SC-100 Practice Test 2 — 30 Questions

Question 1

A security architect is designing a data protection strategy for a Microsoft 365 tenant. The company must prevent users from sharing sensitive documents with external users via SharePoint Online. They want to apply a policy that automatically detects sensitive content and blocks external sharing. Which Microsoft Purview solution should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Data Loss Prevention (DLP) policy. Microsoft Purview Data Loss Prevention (DLP) policies can detect sensitive data and block external sharing. Option C is correct. Option A is wrong because sensitivity labels require manual application or automatic classification, but blocking external sharing is typically done by DLP. Option B is wrong because retention policies are for data retention, not blocking sharing. Option D is wrong because Microsoft Purview Information Protection is the umbrella, but the specific policy is DLP.

Answer

Sensitivity labels

Answer

Retention policies

Answer

Microsoft Purview Information Protection

Question 2

Your organization is using Microsoft Defender for Cloud to manage security across multiple Azure subscriptions. You need to ensure that all virtual machines in the subscriptions are monitored by Defender for Cloud and that security alerts are sent to the security operations team. You also need to enforce that any new VMs are automatically onboarded to Defender for Cloud. You have a Log Analytics workspace in the central subscription. What should you do?

Accepted Answer

In Defender for Cloud, enable auto-provisioning for the Log Analytics agent at the management group level and specify the central workspace.. Enabling auto-provisioning of the Log Analytics agent at the management group scope ensures all VMs across subscriptions are monitored and new VMs are automatically onboarded. Option A is wrong because configuring only the workspace does not auto-provision. Option B is wrong because Azure Policy can enforce agent deployment, but auto-provisioning is simpler and more direct. Option D is wrong because enabling Defender for Cloud at the subscription level does not automatically install the agent.

Answer

Enable Defender for Cloud on each subscription and configure email notifications for alerts.

Answer

Assign an Azure Policy that deploys the Log Analytics agent to all VMs.

Answer

Create a Log Analytics workspace in each subscription and configure Defender for Cloud to use that workspace.

Question 3

You are designing security for a web application that will be developed by an external vendor. The vendor will have access to the source code repository and the development environment. You need to ensure that no secrets (e.g., API keys, connection strings) are stored in the source code. What is the best approach to manage secrets for this application?

Accepted Answer

Use Azure Key Vault to store secrets and configure the application to use managed identity to retrieve them.. Using Azure Key Vault to store secrets and referencing them from the application is the standard best practice. The application can use managed identity to authenticate to Key Vault securely. Storing secrets in app settings is not secure if the repository is accessible. Using environment variables is better but still not as secure as Key Vault. Hardcoding is unacceptable.

Answer

Store secrets in environment variables on the application server.

Answer

Store secrets in Azure App Service application settings encrypted at rest.

Answer

Embed secrets in the compiled code using obfuscation.

Question 4

A security administrator applies the Azure Policy definition shown in the exhibit to a management group containing multiple subscriptions. After the policy is assigned, a development team reports they cannot create a new storage account in their subscription. What is the most likely cause?

Accepted Answer

The storage account was created with the 'Secure transfer required' setting disabled.. The Azure Policy definition in the exhibit likely includes an effect (e.g., 'Deny') that requires the 'Secure transfer required' setting to be enabled on storage accounts. When the development team attempts to create a storage account with this setting disabled, the policy denies the request, preventing the creation. This is the most direct cause because Azure Policy enforces compliance rules at resource creation time, and disabling secure transfer violates the policy's condition.

Answer

The storage account was created using an older API version that does not support Azure Policy enforcement.

Answer

The storage account was created in a region that does not support the premium tier.

Answer

The storage account was assigned a network security group (NSG) that blocks inbound HTTPS traffic.

Question 5

A company's security team wants to automate response to common incidents like malware detected on endpoints. They have Microsoft 365 Defender and Microsoft Sentinel. Which feature should they use to create automated playbooks?

Accepted Answer

Microsoft Sentinel automation rules and playbooks. Microsoft Sentinel's automation rules and playbooks are the correct choice because they are specifically designed to automate incident response by triggering predefined actions (e.g., running a Logic App) when a detection event, such as malware on an endpoint, is ingested from Microsoft 365 Defender. This integration allows security teams to create custom, automated workflows that respond to common incidents without manual intervention.

Answer

Microsoft Purview's data loss prevention policies

Answer

Azure Policy

Answer

Microsoft Defender for Cloud's workflow automation

Question 6

You are designing a hybrid identity solution for an organization that uses Microsoft Entra ID and an on-premises Active Directory. The organization requires that users who are located in a remote office without a direct VPN connection to the main office can authenticate against on-premises resources using their Entra ID credentials. The solution must minimize latency and support passwordless authentication. Which feature should you implement?

Accepted Answer

Implement Microsoft Entra Kerberos authentication. Microsoft Entra Kerberos authentication enables users to authenticate to on-premises resources using their Entra ID credentials without requiring a VPN, and it supports passwordless methods like FIDO2 and Windows Hello for Business. Option A is incorrect because Entra Application Proxy is designed for publishing on-premises web applications, not for general authentication. Option C is incorrect because Conditional Access policies enforce access controls but do not provide authentication or passwordless capabilities. Option D is incorrect because Entra Connect Sync with password hash synchronization only syncs password hashes and does not support real-time passwordless authentication without a VPN.

Answer

Configure Microsoft Entra Application Proxy

Answer

Enable Microsoft Entra Conditional Access policies

Answer

Deploy Microsoft Entra Connect Sync with password hash synchronization

Question 7

Which TWO of the following are best practices for securing Microsoft 365 tenants? (Choose two.)

Accepted Answer

Enable security defaults in Microsoft Entra ID. Enabling security defaults provides a baseline of security. Using Conditional Access policies allows granular access control. These are best practices. Disabling modern authentication is counterproductive. Allowing all external sharing is risky. Using basic authentication is insecure. So the correct two are A and B.

Answer

Enable basic authentication for all apps

Answer

Disable modern authentication for legacy protocols

Answer

Allow all external sharing in SharePoint

Question 8

A healthcare provider is building a new patient portal on Azure App Service. The portal calls a backend API hosted on Azure Functions. The security team requires that the API accept requests only from the portal, that the portal prove its identity to the API without storing secrets in code or configuration, and that the credentials rotate automatically. You need to recommend an authentication approach for the portal-to-API call. What should you recommend?

Accepted Answer

Enable a system-assigned managed identity on the App Service and use it to request an access token for the Azure Functions app.. The cleanest way for one Azure compute resource to authenticate to another without secrets is a managed identity. The App Service obtains a Microsoft Entra ID token for the Functions app's audience, and the Functions app validates the token and authorizes the specific identity. The credential lifecycle is handled by the platform, which satisfies the automatic rotation requirement and eliminates secret sprawl.

Answer

Store a client secret in Azure Key Vault and have the portal retrieve it at runtime to call the API.

Answer

Issue each portal instance a client certificate and configure mutual TLS between App Service and Azure Functions.

Answer

Configure IP restrictions on the Azure Functions app to allow only the App Service outbound IP addresses.

Question 9

A company uses Microsoft Entra ID with P2 licenses. They want to implement a Zero Trust approach that requires step-up authentication for accessing high-value data in SharePoint. The solution must use risk-based policies and minimize user friction. Which combination should you recommend?

Accepted Answer

Microsoft Entra Conditional Access with sign-in risk policy and authentication context for sensitive data. It combines Conditional Access with a sign-in risk policy (from Identity Protection) and an authentication context that is applied to sensitive SharePoint data. This enforces step-up authentication only when risk is detected and the user accesses high-value data, minimizing friction for low-risk sessions while meeting Zero Trust requirements.

Answer

Microsoft Entra Conditional Access with trusted locations policy

Answer

Azure AD Conditional Access with MFA for all SharePoint access

Answer

Microsoft Entra Identity Protection user risk policy with MFA

Question 10

Order the steps to configure a Conditional Access policy requiring MFA for all users.

Accepted Answer

Assign users and groups → Assign cloud apps → Configure access controls (require MFA) → Enable policy. Conditional Access policy creation involves assignments for users and apps, then access controls like MFA.

Answer

Assign cloud apps → Assign users and groups → Configure access controls (require MFA) → Enable policy

Answer

Enable policy → Assign users and groups → Assign cloud apps → Configure access controls (require MFA)

Answer

Assign users and groups → Configure access controls (require MFA) → Assign cloud apps → Enable policy

Question 11

Trey Research, a biotech firm, is developing a machine learning model on Azure Machine Learning that uses sensitive genomic data. The data is stored in Azure Blob Storage. The company requires that all data be encrypted at rest using customer-managed keys stored in Azure Key Vault, and that access to the storage account be restricted to the Azure Machine Learning workspace and specific data scientists via Azure AD authentication. Additionally, the storage account must be accessible only from the company's virtual network. Which of the following configurations should you implement?

Accepted Answer

Enable encryption at rest with a customer-managed key, configure a private endpoint for the storage account, and grant the Machine Learning workspace and data scientists access using Azure RBAC with the Storage Blob Data Contributor role.. It provides encryption at rest with a customer-managed key (CMK) stored in Azure Key Vault, a private endpoint to restrict access to the company's virtual network, and Azure RBAC with the Storage Blob Data Contributor role for both the Machine Learning workspace and data scientists, ensuring Microsoft Entra ID authentication. Option A is wrong because firewall rules using IP ranges are less secure than private endpoints, and granting access via storage account access keys bypasses Microsoft Entra ID authentication. Option B is wrong because it uses a service-managed key, which does not meet the customer-managed key requirement. Option D is wrong because a service endpoint is less secure than a private endpoint, and using a SAS token does not provide Microsoft Entra ID-based access control.

Answer

Enable encryption at rest with a customer-managed key, configure a firewall to allow the Machine Learning workspace's IP range, and grant data scientists access via storage account access keys.

Answer

Enable encryption at rest with a service-managed key, configure a private endpoint, and grant data scientists access using Azure RBAC with the Storage Blob Data Reader role.

Answer

Enable encryption at rest with a customer-managed key, configure a service endpoint for the storage account, and grant the Machine Learning workspace access using a SAS token.

Question 12

A government agency, Northwind, is deploying a sensitive application on Azure App Service Environment (ASE) v3. The application handles classified data and must meet FedRAMP High requirements. You need to design a security solution that includes: (1) encryption at rest for the app's content and configuration, (2) encryption in transit with TLS 1.2 or higher, (3) network isolation using VNet integration and private endpoints, (4) identity-based access to Azure SQL Database using managed identity, and (5) certificate management for custom domains using Azure Key Vault. Which of the following designs meets all requirements?

Accepted Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.. ASE v3 provides a fully isolated, single-tenant App Service environment deployed into a customer VNet, which is required for FedRAMP High and network isolation. It also correctly combines HTTPS-only with TLS 1.2, a system-assigned managed identity for passwordless Azure SQL authentication, and Key Vault for certificate management — all of which are supported natively in ASE v3. The other options either use multi-tenant App Service (not isolated) or substitute components that don't meet the full requirement set.

Answer

Deploy the app on a multi-tenant App Service plan, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.

Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a user-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from App Service certificates.

Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a service principal to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.

Question 13

You are a security architect for a large enterprise that is migrating to Microsoft 365. The organization has 50,000 users across multiple regions. They have recently experienced a ransomware attack that encrypted files on SharePoint Online and OneDrive for Business. The security team wants to implement a comprehensive protection strategy. Requirements: 1. Automatically detect and block ransomware-like behavior in real-time. 2. Provide users with self-service recovery of files encrypted by ransomware. 3. Ensure that all files in SharePoint and OneDrive are scanned for malware upon upload. 4. Minimize administrative overhead. Which combination of Microsoft 365 security features should you recommend?

Accepted Answer

Enable Microsoft Defender for Office 365 to scan files on upload and use version history and recycle bin for recovery.. Microsoft Defender for Office 365 provides real-time scanning of files uploaded to SharePoint and OneDrive, detecting and blocking known malware. Combined with version history and the recycle bin, users can self-recover files encrypted by ransomware without administrative intervention, satisfying all requirements with minimal overhead.

Answer

Use Microsoft Entra ID Protection to detect compromised accounts and automatically block access.

Answer

Enable Microsoft Endpoint DLP and configure file policies to block encrypted files.

Answer

Configure Microsoft Purview auto-labeling to apply a 'Ransomware' label and then block all labeled files.

Question 14

Which TWO are recommended practices for securing Microsoft 365 workloads? (Select two.)

Accepted Answer

Enable unified audit logging in Microsoft Purview. Option D is correct because enabling unified audit logging in Microsoft Purview ensures that user and admin activities across Exchange Online, SharePoint Online, OneDrive, and Teams are recorded, which is essential for incident investigation, forensic analysis, and compliance reporting. Option E is correct because a Microsoft Defender for Office 365 Safe Attachments policy detonates email attachments in a sandbox before delivery, blocking zero-day malware and malicious payloads that traditional signature-based filtering would miss. The unmarked options do not belong: A weakens security by exposing SharePoint content externally, B undermines account protection by removing MFA even for trusted IPs (which can be spoofed or compromised), and C grants broad OAuth access to third-party apps, increasing the risk of data exfiltration and consent-phishing attacks.

Answer

Allow external sharing for all SharePoint sites

Answer

Disable multifactor authentication for users who access from trusted IPs

Answer

Allow all third-party apps to access Microsoft 365 data

Question 15

Which TWO of the following are key components of a Zero Trust architecture according to Microsoft? (Choose two.)

Accepted Answer

Use least privilege access. Option D, 'Verify explicitly,' is correct because Microsoft's Zero Trust model requires that every access request be authenticated and authorized based on all available data points, including user identity, device health, location, and data sensitivity, rather than assuming trust based on network location. Option C, 'Use least privilege access,' is correct because Zero Trust limits user access with just-in-time and just-enough-access (JIT/JEA) principles, risk-based adaptive policies, and data protection to minimize lateral movement and exposure. The three guiding principles Microsoft defines are verify explicitly, use least privilege access, and assume breach, so these two options align directly with that framework. Option A, 'Trust but verify,' is not a Zero Trust principle; it reflects a traditional perimeter mindset where trust is initially granted. Option B, 'Implicit trust for internal traffic,' contradicts Zero Trust, which removes implicit trust based on network location. Option E, 'Rely on a strong perimeter,' is also contrary to Zero Trust, which assumes the perimeter can be breached and therefore does not rely on it for security.

Answer

Trust but verify

Answer

Implicit trust for internal traffic

Answer

Rely on a strong perimeter

Question 16

You are the security architect for a company that uses Microsoft Defender for Cloud. The company has Azure virtual machines (VMs) and on-premises Windows Servers onboarded to Microsoft Defender for Servers Plan 2. The security team requires that all servers be protected against fileless attacks and that suspicious process behavior be detected in near real-time. You need to recommend a solution that meets these requirements while minimizing administrative effort. What should you include in your recommendation?

Accepted Answer

Enable Microsoft Defender for Endpoint integration and ensure that the automatic provisioning of the Microsoft Defender for Endpoint agent is turned on for all supported machines.. The requirement is for advanced endpoint detection and response, specifically fileless attack detection and behavioral monitoring. Microsoft Defender for Servers Plan 2 includes Defender for Endpoint integration, which delivers these capabilities. Automatic provisioning ensures the agent is deployed to all supported machines with minimal administrative effort, satisfying both the technical and operational requirements.

Answer

Enable just-in-time (JIT) VM access for all servers to limit exposure to brute-force attacks.

Answer

Configure adaptive application controls in Microsoft Defender for Cloud to allow only approved applications to run on the servers.

Answer

Deploy the Log Analytics agent to all servers and create custom alerts based on Windows Security event logs.

Question 17

Your organization uses Microsoft Sentinel as its SIEM. You need to design a solution to automatically respond to detected threats in Azure resources. The response must include isolating the affected virtual machine and creating a support ticket. Which approach should you use?

Accepted Answer

Create a Microsoft Sentinel automation rule that triggers a playbook when an incident is generated. The playbook uses Azure Logic Apps to isolate the VM and create a ticket in your IT service management tool.. Microsoft Sentinel automation rules can trigger playbooks (Azure Logic Apps) when incidents are generated. Logic Apps provide native connectors to isolate Azure VMs (via the Azure Resource Manager connector) and create tickets in IT service management tools (e.g., ServiceNow, Jira), meeting both requirements in a single automated workflow.

Answer

Create an Azure Policy initiative that automatically remediates non-compliant resources

Answer

Create a Microsoft Sentinel analytics rule that runs a KQL query and automatically sends an email to the security team

Answer

Create an Azure Automation runbook that runs on a schedule to check for threats and isolate VMs

Question 18

Refer to the exhibit. You are reviewing a Conditional Access policy in Microsoft Entra ID. Based on the JSON snippet, what is the most likely outcome when a user with high user risk attempts to sign in?

Accepted Answer

The sign-in is blocked because user risk is high. The Conditional Access policy shown in the JSON snippet includes a condition for 'userRiskLevels' set to 'high', and the grant control is 'block'. When a user with high user risk attempts to sign in, the policy evaluates the user risk level and, since it matches the condition, applies the block action, preventing the sign-in entirely.

Answer

The sign-in is blocked only if sign-in risk is also high

Answer

The sign-in is allowed because sign-in risk is not high

Answer

The user is prompted for multi-factor authentication

Question 19

Your organization uses Microsoft Sentinel for security operations. You need to ensure that all incidents related to a specific critical asset are automatically assigned to the senior SOC analyst. The assignment should occur as soon as the incident is created. What should you configure?

Accepted Answer

Create an automation rule that sets the incident owner to the senior SOC analyst.. Automation rules in Microsoft Sentinel can directly set the incident owner upon creation without requiring a playbook. This is the simplest and most efficient method for immediate assignment, as automation rules run automatically when an incident is created and can modify incident properties like owner.

Answer

Modify the analytics rule to include a custom details field for owner.

Answer

Create a playbook and trigger it from an automation rule.

Answer

Configure a workbook to display incidents and manually assign them.

Question 20

Your organization is implementing a zero-trust security model. You need to design a solution that continuously verifies user identity, device compliance, and access context before granting access to corporate resources. The solution should also support risk-based policies. Which Microsoft security capability should be at the core of this design?

Accepted Answer

Microsoft Entra ID Conditional Access. Microsoft Entra ID Conditional Access is the core policy engine for zero-trust, enabling continuous verification of user identity, device compliance, and access context before granting resource access. It integrates with risk signals from Microsoft Entra ID Protection to enforce risk-based policies, such as requiring multi-factor authentication when sign-in risk is high. This aligns directly with the zero-trust principle of 'never trust, always verify' by evaluating conditions in real time.

Answer

Microsoft Defender for Identity

Answer

Microsoft Sentinel

Answer

Microsoft Intune