SC-100 Practice Test 30 — 15 Questions

Question 1

Your organization has a Microsoft 365 E5 subscription and uses Microsoft Entra ID for identity. You need to implement a solution to secure privileged access to Azure resources, requiring just-in-time access and approval workflows. What should you configure?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM). Option A is correct because Microsoft Entra Privileged Identity Management (PIM) provides just-in-time access and approval workflows for Azure roles. Option B is wrong because Conditional Access controls access based on conditions, not just-in-time role activation. Option C is wrong because Azure AD (now Entra ID) roles are managed by PIM. Option D is wrong because Microsoft Defender for Identity identifies threats to on-premises Active Directory.

Answer

Microsoft Defender for Identity

Answer

Azure AD administrative units

Answer

Microsoft Entra Conditional Access

Question 2

Refer to the exhibit. A KQL query in Microsoft Sentinel is used to detect potential brute-force attacks. What does this query detect?

Accepted Answer

Successful remote logon attempts from a single IP exceeding 10. Option B is correct: The query filters for successful logon events (4624) with LogonType 10 (remote interactive), then summarizes by account and IP address, and filters for more than 10 attempts. This detects potential brute-force attacks. Option A is wrong because it looks for successful logons, not failures. Option C is wrong because it looks for remote logons (type 10). Option D is wrong because it looks for successful logons, not failures.

Answer

Local logon attempts from multiple accounts

Answer

Failed logon attempts from multiple IPs

Answer

Failed logon attempts from a single IP

Question 3

Your organization uses Microsoft Sentinel to monitor hybrid workloads. You need to design a solution to detect lateral movement attempts using pass-the-hash attacks. Which data source should you prioritize for ingestion?

Accepted Answer

Windows Security Events (Event ID 4624). Option B is correct because Windows Security Event ID 4624 (successful logon) with LogonType 3 (network) and hashed credentials is key for detecting pass-the-hash. Option A is wrong because Azure Activity Logs record control plane events, not authentication details. Option C is wrong because Sysmon Event ID 1 is process creation, not authentication. Option D is wrong because DNS logs may show network connections but not credential theft.

Answer

Sysmon Event ID 1 (Process creation)

Answer

DNS Query Logs

Answer

Azure Activity Logs

Question 4

Which THREE components are required to implement a Zero Trust network architecture using Microsoft Entra Internet Access (formerly Microsoft 365 Network Connectivity)?

Accepted Answer

Conditional Access policies. Options A, B, and D are correct because Entra Internet Access, Conditional Access, and Intune compliance are core Zero Trust components. Option C is wrong because VPN is traditional perimeter security. Option E is wrong because Azure AD Application Proxy (now Entra Application Proxy) is for legacy app publishing.

Answer

Azure AD Application Proxy

Answer

Site-to-site VPN

Question 5

Which TWO Azure services can you use to implement a zero-trust network architecture that verifies identity and device compliance before granting access to on-premises applications? (Choose two.)

Accepted Answer

Microsoft Entra Application Proxy. Option A is correct because Microsoft Entra Application Proxy provides pre-authentication and conditional access for on-premises apps. Option C is correct because Microsoft Entra ID Conditional Access evaluates user identity and device compliance before granting access. Option B is wrong because Azure Bastion provides secure RDP/SSH access to VMs, not to applications. Option D is wrong because Azure Firewall is a network firewall, not an identity-aware access control. Option E is wrong because VPN Gateway provides network-level connectivity without identity verification.

Answer

Azure VPN Gateway

Answer

Azure Firewall

Answer

Azure Bastion

Question 6

You need to secure Azure Kubernetes Service (AKS) clusters by ensuring that only approved container images from a private Azure Container Registry (ACR) can be deployed. The solution should enforce this at admission time. Which Azure Policy effect should you use?

Accepted Answer

enforceRegoPolicy. The 'enforceRegoPolicy' effect for Azure Policy on AKS uses Open Policy Agent (OPA) Gatekeeper to enforce that only images from specific registries are allowed. 'audit' only logs, 'deny' is not directly applicable for AKS admission, 'modify' changes resources but does not block.

Answer

modify

Answer

audit

Answer

deny

Question 7

A company uses Azure Firewall to protect their virtual network. They need to allow outbound HTTPS traffic to a specific external website while blocking all other outbound traffic. What should they configure?

Accepted Answer

Add an Application Rule with the destination FQDN of the website.. Option A is correct because Application Rules filter outbound traffic based on FQDN (e.g., *.contoso.com). Option B is wrong because Network Rules filter based on IP addresses/ports, not FQDNs. Option C is wrong because DNAT rules are for inbound traffic. Option D is wrong because Threat Intelligence rules block known malicious IPs/FQDNs, not allow specific ones.

Answer

Add a Network Rule with the destination IP address and port 443.

Answer

Add a Threat Intelligence rule to allow the website's domain.

Answer

Add a DNAT Rule to translate the traffic to the website's IP.

Question 8

Which THREE components are required to implement a secure Azure DevOps CI/CD pipeline that scans for secrets in code? (Choose three.)

Accepted Answer

GitHub Advanced Security for secret scanning.. Option B is correct because GitHub Advanced Security includes secret scanning for code repositories. Option C is correct because Azure Key Vault can store secrets accessed during pipeline execution. Option D is correct because Credential Scanner is a Microsoft security tool that is integrated into Azure DevOps for scanning secrets. Option A is wrong because Azure Artifacts is a package management solution. Option E is wrong because Azure Boards is for work item tracking.

Answer

Azure Artifacts to store packages.

Answer

Azure Boards for tracking security issues.

Question 9

A company is designing a security solution for their hybrid infrastructure that includes on-premises servers and Azure virtual machines. They need to ensure that all administrative access to servers is just-in-time (JIT) and just-enough-administration (JEA). Which Azure service should they use?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides JIT VM access and JEA capabilities through Azure Arc for on-premises servers, making it the correct choice. Azure AD Privileged Identity Management (PIM) is for user roles, not server access. Azure Bastion provides secure RDP/SSH access but not JIT. Azure Policy is for compliance, not JIT access.

Answer

Azure Bastion

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Azure Policy

Question 10

Which THREE components are required to implement a zero-trust network architecture in Azure using Microsoft security solutions?

Accepted Answer

Microsoft Defender for Cloud Apps. Azure AD Conditional Access enforces access policies. Microsoft Defender for Cloud Apps provides cloud access security broker (CASB) functionality. Azure Policy ensures compliance. Azure Bastion is for secure connectivity. Microsoft Sentinel is for SIEM, not a core zero-trust component.

Answer

Microsoft Sentinel

Answer

Azure Bastion

Question 11

Your company is designing a Zero Trust network for a hybrid workforce. Remote users connect via VPN to on-premises resources, while cloud apps use Microsoft Entra ID. You need to enforce conditional access based on device compliance and user risk. Which Microsoft security solution should you integrate with Entra ID to provide real-time device posture signals?

Accepted Answer

Microsoft Intune. Option C is correct because Microsoft Intune provides device compliance policies that integrate with Entra ID Conditional Access. Option A is wrong because Microsoft Defender for Cloud Apps is a CASB, not a device management solution. Option B is wrong because Microsoft Purview focuses on data governance. Option D is wrong because Microsoft Sentinel is a SIEM/SOAR, not a device management tool.

Answer

Microsoft Purview

Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Sentinel

Question 12

Which TWO Azure services should you use to implement a defense-in-depth strategy for protecting Azure virtual machines?

Accepted Answer

Network Security Groups (NSGs). Options A and D are correct because NSGs provide network segmentation and Azure Backup provides data protection. Option B is wrong because Azure Front Door is for global load balancing. Option C is wrong because Azure Logic Apps is an integration service. Option E is wrong because Azure Automation is for process automation.

Answer

Azure Logic Apps

Answer

Azure Automation

Answer

Azure Front Door

Question 13

Which THREE components are required to implement a Microsoft Sentinel solution that collects security logs from a multi-cloud environment including AWS and Azure? (Choose three.)

Accepted Answer

Log Analytics workspace. Option A is correct because Log Analytics workspace is the data store for Sentinel. Option B is correct because the Azure Monitor Agent (AMA) collects logs from Azure VMs. Option D is correct because a data connector for AWS (e.g., AWS CloudTrail) is needed to ingest logs. Option C is not required because Sentinel itself is the SIEM, not a separate component. Option E is not required because Azure Arc is optional for non-Azure servers but not required for AWS logs.

Answer

Microsoft Sentinel solution

Answer

Azure Arc

Question 14

Your company is migrating to a cloud-native security operations center (SOC) using Microsoft Sentinel. You need to design a solution that automatically investigates and remediates common incidents like brute-force attacks on Azure VMs. The solution should use playbooks triggered by analytics rules. Which Microsoft service should you use to create the playbooks, and what is the recommended authentication method?

Accepted Answer

Azure Logic Apps with managed identity. Azure Logic Apps is the recommended platform for Sentinel playbooks. Managed identity is the preferred authentication method because it avoids credential management and supports automation. Azure Automation is for runbooks, not playbooks. Service principal is possible but not recommended due to credential management.

Answer

Power Automate with user account

Answer

Azure Automation with service principal

Answer

Azure Functions with API key

Question 15

You are designing a secure hybrid network for a multinational company. They require encrypted communication between on-premises data centers and Azure, with high availability and no single point of failure. Which solution should you recommend?

Accepted Answer

Deploy ExpressRoute with a site-to-site VPN as a failover.. Option B is correct because ExpressRoute with a VPN gateway failover provides a private dedicated connection with encrypted site-to-site VPN as backup, meeting high availability and encryption. Option A is wrong because site-to-site VPN alone lacks the private dedicated connection. Option C is wrong because Azure Virtual WAN is a networking service, not a specific connectivity solution, and point-to-site VPN is for remote users. Option D is wrong because ExpressRoute does not encrypt traffic by default; encryption must be added separately.

Answer

Deploy a site-to-site VPN over the internet with two active VPN devices.

Answer

Deploy Azure Virtual WAN with point-to-site VPN for each data center.

Answer

Deploy ExpressRoute without encryption and rely on Microsoft backbone security.