Accepted Answer

Privileged Identity Management (PIM). Option B and Option D are correct. Conditional Access verifies access requests based on conditions, and Privileged Identity Management (PIM) provides just-in-time access for least privilege. Option A is wrong because Microsoft Entra ID is the identity provider, not a specific verification mechanism. Option C is wrong because Microsoft Defender for Cloud Apps is a CASB, not primarily for identity verification. Option E is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Entra ID

Answer

Microsoft Purview

Question 3

Which TWO actions should you take to secure Azure SQL Database against SQL injection attacks?

Accepted Answer

Enable Azure Web Application Firewall (WAF) on Application Gateway. Using parameterized queries in stored procedures prevents SQL injection by separating SQL code from data. Enabling Azure WAF on Application Gateway filters malicious requests at the network edge. Row-Level Security is for access control, not injection. Always Encrypted protects data at rest. Dynamic Data Masking obfuscates data.

Answer

Implement Always Encrypted

Answer

Enable Row-Level Security (RLS)

Answer

Apply Dynamic Data Masking

Question 4

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts from compromised on-premises servers to Azure VMs. Which data connector should you prioritize?

Accepted Answer

Windows Security Events via AMA. Option B is correct because the Windows Security Events via AMA connector provides the necessary event IDs (e.g., 4624, 4625) for lateral movement detection on Azure VMs. Option A is wrong because Azure Activity Log does not capture OS-level events. Option C is wrong because Syslog via AMA covers Linux but not Windows. Option D is wrong because Office 365 connector is for cloud app activity.

Answer

Syslog via AMA

Answer

Office 365 Logs

Answer

Azure Activity Log

Question 5

A company plans to use Microsoft Defender for Cloud to secure a multi-cloud environment including Azure, AWS, and GCP. What is the first step to enable multi-cloud visibility?

Accepted Answer

Connect AWS and GCP accounts using the cloud connectors in Defender for Cloud. Option C is correct because you must first onboard the AWS/GCP accounts into Defender for Cloud by connecting them via the native cloud connectors. Option A is wrong because deploying Azure Arc agents is for on-premises servers, not cloud accounts. Option B is wrong because enabling Defender plans is done after onboarding. Option D is wrong because custom policies are optional.

Answer

Enable all Defender plans for subscription

Answer

Create custom compliance policies

Answer

Deploy Azure Arc agents on all cloud VMs

Question 6

You are designing a secure DevOps pipeline using GitHub Advanced Security and Microsoft Defender for Cloud. The development team uses a mix of Python and JavaScript. Which tool should you integrate to detect secrets (e.g., API keys) committed to the repository?

Accepted Answer

GitHub secret scanning. Option A is correct because GitHub secret scanning automatically detects secrets in repositories. Option B is wrong because Dependabot focuses on dependency vulnerabilities. Option C is wrong because CodeQL analyzes code for security vulnerabilities, not secrets. Option D is wrong because Defender for Cloud’s DevOps security posture management does not replace secret scanning.

Answer

CodeQL code scanning

Answer

Dependabot alerts

Answer

Defender for Cloud DevOps security posture management

Question 7

Which TWO actions should you take to improve the security posture of an Azure subscription using Microsoft Defender for Cloud? (Select two.)

Accepted Answer

Enable Azure Defender plans for all supported resource types. Options A and B are correct because enabling Defender plans and implementing recommendations improve security. Option C is wrong because Defender for Cloud already provides recommendations. Option D is wrong because vulnerability assessment for VMs is a feature, not a specific action. Option E is wrong because assigning Azure Policy is a method, but the most direct actions are enabling plans and implementing recommendations.

Answer

Assign Azure Policy to enforce resource compliance

Answer

Create custom security policies

Answer

Deploy vulnerability assessment solution to all VMs

Question 8

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy accomplish?

Accepted Answer

Denies creation of network security rules that allow traffic to ports other than 22 and 3389. Option C is correct because the policy denies security rules that allow ports other than 22 (SSH) and 3389 (RDP) as destination ports. Option A is wrong because it allows only specific ports. Option B is wrong because it allows those ports. Option D is wrong because it doesn't enforce a specific range.

Answer

Requires that all network security rules have destination port range between 22 and 3389

Answer

Denies all inbound traffic except SSH and RDP

Answer

Allows only SSH and RDP inbound traffic

Question 9

Refer to the exhibit. You need to ensure that the storage account 'seccorpstorage' is only accessible from a specific Azure virtual network. What should you do?

Accepted Answer

Add a virtual network rule for the specific VNet. Option B is correct because you need to add a virtual network rule to allow traffic from the VNet. The current configuration has no rules, so all traffic is denied. Option A is wrong because the storage account already has public network access disabled. Option C is wrong because enabling firewall and adding IP rules would allow specific IPs, not a VNet. Option D is wrong because adding a service endpoint alone is incomplete without the rule.

Answer

Enable the service endpoint for Microsoft.Storage on the VNet subnet

Answer

Enable firewall and add an IP rule for the VNet's public IP

Answer

Enable public network access and add a firewall rule

Question 10

You need to design a solution to protect Azure VMs from malware and vulnerabilities. Which Microsoft service should you use?

Accepted Answer

Microsoft Defender for Cloud. Option C is correct because Microsoft Defender for Cloud provides threat detection, vulnerability assessment, and antimalware for VMs. Option A is wrong because Microsoft Sentinel is a SIEM. Option B is wrong because Microsoft Intune is for device management. Option D is wrong because Microsoft Purview is for data governance.

Answer

Microsoft Purview

Answer

Microsoft Sentinel

Answer

Microsoft Intune

Question 11

Refer to the exhibit. You are deploying an ARM template for a network security group. What is the security implication of this configuration?

Accepted Answer

The rule allows inbound HTTPS traffic from any Internet source to the subnet, which may be overly permissive. Option C is correct because the rule allows HTTPS from the Internet to the subnet 10.0.1.0/24, making the frontend accessible from anywhere, which is a security risk if not intended. Option A is wrong because the rule does allow Internet traffic. Option B is wrong because the rule is inbound, not outbound. Option D is wrong because the rule allows traffic on port 443.

Answer

The rule only allows traffic on port 443 from a specific IP range

Answer

The rule allows outbound traffic from the subnet to the Internet

Answer

The rule blocks all inbound traffic from the Internet

Question 12

Your organization uses Microsoft Intune to manage Windows 10 devices. You need to ensure that only approved applications can run on corporate devices. Which Intune feature should you configure?

Accepted Answer

AppLocker. Option B is correct because AppLocker allows you to create policies to control which apps can run. Option A is wrong because Windows Defender Firewall controls network traffic. Option C is wrong because BitLocker encrypts drives. Option D is wrong because Windows Information Protection prevents data leaks.

Answer

Windows Defender Firewall

Answer

BitLocker

Answer

Windows Information Protection

Question 13

A multinational corporation uses Microsoft Entra ID with hybrid identities. They need to design a solution that automatically remediates risky sign-ins without user intervention. Which feature should you enable?

Accepted Answer

Identity Protection with Conditional Access policies. Option B is correct because Entra ID Identity Protection with conditional access policies can block or require MFA automatically based on risk. Option A is wrong because PIM is for privileged identity management, not risk-based remediation. Option C is wrong because Entra ID Governance is for access reviews and entitlement management. Option D is wrong because Microsoft Defender for Identity is for on-premises identity protection, not automatic remediation.

Answer

Entra ID Governance (Access Reviews)

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Defender for Identity

Question 14

Your organization uses Microsoft Sentinel and Microsoft Defender XDR. You need to design a solution that automatically creates an incident in Sentinel when a Defender XDR alert fires. Which integration should you configure?

Accepted Answer

Microsoft Defender XDR data connector in Sentinel. Option C is correct because the Microsoft Defender XDR connector in Sentinel allows alert streaming and incident creation. Option A is wrong because Microsoft Power Automate can be used but is not the primary integration. Option B is wrong because Logic Apps can automate but the connector is the standard method. Option D is wrong because Microsoft Graph API is programmatic but not the designed integration.

Answer

Azure Logic Apps with Defender XDR connector

Answer

Microsoft Power Automate flow triggered by Defender XDR alerts

Answer

Microsoft Graph API subscription to Defender XDR alerts

Question 15

Your organization is designing a secure network infrastructure for a multi-cloud environment that includes Azure, AWS, and on-premises datacenters. The security team requires that all traffic between these environments be inspected for threats and that any malicious traffic be automatically blocked. The solution must minimize complexity and use a single pane of glass for policy management. Which Azure service should you use as the central hub?

Accepted Answer

Azure Firewall. Option B is correct because Azure Firewall can be deployed as a central hub in a hub-and-spoke topology, providing network-level traffic inspection for Azure, on-premises (via ExpressRoute or VPN), and even AWS (via VPN or Azure Virtual WAN). It offers integrated threat intelligence and supports routing policies. Option A is wrong because Azure DDoS Protection only mitigates volumetric attacks, not traffic inspection. Option C is wrong because Network Security Groups (NSGs) provide basic filtering but lack advanced inspection and multi-cloud support. Option D is wrong because Azure Front Door is a global load balancer and web application firewall, not a network firewall for multi-cloud traffic.

Answer

Azure Front Door

Answer

Network Security Groups (NSGs)

Answer

Azure DDoS Protection