SC-100 Practice Test 28 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an ARM template that deploys a storage account. The compliance team requires that all storage accounts use TLS 1.2 or higher. Does this template meet the requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Yes, because minimumTlsVersion is set to TLS1_2.. The template meets the requirement because the storage account resource explicitly sets the minimumTlsVersion property to TLS1_2, which enforces TLS 1.2 as the minimum accepted version for all connections. This is the exact ARM property Microsoft.Storage/storageAccounts exposes for controlling the minimum TLS version, and TLS1_2 satisfies the compliance team's 'TLS 1.2 or higher' rule. Option A is wrong because the SKU Standard_GRS controls replication and redundancy, not the TLS version. Option C is wrong because supportsHttpsTrafficOnly is a separate setting that only redirects/rejects HTTP traffic; it does not by itself set the minimum TLS version, and the template already sets minimumTlsVersion. Option D is wrong because the apiVersion does support the minimumTlsVersion property, so the setting is valid.

Answer

Yes, because Standard_GRS automatically enforces TLS 1.2.

Answer

No, because supportsHttpsTrafficOnly only allows HTTPS but does not enforce TLS 1.2.

Answer

No, because the apiVersion is outdated and does not support TLS setting.

Question 2

You are designing a zero-trust network architecture for a hybrid environment using Azure Virtual WAN. You need to secure all traffic between on-premises sites and Azure virtual networks using Microsoft's security services. The solution should include next-generation firewall capabilities and TLS inspection. What should you deploy?

Accepted Answer

Deploy Azure Firewall Premium as the secured hub in Virtual WAN.. Azure Firewall Premium is the correct choice because it is the only Azure Firewall SKU that provides next-generation firewall capabilities such as TLS inspection, IDPS, and URL filtering, and it can be deployed directly as the secured hub in Azure Virtual WAN to protect all on-premises-to-Azure and inter-hub traffic. Azure Firewall Standard lacks TLS inspection and IDPS, so it cannot meet the stated requirement. A third-party NVA in a spoke virtual network would require custom routing and does not natively integrate as the Virtual WAN secured hub, adding complexity and not using Microsoft's security services as requested. Application Gateway with WAF is a Layer 7 web traffic load balancer for HTTP/HTTPS applications, not a network firewall for securing all hybrid traffic.

Answer

Deploy a third-party NVA in a spoke virtual network and route traffic through it.

Answer

Deploy Azure Firewall Standard as the secured hub in Virtual WAN.

Answer

Deploy Azure Application Gateway with WAF in each virtual network.

Question 3

A multinational corporation uses Microsoft Entra ID with hybrid identities. They need to design a solution that automatically remediates risky sign-ins without user intervention. Which feature should you enable?

Accepted Answer

Identity Protection with Conditional Access policies. The correct option is D: Identity Protection with Conditional Access policies, because Entra ID Identity Protection detects risky sign-ins and risk detections, and Conditional Access can automatically enforce remediation actions such as requiring MFA, blocking access, or forcing password reset without user intervention. This directly addresses the requirement for automatic remediation of risky sign-ins in a hybrid identity environment. Option A, Entra ID Governance Access Reviews, is for periodic attestation of access rights, not sign-in risk remediation. Option B, Privileged Identity Management, manages just-in-time privileged role activation and approvals, not risky sign-in response. Option C, Microsoft Defender for Identity, detects identity threats on-premises but does not itself automatically remediate Entra ID sign-in risk through Conditional Access.

Answer

Entra ID Governance (Access Reviews)

Answer

Privileged Identity Management (PIM)

Answer

Microsoft Defender for Identity

Question 4

A company is implementing a Zero Trust security model using Microsoft 365 Defender. Which THREE of the following are key principles they should follow?

Accepted Answer

Use least privilege access by limiting user permissions with Just-In-Time and Just-Enough-Access.. Option B is correct because Zero Trust requires least privilege access, and Microsoft recommends Just-In-Time (JIT) and Just-Enough-Access (JEA) with Privileged Identity Management (PIM) to grant permissions only when needed and only for the required scope. Option D is correct because the 'assume breach' principle means designing as if attackers are already present, using micro-segmentation, network segmentation, and conditional access to limit lateral movement and reduce blast radius. Option E is correct because 'verify explicitly' is the foundational Zero Trust principle: every access request must be authenticated and authorized using all available signals such as user identity, device compliance, location, and risk level via Conditional Access and Microsoft 365 Defender signals. Option A is incorrect because trusting all traffic from the corporate network is the traditional perimeter-based model that Zero Trust explicitly rejects; internal networks are not inherently trusted. Option C is incorrect because implicit trust for known users or devices contradicts Zero Trust, which requires continuous verification rather than granting trust based on prior knowledge or network location.

Answer

Trust all traffic originating from within the corporate network.

Answer

Provide implicit trust to known users and devices.

Question 5

Your organization uses Microsoft Purview. You need to design a solution that automatically detects and classifies sensitive data such as passport numbers stored in Microsoft OneDrive. The solution should apply a 'Highly Confidential' sensitivity label without user intervention. What should you configure?

Accepted Answer

Create an auto-labeling policy in Microsoft Purview that targets OneDrive and includes the 'Passport Number' sensitive info type.. Option A is correct because an auto-labeling policy in Microsoft Purview is the feature designed to automatically detect sensitive information types (such as 'Passport Number') in locations like OneDrive and apply a sensitivity label like 'Highly Confidential' without user intervention. Auto-labeling policies use the sensitive info type as a condition and can apply the label directly to matching content. Option B is incorrect because a DLP policy blocks or restricts sharing; it does not apply sensitivity labels. Option C is incorrect because auditing only records activity and does not classify or label data. Option D is incorrect because manual labeling requires user action, which contradicts the no-user-intervention requirement.

Answer

Create a Data Loss Prevention (DLP) policy that blocks sharing of files with passport numbers.

Answer

Enable auditing in Microsoft Purview to track where passport numbers are stored.

Answer

Configure a manual sensitivity label and train users to apply it.

Question 6

You are designing a secure access solution for an on-premises application that uses legacy authentication protocols. The organization plans to migrate to Microsoft Entra ID but the application vendor has not yet provided a modern authentication update. The solution must enable single sign-on (SSO) and support multifactor authentication (MFA) for this application without modifying the application code. Which approach should you recommend?

Accepted Answer

Deploy Microsoft Entra Application Proxy with pre-authentication. Microsoft Entra Application Proxy with pre-authentication (option D) is correct because it publishes the on-premises legacy application externally while enforcing Microsoft Entra ID authentication and MFA at the proxy before traffic reaches the app, enabling SSO without changing application code. Pre-authentication means users authenticate against Microsoft Entra ID first, so legacy protocols inside the app are shielded and MFA/Conditional Access can be applied. MSAL (A) requires modifying the application to use modern auth libraries, which the vendor has not provided. Federating on-premises AD with Entra ID (B) only enables identity synchronization/federation and does not by itself provide SSO or MFA for a legacy on-premises app. Conditional Access policies (C) require the app to already authenticate with Entra ID and cannot protect an app that still uses legacy authentication directly.

Answer

Integrate the application with the Microsoft Authentication Library (MSAL)

Answer

Federate the on-premises Active Directory with Microsoft Entra ID

Answer

Use Microsoft Entra Conditional Access policies to require MFA

Question 7

You are designing a secure access solution for on-premises applications using Microsoft Entra ID. The solution must support modern authentication, single sign-on (SSO), and Conditional Access. Which TWO technologies should you implement?

Accepted Answer

Microsoft Entra application proxy. Microsoft Entra application proxy (C) is correct because it publishes on-premises web applications to the internet and enforces Microsoft Entra ID pre-authentication, which enables modern authentication, SSO, and Conditional Access for those apps without opening inbound firewall ports. Microsoft Entra ID as the identity provider (D) is correct because it is the cloud identity service that issues tokens, performs authentication, and evaluates Conditional Access policies for the published applications. Together, application proxy and Entra ID as the IdP provide the required modern authentication, SSO, and Conditional Access for on-premises apps. Azure AD B2C (A) is for customer-facing identity scenarios with local or social accounts, not for securing internal on-premises enterprise applications. Microsoft Entra Domain Services (B) provides managed domain services such as domain join and Group Policy, but it does not by itself publish on-premises apps or deliver the required modern auth/SSO/Conditional Access. Site-to-Site VPN (E) only provides network connectivity and does not deliver identity-based authentication, SSO, or Conditional Access.

Answer

Azure AD B2C

Answer

Microsoft Entra Domain Services

Answer

Site-to-Site VPN

Question 8

A software company, Northwind, is developing a mobile app that uses Microsoft Entra ID for authentication. The app accesses an Azure Function App backend that stores data in Azure Cosmos DB. The company wants to implement a defense-in-depth security strategy. Which TWO of the following should you implement?

Accepted Answer

Use OAuth 2.0 with Microsoft Entra ID to secure the Azure Functions.. Option A is correct because using OAuth 2.0 with Microsoft Entra ID lets the Azure Functions validate the bearer tokens issued to the mobile app, providing strong, identity-based authentication and enabling fine-grained authorization through app roles or scopes in a defense-in-depth model. Option C is correct because configuring Azure Cosmos DB with a private endpoint (via Azure Private Link) removes the database from the public internet and restricts traffic to the virtual network, adding a network-layer control that complements the identity-layer protection. Option B is not appropriate because IP whitelisting is brittle for a mobile app whose users connect from many dynamic addresses and does not authenticate the caller. Option D is weaker than A because function-level authorization keys are shared secrets that are hard to rotate and do not provide user identity or scoped permissions. Option E is incorrect because TLS 1.0 is deprecated and insecure; TLS 1.2 or higher should be enforced.

Answer

Restrict access to the Azure Functions by IP whitelisting.

Answer

Use function-level authorization keys for the Azure Functions.

Answer

Enforce TLS 1.0 for all API calls.

Question 9

A company uses Microsoft Defender for Identity (MDI) to monitor on-premises Active Directory. They want to integrate MDI alerts into Microsoft Sentinel. Which data connector should they use?

Accepted Answer

Microsoft Defender for Identity connector. The Microsoft Defender for Identity connector is the correct choice because it is the purpose-built Microsoft Sentinel data connector that ingests MDI alerts and related entity data directly from the MDI service into the Sentinel workspace, enabling built-in analytics rules and incident creation. The Syslog connector is for forwarding syslog/CEF events from Linux or network devices, not for MDI's native alert stream. The Microsoft Entra ID connector ingests Microsoft Entra ID sign-in and audit logs, not on-premises AD threat alerts from MDI. Windows Security Events via AMA collects Windows event logs from servers, which does not include MDI's correlated identity alerts.

Answer

Syslog connector

Answer

Azure Active Directory connector

Answer

Windows Security Events via AMA

Question 10

Refer to the exhibit. You are reviewing a Bicep template for deploying an Azure SQL Database server. Which security best practice is violated?

Accepted Answer

Administrator password is hardcoded in plain text.. The administrator password is hardcoded in plain text, which violates the security best practice of never embedding secrets directly in infrastructure-as-code templates. Hardcoded credentials in a Bicep file can be exposed through source control, deployment history, or template exports, so the password should instead be supplied via a secure parameter using Key Vault or a secure string parameter. Option A is not a violation because TLS 1.2 is the minimum acceptable version for Azure SQL Database. Option C is not a violation because disabling public network access is actually a recommended security hardening measure, typically paired with private endpoints. Option D is a weaker recommendation rather than the clear violation shown, since Microsoft Entra ID authentication is encouraged but the exposed plaintext password is the definitive security flaw.

Answer

Minimal TLS version is set to 1.2, which is acceptable.

Answer

Public network access is disabled, which may affect connectivity.

Answer

Azure AD authentication is not configured.

Question 11

Your company is planning to use Microsoft Intune for mobile device management (MDM). You need to ensure that devices are compliant before accessing corporate resources. Which TWO components should you configure?

Accepted Answer

Conditional Access policies in Microsoft Entra ID.. Compliance policies (D) are the correct component because they define the rules a device must meet—such as requiring a PIN, encryption, or a minimum OS version—and Intune uses them to mark devices as compliant or non-compliant, which is the prerequisite for gating access to corporate resources. Conditional Access policies in Microsoft Entra ID (C) are also correct because they enforce the actual access decision, using signals like device compliance status to grant, block, or require additional controls (for example, MFA) before a device can reach corporate resources. Together, compliance policies evaluate the device and Conditional Access enforces that evaluation at sign-in. Device configuration policies (A) only push settings to devices but do not by themselves determine compliance, enrollment restrictions (B) merely limit which devices or platforms can enroll, and app protection policies (E) protect app-level data on mobile apps without establishing device compliance for resource access.

Answer

Device configuration policies.

Answer

Enrollment restrictions.

Answer

App protection policies.

Question 12

Your organization is designing a secure network infrastructure for a multi-cloud environment that includes Azure, AWS, and on-premises datacenters. The security team requires that all traffic between these environments be inspected for threats and that any malicious traffic be automatically blocked. The solution must minimize complexity and use a single pane of glass for policy management. Which Azure service should you use as the central hub?

Accepted Answer

Azure Firewall. Azure Firewall (option D) is the correct choice because it provides a centralized, cloud-native firewall service that can inspect and filter traffic across Azure, AWS, and on-premises connections through a hub-and-spoke or Virtual WAN topology, with a single management plane via Azure Firewall Manager for policy and threat intelligence-based blocking. It supports FQDN filtering, threat intelligence, and IDPS, making it suitable for multi-cloud traffic inspection and automatic malicious traffic blocking while minimizing complexity. Azure Front Door (A) is a global HTTP/HTTPS load balancer and WAF for web applications, not a general network traffic inspection hub for multi-cloud and on-premises traffic. Network Security Groups (B) are stateful packet filters at the subnet/NIC level with no central management pane or advanced threat inspection. Azure DDoS Protection (C) only mitigates volumetric DDoS attacks against Azure resources and does not inspect or block general malicious traffic across hybrid and multi-cloud environments.

Answer

Azure Front Door

Answer

Network Security Groups (NSGs)

Answer

Azure DDoS Protection

Question 13

Your company plans to use Microsoft Sentinel to detect threats across multiple Azure subscriptions. You need to design a cost-effective solution that ingests logs from all subscriptions. What should you use?

Accepted Answer

Deploy a single Sentinel workspace and configure data collection rules to collect logs from all subscriptions. Microsoft Sentinel is built on a Log Analytics workspace, and a single workspace can ingest data from multiple Azure subscriptions via data collection rules (DCRs) and diagnostic settings, avoiding duplicated workspace and Sentinel costs. This centralized design is the most cost-effective since Sentinel pricing (ingestion and retention) applies per workspace, so consolidating into one workspace prevents paying for multiple Sentinel instances. Azure Lighthouse (A) is for delegated resource management across tenants, not for log ingestion into Sentinel. Creating a separate workspace per subscription (C) multiplies Sentinel and Log Analytics costs and fragments detection. Azure Policy (D) can assign a workspace via DeployIfNotExists, but assigning a workspace per subscription still results in multiple workspaces rather than the single cost-effective workspace the scenario requires.

Answer

Use Azure Lighthouse to manage cross-subscription connectivity

Answer

Create a separate Sentinel workspace for each subscription

Answer

Use Azure Policy to assign a Log Analytics workspace to each subscription

Question 14

Your organization uses Microsoft Purview Information Protection to classify and protect sensitive data. The compliance team wants to automatically apply a 'Highly Confidential' sensitivity label to emails that contain credit card numbers. Which solution should you configure?

Accepted Answer

Microsoft Purview auto-labeling policy. The correct option is A, Microsoft Purview auto-labeling policy, because auto-labeling policies are the native Purview Information Protection mechanism that scans content for sensitive information types (such as credit card numbers) and automatically applies a specified sensitivity label like 'Highly Confidential' to emails and files. This directly matches the requirement to classify and protect data at the label level, since sensitivity labels can also enforce encryption and other protection settings. Option B, Safe Attachments, is a Defender for Office 365 threat-detection feature that sandboxes attachments and does not apply sensitivity labels. Option C, a DLP policy, can detect credit card numbers and block or warn on sharing, but it enforces DLP rules rather than automatically applying a sensitivity label. Option D, Microsoft Endpoint DLP, extends DLP controls to endpoint devices and likewise does not apply sensitivity labels to email.

Answer

Microsoft Defender for Office 365 Safe Attachments policy

Answer

Microsoft 365 Data Loss Prevention (DLP) policy

Answer

Microsoft Endpoint DLP

Question 15

Your company uses Microsoft Purview Compliance Manager to track compliance with regulatory standards. You need to generate a report that shows the percentage of controls that are not yet implemented for the PCI DSS standard. What should you do?

Accepted Answer

In Compliance Manager, open the PCI DSS assessment and view the control status.. The correct option is A: in Compliance Manager, open the PCI DSS assessment and view the control status, because Compliance Manager assessments include a controls view that shows each control's implementation status and progress percentages for the specific standard, which directly provides the percentage of controls not yet implemented. This is the built-in reporting surface for tracking regulatory compliance progress against PCI DSS. Option B is incorrect because Data Lifecycle Management policies govern retention and deletion of content, not compliance control reporting. Option C is incorrect because custom risk assessments are for assessing risks, not for reporting control implementation percentages for a regulatory standard. Option D is incorrect because Communication Compliance policies detect policy violations in communications, not PCI DSS control implementation status.

Answer

Create a Data Lifecycle Management policy for PCI DSS.

Answer

Create a custom risk assessment in Compliance Manager for PCI DSS.

Answer

Configure a Communication Compliance policy to monitor PCI DSS compliance.