SC-100 Practice Test 2 — 30 Questions

Question 1

A company uses Microsoft Entra ID for identity management. They want to ensure that only managed devices can access corporate email. Which Conditional Access policy setting should be configured?

Accepted Answer

Require device to be marked as compliant. To ensure only managed devices can access corporate email, you need to enforce device compliance. The Conditional Access policy setting 'Require device to be marked as compliant' checks that the device is enrolled in Microsoft Intune and meets all compliance policies (e.g., encryption, OS version, jailbreak detection) before granting access. This directly restricts access to managed devices only.

Answer

Require multifactor authentication

Answer

Block legacy authentication

Answer

Require approved client app

Question 2

Your organization uses Microsoft Purview Information Protection and Microsoft Defender for Cloud Apps. You need to design a solution that automatically applies a 'Confidential' sensitivity label to documents that contain credit card numbers and are shared externally. The solution should also generate an alert when this occurs. Which two configurations should you implement? (Choose TWO.)

Accepted Answer

Create a Microsoft Purview auto-labeling policy that includes the 'Credit Card Number' sensitive info type and specifies the 'Confidential' label.. Options D and E are correct because an auto-labeling policy in Microsoft Purview can scan for sensitive info types (credit card numbers) and automatically apply the 'Confidential' label to documents. A Microsoft Defender for Cloud Apps app governance policy can monitor file sharing and trigger an alert when a document with the 'Confidential' label is shared externally. Option A (Microsoft Sentinel analytics rule) could generate alerts but is not the primary mechanism for labeling, and option B (Conditional Access) controls access, not labeling. Option C (Data Loss Prevention) is for blocking, not labeling.

Answer

Configure a Microsoft Sentinel analytics rule that queries audit logs for external sharing of labeled documents and generates an incident.

Answer

Create a Conditional Access policy in Microsoft Entra ID that requires device compliance when accessing documents labeled 'Confidential'.

Answer

Configure a Microsoft Purview Data Loss Prevention (DLP) policy that blocks the sharing of documents containing credit card numbers.

Question 3

Your company uses Microsoft Defender for Cloud to secure Azure workloads. You need to ensure that all storage accounts have the 'Secure transfer required' setting enabled. What should you use?

Accepted Answer

Azure Policy. Azure Policy can audit and enforce the 'Secure transfer required' setting across all storage accounts. Option A (RBAC) is incorrect because RBAC controls access permissions, not resource configuration. Option B (Azure Blueprints) is deprecated and not the direct solution for this requirement. Option C (Microsoft Defender for Cloud regulatory compliance dashboard) provides visibility but does not enforce settings.

Answer

Azure role-based access control (RBAC)

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Question 4

A company is implementing a Zero Trust identity strategy. They want to ensure that only compliant and managed devices can access corporate resources. Which THREE components should they include in their solution? (Choose three.)

Accepted Answer

Microsoft Intune for device management and compliance policies. A is correct because Microsoft Intune provides device management and compliance policies that define the security posture required for managed devices, such as requiring encryption, a minimum OS version, or a specific patch level. These compliance policies are evaluated by Azure AD during authentication, ensuring only devices that meet the organization's security standards can access corporate resources.

Answer

Azure AD Application Proxy

Answer

Azure AD B2B collaboration

Question 5

Your organization is adopting a Zero Trust security model. You need to design a solution that ensures continuous verification of user identity and device health before granting access to resources. Which Microsoft Entra ID feature should you prioritize?

Accepted Answer

Microsoft Entra ID Conditional Access. Conditional Access is the primary Microsoft Entra ID feature that enforces continuous verification by evaluating user identity, device health (via compliance policies or Microsoft Defender for Endpoint signals), location, and risk in real-time before granting access. It directly supports the Zero Trust principle of 'never trust, always verify' by requiring authentication and authorization at every access attempt, not just at the perimeter.

Answer

Microsoft Entra ID Domain Services

Answer

Microsoft Entra ID Identity Protection

Answer

Microsoft Entra ID Privileged Identity Management (PIM)

Question 6

You are a security architect for a large financial services company. The company has a hybrid identity environment with on-premises Active Directory synchronized to Microsoft Entra ID using Microsoft Entra Connect. They use Microsoft 365 E5 licenses and have deployed Microsoft Defender for Cloud, Microsoft Defender for Identity, Microsoft Sentinel, and Microsoft Purview. The company has recently suffered a ransomware attack where an attacker gained access via a compromised service account that had permanent Global Administrator privileges. The attacker then used the account to create a backdoor user and exfiltrate sensitive data from SharePoint Online. After the incident, the CISO mandates a Zero Trust security transformation with the following requirements: 
1. Eliminate standing privileged access for all cloud admins.
2. Require phishing-resistant authentication for all privileged roles.
3. Ensure that all sensitive data in SharePoint Online is automatically classified and protected.
4. Enable detection of lateral movement using anomalous behavior analytics. Which combination of actions should you recommend?

Accepted Answer

Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.. It directly addresses all four CISO requirements: Privileged Identity Management (PIM) eliminates standing Global Administrator privileges by requiring just-in-time activation; Authentication Strengths with FIDO2 enforces phishing-resistant authentication for privileged roles; auto-labeling policies in Microsoft Purview automatically classify and protect sensitive data like credit card numbers in SharePoint Online; and Defender for Identity lateral movement path detection uses behavioral analytics to detect anomalous lateral movement, fulfilling the detection requirement.

Answer

Deploy Microsoft Entra Identity Protection for all users, configure Azure AD Conditional Access with MFA, use Microsoft Purview Information Protection with manual labeling, and enable Microsoft Sentinel analytics for lateral movement.

Answer

Configure Conditional Access to require MFA for admins, enable Microsoft Purview DLP for SharePoint, deploy Defender for Cloud Apps, and use Identity Protection for user risk.

Answer

Remove all permanent admin roles and use just-in-time access via PIM, enforce MFA via Conditional Access, apply sensitivity labels via Microsoft Purview Data Map, and use Microsoft Defender for Cloud for network security groups.

Question 7

Your organization uses Microsoft Sentinel and wants to correlate security events from multiple sources to detect multi-stage attacks. What should you create?

Accepted Answer

Fusion rule. Fusion rules in Microsoft Sentinel are specifically designed to correlate security events from multiple sources and detect multi-stage attacks by combining alerts from different detection technologies into a single incident. This matches the requirement to correlate events across sources for complex attack chains, unlike other rule types that focus on single-source or single-event detection.

Answer

Scheduled query rule

Answer

NRT rule

Answer

Anomaly rule

Question 8

A company uses Azure DevOps and wants to implement a DevSecOps practice by scanning code for secrets and vulnerabilities before deployment. Which tool should they integrate into their pipeline?

Accepted Answer

Microsoft Defender for DevOps. Microsoft Defender for DevOps is the correct choice because it is a unified DevSecOps solution that integrates directly into Azure DevOps pipelines to scan code for secrets, vulnerabilities, and open-source dependencies before deployment. It provides actionable security insights and remediation guidance, aligning with the requirement to implement a DevSecOps practice by scanning code for secrets and vulnerabilities.

Answer

Azure Policy

Answer

Microsoft Purview

Answer

GitHub Advanced Security

Question 9

A company is designing a security strategy for their AI-powered applications using Microsoft Azure OpenAI Service. They need to ensure that the AI models are not used to generate harmful content and that the data sent to the models is protected. Which Microsoft Purview feature should they use?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) for AI. Microsoft Purview Data Loss Prevention (DLP) for AI is the correct feature because it is specifically designed to monitor and control the data sent to and from AI applications, including Azure OpenAI Service, to prevent the generation of harmful content and protect sensitive data. It uses deep content analysis and policy-based controls to detect and block policy violations in real-time, directly addressing the dual requirements of content safety and data protection.

Answer

Microsoft Purview Endpoint DLP

Answer

Microsoft Purview Information Protection

Answer

Microsoft Purview Audit

Question 10

A company uses Azure App Service to host a web application that stores sensitive data in Azure SQL Database. The security team requires that data at rest in the database be encrypted using a customer-managed key stored in Azure Key Vault. The key must be rotated automatically every 90 days. What is the recommended approach to meet these requirements?

Accepted Answer

Enable TDE with customer-managed keys in Azure Key Vault and set a key rotation policy in Key Vault to rotate the key every 90 days.. Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure Key Vault meets the requirement for encrypting data at rest in Azure SQL Database using a key controlled by the customer. Azure Key Vault supports automatic key rotation policies that can be set to rotate the key every 90 days, satisfying the rotation requirement without manual intervention or application code changes.

Answer

Encrypt sensitive columns using cell-level encryption with keys stored in Azure Key Vault and rotate keys manually every 90 days.

Answer

Enable Transparent Data Encryption (TDE) with service-managed keys in Azure SQL Database.

Answer

Use Always Encrypted with column master keys stored in Azure Key Vault and configure key rotation in the application code.

Question 11

A company is designing a defense-in-depth strategy for their Azure environment. They want to ensure that if a virtual machine is compromised, the attacker cannot move laterally to other VMs in the same virtual network. Which security control should they prioritize?

Accepted Answer

Implement network segmentation using NSGs and application security groups. Network segmentation using NSGs and application security groups is the correct priority because it directly controls east-west traffic between VMs within the same virtual network. By defining explicit inbound and outbound rules that restrict communication to only necessary ports and protocols (e.g., TCP 443 for HTTPS), an attacker who compromises one VM cannot initiate lateral movement to other VMs, as the NSG will drop unauthorized traffic at the subnet or NIC level.

Answer

Enable Azure DDoS Protection on the virtual network

Answer

Enable multi-factor authentication (MFA) for all admin accounts

Answer

Deploy Azure Bastion for secure remote access

Question 12

Tailwind Traders is a small business that uses Microsoft 365 Business Premium. They have no dedicated IT staff. The owner wants to implement basic security measures to protect against common threats like phishing, ransomware, and unauthorized access. They need a simple, cost-effective solution that aligns with Microsoft's security best practices for small businesses. Which set of actions should you recommend?

Accepted Answer

Enable Security Defaults in Microsoft Entra ID to enforce MFA for all users. Configure Microsoft Defender for Office 365 to protect against phishing and malware. Use Microsoft Defender for Business (included) for endpoint protection. Regularly review the Microsoft 365 Secure Score and implement top recommendations.. It aligns with Microsoft's security best practices for small businesses with no dedicated IT staff. Security Defaults in Microsoft Entra ID provide a baseline of MFA enforcement without requiring complex configuration. Microsoft Defender for Office 365 and Defender for Business (included in Microsoft 365 Business Premium) offer integrated phishing, malware, and endpoint protection. Regularly reviewing the Secure Score ensures continuous improvement against common threats like ransomware and unauthorized access.

Answer

Implement Privileged Identity Management (PIM) for all accounts. Use Azure Information Protection to classify all emails. Set up a SIEM using Microsoft Sentinel.

Answer

Deploy Microsoft Intune to manage devices. Configure Conditional Access policies to require compliant devices. Use Microsoft Defender for Endpoint for antivirus. Set up a VPN for remote access.

Answer

Purchase Azure AD Premium P2 for all users. Use Identity Protection to detect risks. Configure Conditional Access with session controls. Use Azure AD Identity Governance for access reviews.

Question 13

A company uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data. They want to prevent users from sharing credit card numbers in email but allow sharing via encrypted email. What should they configure?

Accepted Answer

Configure a DLP rule that blocks sharing unless the email is encrypted, with user override. Microsoft Purview DLP can enforce a policy that blocks sharing of credit card numbers unless the email is encrypted, with a user override option to allow legitimate encrypted sharing. This directly meets the requirement to prevent unencrypted sharing while permitting encrypted email transmission, leveraging DLP's ability to inspect email content and conditionally apply actions based on encryption status.

Answer

Assign a sensitivity label that encrypts the email automatically

Answer

Create a Microsoft Purview Message Encryption policy

Answer

Use Exchange mail flow rules to block unencrypted credit card data

Question 14

Your organization is migrating to Microsoft 365 and wants to implement a defense-in-depth strategy for email security. Which combination of Microsoft services should you use?

Accepted Answer

Microsoft Defender for Office 365 and Exchange Online Protection. Defense-in-depth for email security requires layered protection at the transport, filtering, and post-delivery stages. Exchange Online Protection (EOP) provides baseline anti-malware, anti-spam, and transport rules, while Microsoft Defender for Office 365 adds advanced threat protection like Safe Attachments, Safe Links, and anti-phishing policies that inspect URLs and attachments in real time. Together, they cover the full email threat chain from ingress to user interaction.

Answer

Microsoft Purview Compliance Manager and Microsoft Defender for Cloud Apps

Answer

Microsoft Intune and Microsoft Entra ID

Answer

Microsoft Sentinel and Microsoft Defender for Identity

Question 15

Which TWO configurations are required to enable Microsoft Defender for Cloud Apps to monitor cloud app usage?

Accepted Answer

Add app connectors for the cloud apps you want to monitor. A is correct because Microsoft Defender for Cloud Apps requires app connectors to establish API-based connections with cloud applications (e.g., Office 365, Salesforce, AWS). These connectors enable the service to ingest activity logs, file metadata, and user sessions for monitoring and threat detection. Without app connectors, Defender for Cloud Apps cannot access the cloud app's data plane to perform its core monitoring functions.

Answer

Configure Microsoft Intune device compliance policies

Answer

Deploy Azure Information Protection scanner

Answer

Synchronize with Microsoft Entra ID

Question 16

A financial services company uses Microsoft Sentinel for SIEM. They need to detect potential data exfiltration from their Azure SQL Database. Which THREE data sources should they connect to Sentinel to achieve this? (Choose THREE.)

Accepted Answer

Azure Network Watcher NSG flow logs. Azure SQL Database audit logs (Option D) capture detailed information about database queries and operations, which can help detect unauthorized data access. Azure Activity Logs (Option E) provide visibility into management-plane events such as changes to database configurations or firewall rules. Network Security Group (NSG) flow logs (Option C) show network traffic patterns to and from Azure SQL Database, enabling the detection of abnormal data transfer volume or patterns indicative of exfiltration. Options A and B are incorrect: Microsoft Defender for Cloud alerts provide security recommendations and alerts but not raw data exfiltration details; Azure AD sign-in logs focus on user authentication events, not database operations.

Answer

Microsoft Defender for Cloud alerts

Answer

Azure AD sign-in logs

Question 17

Which TWO actions should you take to implement a zero-trust identity strategy in Microsoft Entra ID?

Accepted Answer

Require multi-factor authentication for all users. For a zero-trust identity strategy in Microsoft Entra ID, requiring multi-factor authentication (MFA) for all users (option B) is a fundamental control to verify identity. Configuring Conditional Access policies based on user risk and device compliance (option E) enforces adaptive, context-aware access. Option A (single sign-on) improves user experience but does not directly enforce zero-trust. Option C (passwordless authentication) enhances security but is not a specific zero-trust action; MFA is more critical. Option D (synchronizing identities) supports hybrid scenarios but does not advance zero-trust principles.

Answer

Enable single sign-on for all applications

Answer

Implement passwordless authentication for all users

Answer

Synchronize all on-premises identities to the cloud

Question 18

A global enterprise uses Microsoft Entra ID with Privileged Identity Management (PIM) and Conditional Access. They need to ensure that all privileged role activations require an approval workflow, and that the approval process is documented for compliance. What configuration should they implement?

Accepted Answer

In PIM, edit the role settings to require approval for activation. In PIM, you can configure role settings to require approval for activation, which ensures that every privileged role activation goes through an approval workflow and is documented in audit logs. Option A is incorrect because Authentication Strength in Conditional Access enforces MFA, not approval. Option C is incorrect because access reviews are for periodic attestation, not for per-activation approval. Option D is incorrect because role-assignable groups allow group-based role assignments but do not enforce an approval workflow for activation.

Answer

Create a Conditional Access policy requiring an Authentication Strength

Answer

Configure an access review for the privileged roles

Answer

Create a role-assignable group and assign the privileged role to the group

Question 19

Refer to the exhibit. You are reviewing an ARM template that deploys a network security group (NSG) for a web application. The NSG allows inbound HTTP traffic from any source and then denies all other inbound traffic. However, after deployment, you find that HTTP traffic is being blocked. What is the most likely cause?

Accepted Answer

The DenyAll rule has a higher priority than the AllowHTTP rule, so it takes precedence.. The DenyAll rule has a higher priority (lower priority number) than the AllowHTTP rule, so it is evaluated first and blocks all traffic, including HTTP. To fix this, the AllowHTTP rule should have a higher priority (lower number) than the DenyAll rule.

Answer

The AllowHTTP rule uses sourcePortRange '*' which conflicts with the DenyAll rule.

Answer

The NSG is not associated with the subnet or network interface where the web server is deployed.

Answer

The DenyAll rule uses protocol '*' which blocks all traffic including HTTP.

Question 20

Your company uses Azure Firewall to filter outbound traffic from a virtual network. You need to allow only HTTP and HTTPS traffic to specific FQDNs, while blocking all other outbound traffic. Which Azure Firewall rule type should you use?

Accepted Answer

Application rule. Application rules in Azure Firewall allow filtering outbound traffic based on fully qualified domain names (FQDNs) for HTTP and HTTPS protocols. Option A is wrong because NAT rules only perform destination network address translation, not FQDN filtering. Option C is wrong because threat intelligence rules are used to block traffic from known malicious IP addresses, not for allowing FQDNs. Option D is wrong because network rules filter traffic based on IP addresses, ports, and protocols, not FQDNs.

Answer

NAT rule

Answer

Threat intelligence rule

Answer

Network rule