SC-100 Practice Test 29 — 15 Questions

Question 1

Refer to the exhibit. You are analyzing an Azure PowerShell script that checks a blob property. The output of the last command returns 'False'. What does this indicate about the blob storage configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Access time tracking is disabled for the storage account.. Access time tracking is disabled for the storage account. In Azure Storage, the blob property that reports whether last-access time tracking is enabled returns False when the account-level setting `LastAccessTimeTrackingPolicy` is not enabled, meaning the service is not recording last access times for blobs. Options A, C, and D are unrelated to this property: diagnostic logging is configured via Azure Monitor diagnostic settings, immutability policies are set through container/blob immutability settings, and server-side encryption is always enabled for Azure Storage blobs and is not reported by this property.

Answer

Diagnostic logging is not configured for the container.

Answer

The blob has an immutability policy applied.

Answer

Server-side encryption is disabled for the blob.

Question 2

Your organization uses Microsoft Entra ID with external identities. You need to design a solution that allows partners to self-service sign up using their existing Azure AD or Microsoft account credentials, while preventing them from accessing other resources. What should you use?

Accepted Answer

Microsoft Entra B2B collaboration. Microsoft Entra B2B collaboration is correct because it lets you invite external partners as guest users who can redeem invitations and sign in with their existing work/school account (Microsoft Entra ID) or Microsoft account, while access is scoped only to the resources you explicitly share. Guest users in B2B are represented in your tenant and governed by Conditional Access and entitlement management, so they cannot access other resources by default. Entra B2C is for customer-facing apps with local or social identities, not partner collaboration in your corporate tenant. Identity Protection provides risk-based sign-in and user risk policies, not partner onboarding. Direct federation with a partner's IdP requires configuring a SAML/WS-Fed trust per partner and does not provide the self-service invitation and redemption model of B2B.

Answer

Microsoft Entra B2C

Answer

Microsoft Entra Identity Protection

Answer

Direct federation with partner's IdP

Question 3

Which TWO Azure services can you use to implement a zero-trust network architecture that verifies identity and device compliance before granting access to on-premises applications? (Choose two.)

Accepted Answer

Microsoft Entra Application Proxy. Microsoft Entra Application Proxy (A) is correct because it publishes on-premises web applications to the cloud and enforces Microsoft Entra ID authentication and Conditional Access before any request is forwarded to the internal app, which directly supports verifying identity and device compliance for on-premises access. Microsoft Entra Conditional Access (B) is correct because it is the policy engine that evaluates signals such as user identity, group membership, and device compliance state (via Intune) and then grants, blocks, or challenges access, which is the core of a zero-trust verification step. Azure VPN Gateway (C) only establishes encrypted network tunnels and does not itself verify user identity or device compliance. Azure Firewall (D) is a network-layer traffic filtering and inspection service, not an identity or device-compliance gate. Azure Bastion (E) provides secure RDP/SSH access to Azure VMs over TLS without exposing public IPs, but it does not publish or broker access to on-premises applications based on identity and device compliance.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Bastion

Question 4

Which TWO Microsoft Purview features can be used to classify and label data in Microsoft 365?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (C) are a Microsoft Purview Information Protection capability that automatically applies sensitivity labels to content by scanning items for sensitive data, so they directly classify and label data in Microsoft 365. Sensitive info types (E) are the pattern-based classifiers (for example, credit card or national ID patterns) that define what sensitive data looks like and are used by auto-labeling and other Purview rules to classify data. Retention policies (A) govern how long content is kept or deleted rather than classifying or labeling it, eDiscovery (B) is used for identifying and collecting content for legal cases, and Audit logs (D) record user and admin activity for investigation and compliance reporting, so none of these three perform classification or labeling.

Answer

Retention policies

Answer

eDiscovery

Answer

Audit logs

Question 5

You are designing a secure access solution for an Azure Kubernetes Service (AKS) cluster that hosts a critical application. You need to ensure that only authorized users can access the Kubernetes API server. Which authentication method should you use?

Accepted Answer

Integrate AKS with Microsoft Entra ID for authentication.. The correct option is D: integrate AKS with Microsoft Entra ID for authentication, because this scenario requires authenticating human users who access the Kubernetes API server, and Entra ID integration provides centralized identity-based authentication with conditional access, MFA, and group-based access. AKS supports Entra ID integration so that kubectl and other clients obtain Entra ID tokens that the API server validates, ensuring only authorized users can authenticate. Option A is not suitable because service account tokens are for workloads and automation inside the cluster, not for authenticating external users. Option B is incorrect because managed identities are Azure resource identities for services, not per-user Kubernetes API authentication. Option C is incorrect because Azure RBAC for Kubernetes authorization controls what an already-authenticated principal can do, not how users are authenticated.

Answer

Use Kubernetes service account tokens.

Answer

Use AKS managed identities for each user.

Answer

Use Azure RBAC for Kubernetes authorization.

Question 6

Refer to the exhibit. You are reviewing an Azure Policy definition. What does this policy accomplish?

Accepted Answer

Denies creation of network security rules that allow traffic to ports other than 22 and 3389. The correct option is D: the policy denies creation of network security rules that allow traffic to ports other than 22 and 3389. Azure Policy definitions with a deny effect evaluate the properties of a resource being deployed—here, the destinationPortRange of a network security rule—and block the deployment when the condition is met, so rules permitting any port outside 22 and 3389 are rejected. Option A is wrong because the policy does not require ports to fall within a range; it blocks rules that allow ports other than the two specified. Option B is wrong because the policy targets NSG rule definitions in Azure Resource Manager, not live inbound traffic flows. Option C is wrong because the policy does not permit or allow traffic; it only denies noncompliant rule creation.

Answer

Requires that all network security rules have destination port range between 22 and 3389

Answer

Denies all inbound traffic except SSH and RDP

Answer

Allows only SSH and RDP inbound traffic

Question 7

You need to design a security operations strategy for a hybrid environment using Microsoft Sentinel. Your environment includes on-premises servers and Azure VMs. Which data connector should you use to collect security events from both sources?

Accepted Answer

Windows Security Events via AMA connector. The Windows Security Events via AMA connector is correct because the Azure Monitor Agent (AMA) can be installed on both on-premises Windows servers (via Azure Arc) and Azure VMs, allowing Windows security events to be collected and ingested into Microsoft Sentinel from both sources. This connector uses Data Collection Rules (DCRs) to define which event sets (e.g., All Events, Common, Minimal) are streamed to the Log Analytics workspace. The Azure Activity log connector only captures Azure control-plane/subscription-level operations, not OS security events from servers. The Office 365 connector ingests audit logs from Microsoft 365 services, and the Syslog connector targets Linux/Unix or network appliances via syslog, not Windows security events.

Answer

Azure Activity log connector

Answer

Office 365 connector

Answer

Syslog connector

Question 8

Your organization uses Microsoft Sentinel for security operations. You need to ensure that all incidents are automatically assigned to the appropriate analyst team based on the type of threat. What should you configure?

Accepted Answer

Configure an automation rule to set the incident owner based on custom conditions.. The correct option is D: configure an automation rule to set the incident owner based on custom conditions. Microsoft Sentinel automation rules are designed to run on incident creation or updates and can assign an owner (analyst or team) using conditions such as the incident's title, severity, tactics, or custom details, which directly matches the requirement to route incidents by threat type. Option A is wrong because a watchlist alone does not assign incidents and would require an unnecessary logic app; watchlists are reference data, not automation triggers. Option B is wrong because analytics rules generate incidents and can add custom details or entity mappings, but they do not assign incident ownership to a team. Option C is wrong because playbooks are Logic Apps triggered by automation rules or analytics rules and are used for response actions, not as the primary mechanism for setting incident owner based on conditions.

Answer

Use a watchlist to map threat types to teams and trigger a logic app.

Answer

Modify the analytics rule to include a custom field for the assigned team.

Answer

Create a playbook that assigns ownership based on incident properties.

Question 9

Refer to the exhibit. A security architect is reviewing an ARM template that deploys an Azure Storage container. They want to ensure the container is not publicly accessible. What is the security implication of this template?

Accepted Answer

The template does not configure network rules, so the container may be accessible from the internet, but only to authenticated users. Option D is correct because the ARM template does not define any network rules (such as a virtual network rule or IP firewall rule) for the storage account, so the storage endpoint remains reachable from the internet; however, since public blob access is not enabled, anonymous access is denied and only authenticated requests with valid credentials or SAS tokens can succeed. This means the container is not publicly accessible in the anonymous sense, but the lack of network restrictions still exposes the endpoint to authenticated access from any network. Option A is wrong because nothing in the template enables anonymous public access to the container. Option B is wrong because versioning is a data-protection feature, not a public-access control, and it is not the security implication being asked about. Option C is wrong because encryption at rest is enabled by default for Azure Storage and is unrelated to whether the container is publicly reachable.

Answer

The container allows public access

Answer

The template creates a container with versioning enabled

Answer

The template enables encryption at rest

Question 10

You are designing a security solution for Azure API Management. The requirements include: protecting APIs from abuse, throttling requests, and validating JSON payloads. Which combination of features should you use?

Accepted Answer

Rate limiting policies, validate-json policy, and OAuth 2.0. API Management natively provides rate limiting and quota policies to throttle requests and protect against abuse, the validate-json policy to validate JSON payloads against a schema, and OAuth 2.0 support to secure API access via authorization servers. These features directly satisfy the stated requirements within the APIM gateway itself. Option A addresses identity and authentication but does not provide throttling or JSON schema validation. Option B offloads protection to Application Gateway WAF, which handles web attack patterns but not APIM-level rate limiting or JSON payload schema validation. Option D provides network-layer filtering with Azure Firewall and NSGs, which cannot inspect JSON payloads or apply API-level throttling.

Answer

Managed Identities and Azure AD authentication

Answer

Azure Web Application Firewall (WAF) on Application Gateway

Answer

Azure Firewall and Network Security Groups

Question 11

A company is deploying a new application that will store sensitive customer data in Azure SQL Database. The security team requires that all data at rest be encrypted using a customer-managed key stored in Azure Key Vault. Additionally, they need to ensure that the database can be restored to a point in time and that the encryption key is rotated every 90 days. Which combination of features should you configure?

Accepted Answer

Enable TDE with customer-managed keys in Azure Key Vault and configure automatic key rotation.. Option D is correct because Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure Key Vault encrypts Azure SQL Database data at rest, and TDE supports point-in-time restore (PITR) via automated backups while allowing automatic key rotation through the Key Vault key rotation policy. Configuring TDE with a CMK satisfies the requirement that the encryption key be customer-managed and rotated every 90 days. Option A is wrong because service-managed keys do not meet the customer-managed key requirement, and Azure Policy cannot itself rotate TDE protector keys. Option B is wrong because Always Encrypted protects data in use and in transit at the client, not data at rest as required, and manual rotation does not meet the 90-day automated rotation need. Option C is wrong because Azure Storage Service Encryption applies to Azure Storage, not Azure SQL Database, and soft delete is a Key Vault data-protection feature, not a database encryption solution.

Answer

Enable TDE with service-managed keys and use Azure Policy to enforce rotation.

Answer

Use Always Encrypted with column master key in Azure Key Vault and manual rotation.

Answer

Use Azure Storage Service Encryption with customer-managed keys and enable soft delete.

Question 12

A company uses Microsoft Defender for Cloud Apps to enforce session policies. The security team needs to block downloads of sensitive files from Microsoft 365 when accessed from unmanaged devices. Which type of policy should they configure?

Accepted Answer

Session policy. Session policy. In Microsoft Defender for Cloud Apps, session policies are used with Conditional Access App Control to monitor and control user sessions in real time, including blocking downloads of sensitive files from Microsoft 365 when accessed from unmanaged devices. This is the specific policy type designed for session-based enforcement, such as blocking downloads, uploads, or copy/paste actions during an active session. A file policy (A) applies to files in connected cloud apps for governance and alerting but does not control live session actions like downloads from unmanaged devices. A DLP policy in Microsoft 365 (B) enforces data protection within Microsoft 365 workloads but does not provide the same session proxy-based control for unmanaged device access. An access policy (D) in Defender for Cloud Apps is used to allow or block app access based on conditions, not to block downloads within an active session.

Answer

File policy

Answer

Data Loss Prevention (DLP) policy in Microsoft 365

Answer

Access policy

Question 13

A company uses Microsoft Defender for Cloud to protect their hybrid environment. They have on-premises servers that are monitored by Microsoft Defender for Servers. The security team notices that some servers are missing critical security updates. They want to automatically remediate missing updates on these servers. Which feature should they enable?

Accepted Answer

Azure Update Manager. Azure Update Manager (option C) is the correct choice because it is the native Azure service designed to assess and automatically remediate missing OS security updates across Azure, on-premises, and multicloud servers, including those onboarded to Microsoft Defender for Servers. It provides update assessment, scheduling, and automatic patching for Windows and Linux machines, which directly addresses the team's need to remediate missing updates on their hybrid servers. Adaptive Application Controls (option A) only create allowlist/denylist rules for applications to control execution and do not patch operating systems. Azure Automation Update Management (option B) is the legacy predecessor that has been superseded by Azure Update Manager, so it is not the recommended feature. Just-in-Time VM access (option D) only restricts inbound management ports on VMs and has nothing to do with update remediation.

Answer

Adaptive Application Controls

Answer

Azure Automation Update Management

Answer

Just-in-Time (JIT) VM access

Question 14

Refer to the exhibit. You are auditing an Azure subscription. The Azure Policy assignment above is targeting a resource group. The policy definition ID corresponds to a built-in policy that audits if SQL databases have transparent data encryption (TDE) enabled. What is the effect of this policy assignment?

Accepted Answer

The policy audits SQL databases for TDE and marks non-compliant resources.. Option D is correct because the built-in policy definition audits whether SQL databases have transparent data encryption (TDE) enabled, and an audit-effect policy evaluates resources and flags non-compliant ones in the compliance report without blocking or modifying them. Since the assignment targets a resource group, it evaluates the SQL databases within that scope and marks those lacking TDE as non-compliant. Option A is wrong because audit policies do not remediate or enable TDE; that would require a DeployIfNotExists or Modify effect. Option B is incorrect because 'audit' is the effect, not merely a reporting mode, and the policy still evaluates and flags resources. Option C is wrong because the assignment targets a resource group, not a management group, so its scope is limited to that resource group.

Answer

The policy automatically enables TDE on non-compliant SQL databases.

Answer

The policy is only reported as audit, not enforced.

Answer

The policy applies to all resources in the management group.

Question 15

Your organization uses Microsoft 365 and wants to prevent users from sharing sensitive documents externally via email. The solution must be able to detect credit card numbers and automatically block the email. Which technology should you use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online. Microsoft Purview Data Loss Prevention (DLP) policy for Exchange Online is the correct choice because DLP is purpose-built to inspect email content in transit and detect sensitive information types such as credit card numbers, then automatically block or restrict the message per policy actions. It natively integrates with Exchange Online so detection and blocking happen at the mail-flow level without user intervention. Sensitivity labels with auto-classification apply classification and protection to content but do not themselves block an email from being sent externally based on credit card detection. Safe Attachments focuses on malware detonation in attachments, not on detecting sensitive data patterns, and the AIP unified labeling client is a client-side labeling tool rather than a server-side email blocking control.

Answer

Microsoft Purview Sensitivity labels with auto-classification

Answer

Microsoft Defender for Office 365 Safe Attachments

Answer

Azure Information Protection (AIP) unified labeling client